topic Re: Webex Control Hub - SSO in Webex Administration

Webex Control Hub - SSO

RobT1923 — Tue, 10 Mar 2026 10:07:29 GMT

I have a few queries regarding SSO on WebEx control hub and was hoping someone may be able to answer the below:

Is it possible to enable SSO on WebEx control hub, whilst allowing some users to sign in using their WebEx credentials rather than SSO?
Is it possible to have 2 WebEx tenants configured to the same SSO provider. Example User WebEx tenant and Device WebEx tenant both using a single Microsoft tenant for SSO.

Thanks

Re: Webex Control Hub - SSO

Jonathan Schulenberg — Tue, 10 Mar 2026 18:38:45 GMT

Yes with IdP routing rules. You can have an ordered list of match logic based on email domain of the user account or group membership with a last resort option without a match criteria. Be advised that some InfoSec folks feel that the ability to bypass SSO is a risk, so be sure you get the relevant approvals internally before configuring this.
First, I wanted to warn "don't do this!" Users and endpoints absolutely belong in the same tenant; some features only work intra-tenant. To answer the question directly though: only one Webex tenant could use the Entra ID Wizard App integration (i.e. the easy button.). The other would need to use SAML/OIDC, and optionally SCIM 2.0 for account synchronization, the hard way from Entra as an enterprise application.

Re: Webex Control Hub - SSO

RobT1923 — Wed, 11 Mar 2026 13:00:26 GMT

Thanks, would you be able to say which features only work intra-tenant?
The devices are going to be in Teams mode or Room OS utilising OBTJ.
Thanks

Re: Webex Control Hub - SSO

Jonathan Schulenberg — Mon, 16 Mar 2026 21:37:57 GMT

I'm reluctant to even answer this question because it's such a bad idea. It will make everything more difficult, even sourcing. This is not how Control Hub was designed to function. Why do you want to separate them so badly?

Re: Webex Control Hub - SSO

RobT1923 — Tue, 17 Mar 2026 09:43:52 GMT

I don't want to separate them, i want them on the same tenant but management has asked for them to be separate and i can only see it causing issues.

One of the reasons for separating was due to the fact that its a tenant shared by multiple regions, and they didn't want other regions managing devices. I've been able to confirm that location admin is the way to go for this so that helps my argument for staying on one tenant.