Consolidating Two Webex Organizations and Correcting License Overconsumption
Northwind Retail has 8,500 employees after acquiring a 2,500-user chain. It operates two Webex Control Hub organizations: the original org uses Azure AD SSO and Directory Connector for 6,000 users; the acquired org has 2,500 users managed by CSV and local passwords. The acquired org's domain is not claimed in the original org. License inventory: 1,200 Webex Meetings, 6,000 Messaging, and 350 Webex Calling. The Control Hub license report shows 1,450 Meeting licenses consumed and 700 unassigned Messaging licenses. Users report “You do not have a Webex license” when joining a meeting; some appear twice in the directory with alias email addresses. The acquired company has 300 contractors who should only have Messaging. IT wants a single org before next quarter.
1. Plan the consolidation of the two Control Hub organizations. What must be checked about domains, SSO, directory sync, and identities before merging, and what is the safe sequence?
Read the worked answer
Treat this as an identity and domain cutover, not a simple license move. First inventory both orgs: verified domains, SSO configuration, Directory Connector groups, CSV-created users, aliases, and active licenses. The acquired domain must be verified in the target org by DNS TXT record before users can be claimed. Do not enable SSO in the target until the IdP attribute mappings are tested, because a failed SSO cutover can lock out administrators.
Safe sequence: (1) back up user and license exports; (2) verify the acquired domain in the target org; (3) configure and test SSO in the target with a small pilot group; (4) extend Directory Connector to the acquired AD groups and let users be created or matched by primary email; (5) reassign licenses through templates; (6) migrate or recreate Webex Calling users with care because numbers and devices are service-specific; (7) decommission CSV accounts and the source org. The duplicate alias identities must be resolved before sync, or the merge will create two active accounts and consume extra licenses.
2. Diagnose the license overconsumption and activation failures. What data would you pull and what immediate remediation would you apply?
Read the worked answer
Pull the Control Hub license usage report, the assigned-license export, the inactive-user report, and the directory user export. Compare assigned versus consumed: 1,450 Meeting licenses consumed against 1,200 purchased means overassignment or duplicate identities, not a meeting join defect. Duplicate alias accounts are a likely cause, along with licenses left on departed users and CSV assignments that were never reclaimed. The 700 unassigned Messaging licenses suggest allocation is manual and inconsistent.
Immediate remediation: identify and merge or delete duplicate identities; reclaim licenses from users inactive beyond policy; remove Meeting licenses from Messaging-only users; verify that no site admin assigned licenses outside the approved template. Then test activation with a clean account in the target org. “You do not have a Webex license” often means the user exists in the wrong org, has an alias identity, or has a Messaging license but is joining a meeting that requires a Meetings license. Confirm the meeting type and the license actually assigned before changing anything.
3. What role model and license template design would you recommend for 8,500 users including 300 contractors?
Read the worked answer
Use least privilege and template-driven assignment. Keep full Control Hub admins to a small central team; give help desk a read-only or user-management role scoped to their region; give site admins only user and license assignment rights for their groups. Do not give contractors admin roles. Define license templates by directory group: contractors get Messaging only; retail managers get Messaging plus Meetings; Webex Calling users get Calling plus the appropriate Messaging base. Attach templates to synced AD groups so joiner/mover/leaver changes do not depend on CSV uploads.
Before assigning, confirm the licensing model supports the intended meeting experience and that Calling users are not double-licensed. Set automatic license reclamation for inactive users and require a monthly reconciliation export. For the 300 contractors, also confirm external communication and meeting creation policies, because a license alone does not restrict who they can call or meet with. Document exceptions rather than creating one-off assignments, which is how the current overconsumption likely developed.