Troubleshoot Single Sign On Admin Self Recovery Option

Available Languages

Download Options

  • PDF     (591.6 KB)
    View with Adobe Reader on a variety of devices
  • ePub     (671.6 KB)
    View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone
  • Mobi (Kindle)     (422.8 KB)
    View on Kindle device or Kindle app on multiple devices
Updated:August 12, 2026
Document ID:220390

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Introduction

This document describes the Admin-Self recovery for Control Hub, if Single Sign-On (SSO) does not work.

Prerequisites

Requirements

Cisco recommends that you have knowledge of these topics:

  • Single Sign-On
  • Webex Control Hub

Components Used

The information in this document is based on these software and hardware versions:

  • Azure AD ldP

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.                

Background

Previously, when an Administrator had a failed log in with SSO, ldP or the SP certificate expired if there was an outage for misconfiguration; users were required to contact TAC to disable SSO from the backend to repair the configuration.

The Self Recovery option allows users to update or disable Single Sign-On with a secure backdoor API.

Log In Error

This is an example of when SSO is compromised and cannot access admin.webex.com or Webex.

SSO CompromisedError

Single Sign-On Bypass

  1. Preferably using an incognito browser, go to Webex - Manage SSO and enter the admin email.

Webex Control Hub LoginLogin

2. Select Send One Time Password.

Webex Control Hub Login - Request One Time PasswordLogin 2

3. A one time password PIN is sent from webex_comm@webex.com.

Webex Control Hub - Enter PINLogin 3

4. Enter the one-time PIN received, and click the Sign In button.

Webex Control Hub Sign-inLogin 4

5. In the SSO Recovery Option, choose Option 1: disable SSO or Option 2: update certificate and download metadata.

SSO Recovery Options - Disable SSO and Update Certificate and Download MetadataLogin 5

Option 1

  1. Select the toggle Modify your organization's SSO authentication.

Modify your Organization's SSO AuthenticationOption 1

2. Confirm the action and select the Deactivate button.

Deactivation Single Sign-onOption 1 - 2

3. Single Sign-On is successfully disabled and your basic Webex authentication is in place.

Option 2

  1. Choose a Certificate and upload the updated ldP Metadata file.

Webex Single Sign-on UploadOption 2

2. Click the Test SSO setup button.

Test SSO SetupOption 2 - 2

3. Once Single Sign-On succeeds, it is safe to sign-out from the Manage-SSO portal.

Single Sign-on Successful MessageOption 2 - 3

Related Information

Revision History

Revision Publish Date Comments
2.0
12-Aug-2026
Updated Title, Introduction, grammar, spelling, inserted horizontal lines to separate sections for readability, updated URLs, and CCW alerts.
1.0
14-Apr-2023
Initial Release
TAC Authored

Contributed by Cisco Engineers

  • Josue Vizcaino
    Cisco TAC Engineer

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products