IDENTITY CONTINUITY WORKBENCH

Design the route
before the outage.

Model two identity providers, see which users Webex sends to each one, and turn the design into a controlled test runbook.

Important: Webex selects one IdP per authentication request. Multiple IdPs plus routing rules are not automatic same-user failover.

Identity provider map

Edit the names and routing domains to mirror your test organization.

MPRIMARY

Provider name Route domains

ProtocolSAML 2.0

NameID / uidPrimary email

SERVICE PROVIDERWEBEXRouting rules

OSECONDARY

Provider name Route domains

ProtocolSAML 2.0

NameID / uidPrimary email

Routing simulator

Test the rule outcome before touching Control Hub.

Test user email

Simulate primary IdP outageChanges the advice, not the configured Webex route.

EXPECTED AUTHENTICATION PATH

alex@staff.example.com→Microsoft Entra ID→Webex

Matched the primary domain rule. This user is sent to Microsoft Entra ID.

Controlled deployment runbook

0 of 6 complete

Preserve administrator recovery accessKeep a verified break-glass path and a separate browser session before changing SSO. Add the secondary IdPManagement → Security → Authentication → Identity provider. Exchange SAML metadataImport Webex SP metadata into the IdP, then upload the IdP metadata to Webex. Test from Control HubUse “Test SSO setup” and a private browser window; Webex supports SP-initiated testing. Create and activate a narrow routeStart with a dedicated recovery domain or test group, then confirm rule priority. Run the outage exerciseRecord who changes routing, the rollback trigger, timestamps, and evidence.

SOURCE OF TRUTH

Use the lab to plan.
Use Cisco’s docs to execute.

Multiple IdPs and routing rulesOpen Cisco guide ↗ SAML agreement and SSO setupOpen Cisco guide ↗