8.5 Configuring Webex Cloud Messaging
Key Takeaways
Webex messaging takes place in spaces, and the policies of the organization that owns a group space govern the content shared in it.
External Communication settings allow all external messaging (the default), block selected domains, or allow only listed domains, and can stop users from joining externally owned group spaces.
Collaboration Restrictions can block external file sharing and block file preview, download, or upload by client type, file type, or size; these controls require the Pro Pack.
Files can be stored in Webex or in an enterprise content manager such as OneDrive, SharePoint Online, or Box, and retention, legal hold, and eDiscovery apply to messaging data.
Blocking internal communication between groups (ethical walls) requires the Extended Security Pack, and Webex scans shared files with built-in anti-malware protection.
8.5 Configuring Webex Cloud Messaging
Blueprint objective 5.6 is Configure cloud messaging. Webex messaging takes place in spaces in the Webex App: one-to-one spaces, group spaces, and team spaces. Administrators configure it in Control Hub, mainly through external communication policies, collaboration restrictions, content storage, and compliance settings.
1. How Messaging Policy Works
- Space ownership: Every group space is owned by one organization, normally the organization of the person who created it. The owning organization's policies (retention, file-sharing restrictions, and similar settings) govern the content in that space. A user from another company who joins your space follows your space's rules for that content.
- Encryption: Messages and files are encrypted with keys from the Webex Key Management Service. Organizations that must hold their own keys deploy Hybrid Data Security (Section 10.3).
- Licensing: Several advanced controls, including external communication restrictions and most collaboration restrictions, require the Pro Pack for Control Hub; blocking internal communication between groups requires the Extended Security Pack.
2. External Communication
In Organization Settings > External Communication, choose one of three policies for messaging with people outside the organization:
| Policy | Effect |
|---|---|
| Allow all external messaging (default) | Users can message any Webex user in any organization (global federation) |
| Allow all external messaging except blocked domains | A block list stops messaging with specific domains |
| Allow selected domains only | Only domains on the allow list are reachable; an empty allow list blocks all external messaging |
Related controls:
- Group exemptions let selected groups bypass the allow list, for example a partner-management team.
- Externally owned group spaces: Administrators can prevent users from joining group spaces owned by other organizations.
- Basic Webex calls (calling another Webex App user) follow the same allow and block rules.
- Domain status matters: claiming and verifying your domains (Section 8.2) is what lets these policies identify your users reliably.
3. Collaboration Restrictions (File Sharing)
Under Services > Messaging > Collaboration Restrictions:
- Restrict external file sharing so users can share files only internally. Turning this on also enables the option that lets users open whiteboards in a browser through whiteboard.webex.com.
- Block file preview, download, and upload by client type, for example allowing downloads on managed desktops but blocking them on mobile devices or the web client. These restrictions do not apply in one-to-one spaces with external users.
- Restrict file sharing by file type and size (Pro Pack).
- Network location: Defining the organization's public IP ranges lets file controls treat users on the corporate network differently from users elsewhere.
Other messaging settings include link previews and animated GIFs, and Control Hub can set which Webex App clients (desktop, mobile, web) may sign in and how long their tokens last (Pro Pack).
4. Content Storage, Retention, and Protection
- Enterprise content management: Files can be stored in Webex or in Microsoft OneDrive, SharePoint Online, or Box. Administrators can allow only approved company instances and block personal folders.
- Retention, legal hold, and eDiscovery (Section 8.1) apply to messages and files; retention is indefinite by default.
- Ethical walls: Blocking internal communication between selected groups (for example, two departments that must not share information) requires the Extended Security Pack and applies to messaging and basic Webex calling.
- Anti-malware: Webex scans shared files and attachments with built-in anti-malware protection; organizations can also connect a third-party data loss prevention tool through the Webex APIs.
5. Bots and Integrations
Bots and integrations (Section 8.3) post messages and react to events in spaces. A bot receives all messages in one-to-one spaces but only messages that @mention it in group spaces. Integrations act with the permissions a user grants them. Because these apps can read space content, review which integrations users may authorize as part of messaging governance.
6. Configuration Scenarios
| Requirement | Configuration |
|---|---|
| Employees may message only two partner companies | External Communication: Allow selected domains only, with the two partner domains in the allow list |
| Users must not download files on personal phones | Collaboration Restrictions: block file download (and preview, if required) for the mobile client type |
| Files must stay in the company's SharePoint Online | Enterprise content management: enable SharePoint Online for the organization and block other storage |
| Traders and analysts must not message each other | Block internal communication between the two groups (Extended Security Pack) |
| All chat must be deleted after three years | A retention policy for messaging, managed by a Compliance Officer |
7. Exam Pointers
- The default external policy is to allow all external messaging; restricting it is a deliberate choice that needs the Pro Pack.
- Policies follow space ownership, so a user can be subject to a partner's restrictions inside the partner's space and to your restrictions inside yours.
- File controls can be granular: preview, download, and upload are separate switches, and each can differ by client type (desktop, mobile, web).
- Compliance tools (retention, legal hold, eDiscovery) preserve or remove content; collaboration restrictions decide what users may do with it day to day. Expect questions that ask you to pick the right family of control for a stated requirement.
A company wants employees to exchange Webex messages with only two partner companies and nobody else outside the organization. What should the administrator configure?
A retention policy that deletes every message exchanged with external users after one day.
Collaboration Restrictions set to block file uploads for every client type.
External Communication set to allow only selected domains, listing the two partner domains.
An ethical wall that blocks internal communication between all groups.
Security policy says files in Webex spaces must not be downloaded to mobile devices, but desktop users may still download them. Which control meets this requirement?
Collaboration Restrictions that block file download for the mobile client type.
A legal hold on every user's account.
An External Communication block list containing the company's own domain.
Restrict external file sharing, which blocks all downloads on every client.
Two departments at an investment bank must not message each other in Webex, although both may message everyone else. Which capability provides this, and what does it require?
An ethical wall blocking communication between the two groups, which requires the Extended Security Pack.
Collaboration Restrictions by file type, which come with every Webex Calling Professional user license.
A Webex Calling dial plan that routes the two departments to different trunks.
External Communication with a block list, which is included in every Webex subscription.
Sections you finish are checked off in the contents.