AVinBrief

The commercial AV industry, in briefs you can read in under a minute.

← All briefs

Corporate · August 11, 2026

Webex Zero Touch Provisioning Goes Generally Available for All RoomOS 26 Devices: What Bulk Room Deployments Look Like Without Activation Codes

Cisco's ZTP for RoomOS 26.5 replaces activation codes with MAC-address plug-in provisioning across Board, Desk, and Room Series devices.

By AVinBrief Editorial Desk · · Updated August 12, 2026

What does Zero Touch Provisioning change for RoomOS 26 devices?
Zero Touch Provisioning (ZTP) is now generally available on every RoomOS 26 device running software 26.5.0 or later. It replaces the manual 16-digit activation code with MAC-address registration. An IT admin pre-assigns each device to a workspace in Webex Control Hub, and the device self-configures and authenticates to the network the moment an installer plugs it in. That removes the on-site activation codes, the manual wizard, and the back-and-forth verification between IT and field teams. The supported device families are the Board, Desk, and Room Series.
How does bulk deployment work with ZTP in Control Hub?
In Control Hub, an admin opens Devices, then Add Device, then Bulk Add Devices, and selects the zero-touch onboarding template. From there the steps are straightforward. Download a CSV, fill it with device MAC addresses and workspace assignments, and upload it. Devices can be pre-activated before they ever reach the network, so when the hardware arrives the installer plugs it in and the room goes live. Imported devices may show as 'Claimed and Pending' until their first connection, and the Tasks page tracks import progress. An admin can also trigger activation manually with a CLI command.
What does ZTP change about certificate management and network security?
ZTP supports SCEP-based (Simple Certificate Enrollment Protocol) enrollment with automated DHCP support, which retires the work of issuing unique certificates by hand and tracking their six-month renewals. Integration with Cisco Identity Services Engine (ISE) adds a zero-trust layer, authenticating every device to the network before it receives its service configuration, so access is gated on device identity rather than physical presence alone. On Cisco wired infrastructure, ISE and Catalyst switches handle device profiling and authentication automatically. On Cisco Wireless, location intelligence adds one more check, confirming that the device being provisioned is physically in the room it was assigned to.
What manual steps remain even with ZTP enabled?
ZTP does not erase the on-site visit. Hardware setup and software upgrades still need hands. The feature automates authentication, service configuration, and workspace assignment, but the physical racking, cabling, and any pre-connection firmware updates stay manual. This release is the first phase of ZTP, with further enhancements to come.
Which environments benefit most from ZTP, and where does the Cisco infrastructure dependency matter?
The gains scale with the size of the rollout. For a single room, the difference between typing a 16-digit code and plugging in a cable is small. For an enterprise rolling out 200 rooms across multiple sites, a common corporate, higher-education, healthcare, and government refresh, the drop in truck rolls, activation-code tracking, and IT-to-installer coordination becomes real labor savings. The zero-trust model and location verification matter most in regulated environments, where authenticating a device is a compliance requirement. The full feature set, including ISE integration, location-based room verification, and automated certificate renewal, runs on Cisco network infrastructure, with Catalyst switches for wired deployments and Cisco Wireless for location intelligence. Organizations on non-Cisco switching or wireless still get MAC-address provisioning and the Control Hub pre-configuration workflow, but the ISE zero-trust layer and location verification need the Cisco stack.

The Take

What does Cisco's Zero Touch Provisioning for RoomOS 26 change about how integrators scope, bid, and hand off multi-room deployments?

Provisioning has always been a friction point in large rollouts, between coordinating activation codes across IT and field crews, managing certificate renewals, and absorbing the truck rolls for rooms that do not light up cleanly on first plug-in. ZTP removes most of that friction when the network stack is Cisco, shifting the integration work toward pre-configuration and away from on-site activation.

For an integrator scoping a 200-room corporate or campus refresh, the bid changes in two ways. First, the pre-configuration work moves upstream, since MAC-address collection, workspace mapping, and bulk CSV preparation all happen before hardware ships, which front-loads project coordination rather than spreading it across installation days. Second, the on-site role shrinks to physical work such as racking, cabling, and firmware prep, because the room activates on plug-in. That shifts how labor hours and commissioning timelines are estimated.

The infrastructure dependency is the specification question to resolve early. Integrators should map the client’s switching and wireless environment before positioning ZTP as the deployment standard. On a Cisco-standardized campus, the full feature set, which includes ISE zero-trust authentication, Catalyst profiling, and Cisco Wireless location verification, is available out of the box. On Aruba, Juniper, or Extreme infrastructure, the MAC-address pre-registration and Control Hub bulk workflow still function, but ISE and location-based verification do not. That distinction belongs in the scope document, not the post-installation debrief.

A second item for the punch list: any device in the installed base running RoomOS below 26.5.0 stays on the activation-code workflow. For a phased refresh, that means two provisioning processes running in parallel until the fleet is current. Flagging the firmware baseline early keeps the handoff clean.

Sources