CE-Deploy field course

Learn the workflow.
Prove every result.

Start with setup and the foundation. Then use one pilot device to practice targeting, xAPI, CSV, proxy troubleshooting, and macro deployment.

Course safety rule: use a lab organization or one representative pilot device. Read every Pre-flight result before continuing.
0 of 6 required and guided activities complete

Start here

Install, verify, and choose your organization type.

Complete these tasks before Lesson 1.

1

Install the current release

The buttons open the latest GitHub release. Under Assets, choose the file described below.

macOSmacOS 13+ · Apple silicon and IntelChoose the Universal .dmg for a normal install. Use the .zip when you need the unpacked application.
Open macOS assets ↗
Windows64-bit Windows 10+Choose the installer .exe for a normal install or the portable .exe when installation is restricted.
Open Windows assets ↗

Compare formats and requirements →

Version check: select Settings → About. Confirm the displayed version matches the release you intended to install.
2

Choose the correct course path

Webex Commercial

Choose Cloud — Webex Control Hub (Commercial). Lessons 1–5 use this path.

Webex FedRAMP

Choose FedRAMP — US Government cloud. Follow the cloud lessons in the approved government environment.

On-Premise

Choose On-Premise for local device access. GET Config is cloud-only, and targeting uses IP addresses instead of Webex Device IDs.

Deployment›Organizations›Add Organization
  1. Select the appropriate deployment type.
  2. For Cloud or FedRAMP, select Connect with Webex and complete browser sign-in with an account that can access the organization.
  3. Return to CE-Deploy, wait for Connected!, then select Done.
Checkpoint: the organization name appears in the upper-right organization switcher.
Normal setup uses Webex sign-in. “Have a developer token?” is for short tests. Developer tokens expire after 12 hours and cannot refresh automatically.

Foundation · 10 minutes

Know what CE-Deploy is about to act on.

The core workflow is: choose an organization, prepare an operation, resolve targets, inspect Pre-flight, run, and verify.

Organization

A saved connection to a Webex customer environment or local device environment. It determines which devices CE-Deploy can see.

Device and Device ID

A device is a RoomOS endpoint. A cloud Device ID is its long Webex identifier; use Browse to select by familiar name.

Workspace and location

A workspace is the Control Hub place assigned to a device. A location groups services and resources; it is not a tag.

Tag

A device label. Multiple comma-separated tags resolve devices containing all supplied tags.

xAPI

The RoomOS interface for commands, status, and configuration. Commands may change behavior; GET Config reads configuration.

Pre-flight

The review gate that resolves targets and checks readiness. It is not proof that the final operation succeeded.

Active organization→Operation→Targets→Pre-flight→Run→Verify
Foundation checkYou can explain which organization is active, whether an action reads or changes a device, and why the Pre-flight count must match your intent.
Knowledge check: organization and Pre-flight
  1. What determines which devices CE-Deploy can see?
  2. Pre-flight resolves three devices when you expected one. What is the next action?

Answers: The active organization and target criteria determine visibility. Cancel and correct the organization, target, filter, tags, or CSV; never continue with an unexpected count.

Recommended first session

Stop after your first successful target check.

A new administrator does not need to complete the advanced course in one sitting.

  1. Install CE-Deploy and verify Settings → About.
  2. Connect one organization and confirm it in the upper-right switcher.
  3. Complete Foundation and the interface orientation below.
  4. Complete Lesson 1 with one pilot device.
  5. Stop. Continue into xAPI only after an approved change window is available.

Interface orientation

Main navigationSwitches between Deployment, Settings, and other application areas.
Deployment sidebarOpens Organizations, Apps, Tools, xAPI, and Customizations.
Organization switcherUpper-right control that sets the active device environment.
Operation tabsChoose Commands, CSV, Template, or cloud-only GET Config.
Deployment OptionsChoose Device ID, tags, or another supported target.
Pre-flightReview resolved devices, compatibility, and blocking issues.
Deployment summaryShows the per-device outcome after execution.
Tools and filesUse Tools for exports, tests, and downloaded reports.

Webex account and permissions

Use the Webex account authorized to manage the intended organization. Select Commercial or FedRAMP before sign-in. If the organization does not appear, confirm the account, its Control Hub access, and the selected cloud. Do not compensate by pasting another person’s token.

01

Beginner · 15 minutes · No device change

Resolve one target, then cancel.

Outcome: Select one named cloud device, verify it in Pre-flight, and exit without running an operation.

PrerequisitesConnected cloud organization; one online lab device
MaterialsPilot device name
Success evidenceExactly one intended device in Pre-flight
Deployment›xAPI›GET Config›Next: Select Devices
  1. Activate the pilot organization.

    Use the upper-right organization switcher. If it is missing, select Deployment → Organizations and add it.

    Checkpoint: the expected organization name is visible.
  2. Prepare a read-only request.

    Select Deployment → xAPI → GET Config. Turn on Download Device Configurations. Leave xConfig Filter empty.

    Checkpoint: the page heading is “Download Device Configuration.”
  3. Select by familiar name.

    Select Next: Select Devices. Set Deployment Target to Device ID, select Browse, choose the pilot by name, then select Select.

    Checkpoint: the display name beneath Device ID is your pilot.
  4. Resolve and exit.

    Select Pre-flight. Confirm exactly one intended device, then select Cancel and close Deployment Options.

    Completed when: you can state the active organization, targeting method, device name, and resolved count.
Practice: compare Device ID and tag targeting

Repeat target selection using Tags. Two comma-separated tags resolve devices containing both. Stop if the count is larger than expected.

Knowledge check

Scenario: You expected one pilot but Pre-flight lists three. What do you do?

Answer: Cancel. Confirm the active organization and targeting inputs, then run Pre-flight again. The correct count is a required safety condition.

02

Intermediate · 20 minutes · Controlled change

Run one explicit xAPI operation and capture its output.

Outcome: Set a pilot device to a known volume, capture the response, and restore the original volume.

PrerequisitesLesson 1; approval to change pilot volume
MaterialsCurrent pilot volume; quiet test period
Success evidenceSuccessful output row and restored original volume
This operation changes the pilot. Confirm the room is unoccupied and the device is not in a call. On the device touch controller, open the volume control and record the displayed current volume before continuing. Restore it at the end.
Current runtime volumeThe live level shown on the device controller.
Default configured volumeThe startup/default configuration, which may differ from the live level.
Command responseProof the command was accepted; verify the visible device state separately.
Deployment›xAPI›Commands›Add Command
  1. Add the controlled training command.

    Select Add Command, then Search commands. Find Audio Volume Set and set Level to 50. Commands can change state; they are not read-only status queries.

    Checkpoint: the card shows the intended command and no red validation indicator.
  2. Choose one pilot and request output.

    Select Next: Select Devices, browse to the pilot by Device ID, and turn on Collect Command Outputs. Run Pre-flight.

    Stop if the preview differs or more than one device resolves.
  3. Run and read the report.

    Continue from Pre-flight. In the deployment summary, open Command Output Report. Confirm Device, Command, Status Code, Status, and Result fields.

  4. Verify the visible result.

    The device controller should show volume 50. If it does not, stop and compare the output report with device availability.

  5. Restore and prove the original value.

    Repeat the operation with the recorded starting volume, keep Collect Command Outputs enabled, and open the second report. Confirm success and verify the controller shows the original value.

    Completed when: both reports exist and the pilot is visibly restored.
Instructor note: why this operation?

Volume provides an immediate, reversible result that can be checked without installing content. Use only an unoccupied lab room, never an active meeting space.

Interpret common outcomes
  • Success: device accepted the command; verify actual state.
  • Offline or timeout: confirm availability before retrying.
  • Unsupported: check model and RoomOS compatibility.
  • Output missing: enable Collect Command Outputs before execution.
Knowledge check

Scenario: The report says Success but the visible volume did not change. Is the task complete?

Answer: No. A successful API response is delivery evidence. The desired device state must also be verified, followed by restoration.

03

Intermediate · 25 minutes · Controlled change

Build, validate, and repair an xAPI CSV.

Outcome: Export identifiers, prepare a two-device CSV, identify a delimiter fault, and verify row-to-target mapping.

PrerequisitesLesson 2; two approved pilot devices
MaterialsWorking and broken practice files
Success evidencePre-flight count equals valid pilot rows

CSV columns

ABCD–M
Device IDReserved — emptyReserved — emptyCommands 1–10
Device ID,,,Command 1
REPLACE_WITH_DEVICE_ID,,,xCommand Audio Volume Set Level: 50
Deployment›Tools›Export›Device IDs
  1. Export current identifiers.

    Select Tools → Export, choose Device IDs, and use the narrowest filter. Preserve the export unchanged.

  2. Stage A: build one pilot row.

    Replace only the first sample ID and remove the second data row. Column A is Device ID, B and C remain empty, and commands occupy D–M. Do not execute the file in Stage A.

  3. Inspect as plain text.

    Confirm comma delimiters, UTF-8, one device per row, and two empty fields between Device ID and command. Compare with the broken semicolon file.

    Checkpoint: each row looks like device-id,,,xCommand….
  4. Stage A: upload, Pre-flight, and cancel.

    Select xAPI → CSV, enable Enable CSV-based commands, upload the file, select Next: Select Devices, and run Pre-flight. Confirm one device and the intended command, then cancel.

    Required completion: you repaired the delimiter problem and proved one correct row without executing it.
  5. Stage B: optional instructor-approved execution.

    Only with approval, add a second pilot row, record both live volumes, Pre-flight again, execute, and use the restoration template to return both devices to their original values.

    Stop if either resolved count, command, or original value is uncertain.
Diagnose six common CSV faults
  • Semicolon delimiter: fields do not split into columns.
  • Missing empty columns: command shifts before column D.
  • Duplicate Device ID: the same target appears twice.
  • Blank Device ID: a row has no valid target.
  • Unsupported command: compatibility or validation blocks the row.
  • Modified identifier: spreadsheet formatting changed the Device ID.
Knowledge check

Scenario: Your file has two rows but Pre-flight resolves one device. Should you execute?

Answer: No. Check blank or duplicate IDs, delimiter, and organization before continuing.

04

Advanced · 30 minutes · Conditional

Configure CE-Deploy for a TLS inspection proxy.

Outcome: Identify the proxy mode, add the correct trust certificate, and prove Webex connectivity without disabling verification.

PrerequisitesNetwork-team details; current CE-Deploy release
MaterialsProxy host/port; public CA; credentials if required
Success evidenceDiagnostics and organization connection both pass

Obtain these answers first

  • Proxy type: OS-managed, explicit, or PAC
  • Proxy host and port
  • Whether authentication is required
  • The required root or issuing CA
  • Whether mutual TLS is required
Root CA

The organization’s top trust anchor.

Issuing CA

The CA that may sign the proxy certificate.

TLS inspection

The proxy presents a replacement certificate.

Mutual TLS

The proxy also requires a client certificate and key.

Settings›Network & Proxy›Web Proxy
Use the path supplied by the network team.

OS-managed: Auto Web Proxy Detection. Explicit or PAC: Custom Web Proxy. TLS inspection: add the public CA. Mutual TLS: add client certificate and key only when required.

  1. Record current settings.

    Record enabled sliders, proxy address, port, and certificate filenames. Do not record passwords or private keys.

  2. Configure one proxy method.

    Enable Auto Web Proxy Detection or Custom Web Proxy. Custom overrides auto detection.

  3. Keep validation enabled and add trust.

    Enable Verify TLS Certificates. Under Certificate-Based Proxy (optional), browse for CA Certificate (.pem, .crt). The picker also accepts .cer.

    Checkpoint: client certificate and key remain empty unless mutual TLS is required.
  4. Save and test.

    Select Save Web Proxy. Then run Deployment → Tools → Tests → Webex Diagnostics → Run Diagnostics. Under Organizations, open the active organization menu and select Test Connection.

    Completed when: both tests pass without a certificate error.

Symptom map

SymptomLikely layerFirst check
Name cannot resolveDNSResolver and proxy hostname
Connection times outTCP/firewallRoute, port, Webex destinations
HTTP 407Proxy authenticationUsername, password, policy
Unknown CATLS trustPresented chain and supplied CA
Sign-in rejectedWebex authenticationCloud type and account
Wrong or missing orgOrganization authorizationControl Hub permissions
Failure decision tree and rollback
  • DNS: verify resolver and proxy host.
  • 407: verify proxy authentication.
  • CA error: verify the CA signing the certificate presented on this workstation; ask the network team about bundle order.
  • Timeout: verify firewall and required Webex destinations.
  • Certificate bundles: the network team must specify bundle contents and order.
  • Rollback: restore each recorded slider, proxy address, port, and certificate field; select Save Web Proxy; rerun Webex Diagnostics and Test Connection.
Do not permanently disable Verify TLS Certificates. Repair the trust chain instead.
Knowledge check

Scenario: DNS succeeds and the proxy returns an unknown-CA error. Which layer should you investigate?

Answer: TLS trust. Confirm the CA that signs the certificate presented to this workstation.

05

Intermediate · 25 minutes · Reversible change

Deploy, verify, and remove one training macro.

Outcome: Deploy a harmless logging macro to one pilot, verify its runtime output, then remove it.

PrerequisitesPilot with macros enabled; approval to deploy test code
MaterialsTraining macro below
Success evidenceStart message observed, then macro removed
Deployment›Customizations›Macros›Deploy Macro
  1. Upload and review.

    Under Macro JavaScript File, upload the training macro. Open Code Preview and review Issues.

    Checkpoint: it only logs a start message and reads active-call count.
  2. Configure the pilot.

    Name it CE-Deploy Training, enable Activate on deployment, and leave Skip Transpilation off.

  3. Pre-flight and deploy.

    Select Next: Select Devices, browse to one pilot, and run Pre-flight. Continue only when file, name, activation state, and device are correct.

  4. Confirm the runtime is available.

    Select Deployment → Apps → Macro Factory. Select the pilot device card to open its detail panel. Under engine status, confirm the runtime is running. If it is not, stop and enable Macros Mode through the device’s approved administration workflow.

  5. Verify runtime behavior.

    In the device detail panel, inspect Engine Logs for CE-Deploy training macro started and CE-Deploy training: active calls = 0. Zero is a valid successful result when the room has no active call.

  6. Deactivate, remove, and refresh.

    In Deployment → Apps → Macro Factory, expand the pilot device, find CE-Deploy Training, use the pause control titled Deactivate, then the trash control titled Remove. Confirm Remove Macros, refresh the inventory, and confirm the macro is absent.

    Completed when: the expected logs were observed and a refreshed inventory no longer lists the macro.
Diagnose the correct stage

Upload: file access. Review: code validation. Deployment: target or API. Runtime: macro logic, macros mode, or device state.

Knowledge check

Scenario: Deployment succeeded, but no training log appears. Where do you investigate?

Answer: Check Macro Factory engine status, Macros Mode, activation state, and runtime logs.

Authentication and organization recovery

Test the saved connection before rebuilding it.

  1. Confirm the active organization.

    Read the upper-right switcher. Select the intended organization if another is active.

  2. Test the saved connection.

    Select Deployment → Organizations, open the organization card’s three-dot action menu, and select Test Connection.

  3. Classify the result.

    A sign-in or expired-token response is authentication. A successful sign-in with a missing organization is usually account authorization or the wrong Commercial/FedRAMP cloud. A developer token older than 12 hours should be treated as expired.

  4. Reconnect safely.

    If OAuth access cannot be refreshed, add the organization again through Add Organization → Cloud or FedRAMP → Connect with Webex, verify the new connection, and remove stale entries only after the replacement works.

Separate on-premises path

Translate the workflow without cloud-only controls.

Choose On-Premise when adding the organization. Target local devices by IP address or supported inventory selection. Commands and CSV remain available, but cloud-only GET Config, Webex Device IDs, and Control Hub tag behavior do not apply. Begin with connectivity and credentials for one lab endpoint before using the changing exercises.

Operational reference

Know where results and evidence go.

Downloaded reports

Open the deployment summary and use the available report action. Use Tools for exports and downloaded files appropriate to the workflow.

Deployment summaries

Compare attempted, successful, failed, and blocked devices. Delivery success still requires state verification.

Application updates

Compare Settings → About with the latest release page before troubleshooting a fixed issue.

Offline devices

Do not treat repeated retries as diagnosis. Confirm reachability, registration, model, RoomOS, and organization.

Compatibility

Read validation and Pre-flight messages before execution. Unsupported commands require a different operation or device version.

Support evidence

Collect time, version, OS, organization type, operation, target count, exact error, and sanitized logs.

Troubleshooting

Find the failing layer before repeating an action.

Cannot sign in

Confirm Commercial versus FedRAMP, browser completion, account access, and proxy connectivity. Reconnect the organization. A developer token may have expired.

Device not found

Confirm active organization, online state, exact tag spelling, and Device ID versus IP workflow.

Pre-flight differs

Stop. Compare organization, target, tags, filters, CSV rows, and duplicates.

Deployment failed

Separate transport, authorization, compatibility, and device rejection. Read the summary before retrying.

Need support

Record version, OS, organization type, operation, target, time, count, and exact error. Use Settings → About → Open Logs Folder.

Protect secrets

Remove tokens, passwords, private keys, passphrases, and sensitive identifiers before sharing.

Glossary

Terms used throughout the course.

Cloud organization

A Control Hub environment accessed through Webex APIs.

On-premises organization

An environment that connects directly to local devices.

Deployment summary

Final operation results; delivery still requires outcome verification.

Output report

Per-device response details when output collection is enabled.

PEM

Text encoding for certificates and keys with BEGIN and END markers.

Rollback

Steps or values used to return a pilot to its previous state.

Final assessment · 30 minutes

Complete the workflow without the guided steps.

  1. Confirm installed version and active organization.
  2. Resolve one pilot and prove the Pre-flight count.
  3. Run an approved operation, collect output, and restore the original value.
  4. Repair the broken CSV and explain the fault.
  5. Choose the first diagnostic for authentication, proxy, and offline-device symptoms.
  6. Prepare a useful support note containing no secrets.
Course completionYou can select intended targets, predict the change, interpret the result, restore the pilot, and collect safe evidence.

Passing rubric

AreaPass evidenceCritical safety failure
TargetingOrganization, name, and count matchContinuing with unexpected devices
Change controlOriginal value recorded and restoredNo rollback value or occupied room
CSVFault explained; Stage A Pre-flight matchesExecuting an unverified file
TroubleshootingCorrect failing layer and first checkDisabling TLS verification as the fix
EvidenceUseful sanitized support noteSharing tokens, passwords, or keys
Self-study answer key and instructor review

Pass when every required targeting check is correct, all changing operations are restored, CSV Stage A is explained accurately, and no secrets are collected. Instructors should review the learner’s Pre-flight evidence, two command reports, restoration evidence, CSV diagnosis, and sanitized support note.

Review from the beginning ↑