One of the significant enhancements delivered in today’s Skype for Business Server 2019 CU1 is the new “Modern Administration Control Panel” or MACP.
This is a new HTML5-based admin interface, which shares a particular visual familiarity with the SfB Online and Microsoft Teams Admin Centres – and does so without requiring Silverlight.
Thankfully it still co-exists with its long-established Silverlight equivalent the CSCP, so you can choose between them.
At this release it’s limited to only user-related admin, with more functionality to be added in future CUs.
Installation
It’s a doddle to install, as the bulk of the work is performed by the CU installer.
Just in case you took some short-cuts with that, here are the bits you need to do:
- install-windowsfeature ManagementOdata,Web-Lgcy-Scripting,Web-WMI,Web-Lgcy-Mgmt-Console,Web-Mgmt-Service
- Run bootstrapper, which is by default installed to C:\Program Files\Skype for Business Server 2019\Deployment
Done! Now just browse to https://<FQDN>/macp/ (if a Standard Edition), or to the internal web services URL with a “/macp/” on the end. (EDIT: the trailing slash became a requirement with the October 2022 update).
User Pre-Req’s
Your admin user needs a few pre-req’s before they can sign in, and you might not be able to use your existing Admin account.
An MACP Admin needs to:
- be SIP-enabled
- have their UPN = their SIP address. [This earlier requirement MAY have been dropped at release. I’ll update the post once I can clarify this]
- belong to the CsAdministrator group
If your account doesn’t meet all those criteria you’ll receive an error message when you try to sign in. See “Troubleshooting” below for some guidance there.
Browser support
- Microsoft Edge (version >= 44.17763.1.0 is recommended)
- Google Chrome (version >= 72.0.3626.121 is recommended)
- Mozilla Firefox (version >= 65.0.2 is recommended)
I’ve used IE11 on Windows 10 and Server 2016 and other than a failure to signin (or throw an error) if your SIP address <> your UPN, it appears to be OK – it’s just untested/uncertified.
Troubleshooting
Depending on your setup, the MACP may throw the odd red herring at you.
“Exception : Invalid user credentials : User is not an administrator”
Chrome and Edge on my Windows 10 workstation both threw this error. My user WAS correctly an admin, however their SIP and UPN didn’t match.
Otherwise, your user might not belong to the csAdministrator group!
“Exception : Invalid user credentials : No valid Security Token”
Bad username or password.
<WheelSpin>
IE11 did this when I had the same scenario as above – UPN <> SIP Adddress. Try a different user. (NB: IE isn’t a supported browser.)
“The AppliesTo element of web ticket request points to a different web server or site”
Ahhh, I see you’re a fellow fan of short cuts. You’ve browsed to “https://localhost/macp” because the machine’s FQDN is a pain to type, haven’t you? The problem is that when you sign in you’re being redirected to the FQDN, and that’s triggering this redirection error. You have to do it the long way, sorry.
Summary
I really like the new MACP and I can’t wait more of the old CSCP’s functionality to be added in future updates.
Revision History
5th October 2024. Updated to change the MACP URL to add the trailing slash.
24th March 2021. Added the “different web server” error image.
12th July 2019. This is the initial publication.
– G.
have their UPN = their SIP address. [This earlier requirement MAY have been dropped at release. I’ll update the post once I can clarify this]
This is not a requirement, I have sip:user@domain.com and UPN user@domain.local and I am able to log into /macp
https:///macp
vs
https:///macp or /cscp
Did anybody try to figure out why accessing these by simple url works only from localhost (RDP to FE) and not from wherever on the network? Of course simple url’s DNS record resolves to Sfb FE. Credential popup pops up, but nothing happens afterward if using simple url from workstation or terminal server for example.
I was analyzing URL Rewrite on IIS for Sfb Internal Web Site, but could not figure out where the catch is…
https:// /macp or /cscp
vs
https:// /macp or /cscp
Awesome work Greig!
I don’t suppose there is a way to switch from the Forms based Auth to just regular SSO/WindowsAuth?
Also pretty annoying that the simply Skype admin url doesn’t work, and that it has to be the internal web service url. what’s up with dat.
Hi!
We did upgrade Skype for Business server 2019 with latest CU last month. We have some AD-accounts that has been member of CSAdministrator and SIP-enabled for a long time. They can login to https://poolfdqn/macp and see Users, Voice Routing, Voice Features, Response Groups, Conferencing and Fedreral and External Access in left menu. We also ave some Administrators with limited access. They has been member of CsUserAdministrators but not SIP-enabled. These users can login into /macp but they only see Voice Routing, Conferencing and Federation and External Access in left menu. We have put these users into CsAdministrator group and SIP-enabled them but they still does not see for exampel Users in the menu. We have also tried to create new AD-accounts with all these permissions and SIP-enabled them but no luck. My question is if there is some permission we miss or why we can not see for example Users in the menu?
That’s a weird one KS!
I found the same issue as above… any known resolution to this yet?
On the off chance someone sees this so late in the game :)
All our CsAdministrator role-holders receive the following “Error : User has insufficient permissions” upon entering their creds. They are all able to log into the OLD Control panel. Not even sure which Event Log on our SfB on-prem servers to have a look at, haven’t been able to find logging related to the attempt.
Any takers? :)
yeah, I got this one as well. About the same sort of situation.
I’ve only seen this one in my Lab, and it coincided with the CMS being offline, which I certainly hope isn’t your issue.
Trawl through your IINET logs at C:\inetpub\logs\LogFiles\W3SVC34577 for the username you’re trying to sign in as and see what comes up.
In my case that revealed a 500 error, although in and of itself that’s not particularly forthcoming. This is a heavily edited line:
2021-07-16 23:17:37 10.10.16.90 GET /OcsPsws/Service.svc/LoginUser('sip:adminer@sipdomain.net') ... https://sfb2019se.sipdomain.local/macp/login 500 0 0 128037‘Get-CsManagementStoreReplicationStatus’ hung, revealing I had bigger problems, and that led me to my offline CMS.
Has MACP previously worked, or is this a new install/update? If the latter, I’d double-check the pre-req’s and re-run bootstrapper anyway.
@("ManagementOdata","Web-Lgcy-Scripting", "Web-WMI","Web-Lgcy-Mgmt-Console","Web-Mgmt-Service") | foreach {Get-WindowsFeature $_}(Are you logging in on the server itself, or from say your desktop/workstation? Does it behave differently if you try the opposite?)
Hello, were you able to fix this?
I thought i’d mention this macp problem I’m having after installing a new Standard Edition 2019 server in a 2015 environment, initially only using it to manage the 2015 instance. I installed the server, everything is working fine. However after doing all of the S4B updates, when I browse to the MACP website (https://s4b.network.domain.com), I just see the S4B logo and “Loading” with the spinner forever (did it all night), no errors in the logs I can see. However if I use for example localhost, or just “https://s4b” it will load the login page immediately. Of course I can’t login and I get that message you showed above ““The AppliesTo element of web ticket request points to a different web server or site”.
Hey Joel,
Did you happen to see the change that was made in the October 2022 patch (to 7.0.2046.409), which requires your MACP URL to end with a slash?? https://greiginsydney.com/sfb-2019-server-update-october-2022/
Could it be that simple?
– Greig.
Well it was a simple fix…just had to clear my browser cache/cookies! It affected both edge and chrome on my ws and also edge on the server.
Nice one! Thanks for sharing it.