What's new in version 41?

This release contains the following administrative changes and improvements:

• DSC (desired state configuration) status information for each Teams Connector instance is now shown in Status > Live View in the Pexip Infinity Administrator interface when hovering over a Teams Connector instance, in the detailed status view, and in Status > Microsoft Teams Connectors.
• The Enable PowerPoint Live option in Platform > Global settings in the Pexip Infinity Administrator interface has moved from the Tech preview features section to the Connectivity section.
• The Azure Automation PowerShell module and Automation account resource is no longer required from version 41 (due to Microsoft's deprecation of Azure Automation State Configuration).

Note that version 41 of the Teams Connector contains updates that necessitate an upgrade to your Pexip platform to ensure compatibility with the latest updates to the Microsoft Teams APIs and to the Teams Connector's latest features. We strongly recommend that you upgrade your Pexip deployment — both the Pexip Infinity platform and the Pexip Teams Connector — to version 41 as soon as practicable.

You now have the option to trigger an audio announcement if the classification level changes during a conference.

Content classification levels and announcements are configured via the theme associated with the conference.

When using participant pinning, you can now:

• Provide a dynamic pinning configuration while a conference is in progress via the client REST API. Previously a pinning configuration had to be specified within a theme.
• When defining and assigning a dynamic pinning configuration via the client REST API, a specific participant can now be assigned to a layout group (via their participant UUID).
• Added the ability to exclude a reserved slot from the layout when there are no participants found for that slot.

• There are new theme audio files and settings in support of Gemini note taking in Google Meet conferences:

  • New audio files: conf-smart_notes_started_48kHz_mono.wav and conf-smart_notes_stopped_48kHz_mono.wav.
  • New fields in the themeconfig.json file: disable_smart_notes_indicator and smart_notes_indicator_text.

• There is a new theme audio file in support of content classification level changes: conf-classification-changed_48kHz_mono.wav (note this is an empty/silent file by default).

• There is a new notification message shown to a direct media participant when the call is about to be terminated because the Host participant has left.

• The following fields have also been added to the themeconfig.json file to allow control of pre-existing features: disable_recording_indicator and disable_transcribing_indicator (they both default to false).

Local and external policy has the following enhancements:

• New custom properties fields have been added to the service and participant responses:

  • Service/gateway responses: new custom_properties and host_custom_properties fields.
  • Participant responses: new custom_properties and private_custom_properties fields.

  These new fields can contain any form of JSON dictionary and would typically be subsequently utilized by client applications and plugins.

  The properties supplied in these fields are provided in the conference and participant update events/callbacks in the client APIs.

Virtual Meeting Room / Virtual Auditorium service types response fields

Participant configuration responses

This release contains the following administrative improvements:

• When configuring a syslog server you can now specify the protocol format (defaults to RFC3164), and optionally whether to send system log entries.
• There is a new option in the security wizard that provides the ability to disable DHE ciphersuites.

Using a syslog server

Deploying Pexip Infinity in a secure mode of operation

• Changes to the way in which users select background effects from within their self-view. (See also data-testid changes below.)

• Improvements to background blur and image replacement, including smoother edge definition and more natural compositing between foreground and background.

flow

Support for first-time and infrequent users

When joining a conference that requires SSO authentication, users are no longer asked to enter their display name (because it is provided by the Identity Provider and will override anything provided by the user).

When joining a conference that does not require SSO, users who have not already provided their name (either when joining a previous meeting, or via the Settings menu) are now asked to enter their display name at the end of the joining flow rather than at the beginning.

As part of this change, the link to the Terms of Service now appears when users are asked to enter the video address. When using preconfigured links that include the video address, users will skip this stage. If this applies in your organization but you require users to accept the Terms of Service before use, you should instead implement this as part of a Custom Step. This can be configured to reflect your organization's specific requirements for displaying and accepting the terms of service information.

The data-testid (referenced when hiding elements from the web interface) has changed for the following elements:

• The button to remove background effects has changed from select-effect-none to button-background-effect-none

• The button to blur the background has changed from select-effect-blur to button-background-effect-blur

• The button to upload a new background image has changed from button-add-overlay to button-background-effect-upload

• The format of the backup files no longer includes .tar. The format is now pexip_auto_backup_<hostname>_<version>_<build>_<date>_<time>.pexbak
• SHA-256 Checksums are now available for each backup file. These can be used to verify the file before restoring.

Backing up and restoring configuration

The option to Allow insecure transport for LDAP integrations (available when configuring LDAP sync sources and LDAP-based authentication for the Administrator interface) has been removed. This option relied on Digest-MD5 which was marked as "Historic" in 2011 and is insecure and unsupported.

If your existing deployment still uses the option to Allow insecure transport, before upgrading to v41 you must:

• migrate to TLS-based LDAP integration
• ensure you know the password of your local administrator account, so you can log in as an administrator without LDAP access if necessary.

Contact your Pexip authorized support representative if you require any further information or assistance.

Managing administrator access via LDAP

Configuring an LDAP data source

The security of SSH authentication has been tightened. As a result, if your SSH client has multiple authentication keys available, you may find you are unable to login due to "Too many authentication failures". You can mitigate this by configuring your SSH client to use the specific key for that host. For example:

Host *.example.vc
    User admin
    IdentityFile /path/to/example.vc/key

In a future release we will remove the OAuth (delegate access with a service account) Authentication method option when configuring a Secure Scheduler for Exchange Integration.

This is because from February 2025 Microsoft disabled Application Impersonation role assignments to service accounts (for more information, see Microsoft's announcement). Therefore:

• One-Touch Join customers using O365 with an OTJ Exchange Integration must migrate to using Graph API instead. For full instructions, see Migrating from EWS API to Graph API for One-Touch Join.
• Secure Scheduler for Exchange customers still using O365 with a service account to access equipment resources and mailboxes must migrate to using app permissions instead. For full instructions, see Configuring Office 365 for scheduling using app permissions.

In a future release we will remove the {{start_time}} and {{end_time}} variables from the following Secure Scheduler for Exchange jinja2 template fields:

• Accept new single meeting template
• Accept edited single meeting template
• Accept new recurring meeting template
• Accept edited occurrence template
• Accept edited recurring meeting template

If you are using these variables, please update your templates to remove them.

Certificate-based authentication (CBA) is now the default method to authenticate the Teams Connector CVI application towards MS Graph. You can still use the previous password-based authentication method, but we plan to deprecate it in a future release, thus we recommend using CBA for new installations, or migrating to CBA as soon as practicable when upgrading existing deployments.