Understanding Cloud Connector Edition Auto Update

Starting with Skype for Business Cloud Connector (Cloud Connector) 1.4.1, we introduced an automated update process: Cloud Connector automatically update based on the update schedule that administrators have configured for their Cloud Connector Hybrid PSTN Sites. This article goes into the details of this automatic update.

Note: Cloud Connector should be viewed as a part of Skype for Business Service. We are constantly improving the service and make changes in the Service and in Cloud Connector. If you do not update the Cloud Connector to the latest release, you might end up in the situation when your Cloud Connector will not work properly. Imagine the situation, Microsoft updated the service, added changes in Cloud Connector code to make it work with the new version of the service, but if you don’t update the Cloud Connector, your telephony will not work. Because of these, Microsoft supports only the latest version of Cloud Connector software. Also, to accommodate Update Window, we support the N-1 version for 60 days after releasing a new version.

Auto Update Requirements

  • Outbound internet access to install, manage, and update Cloud Connector on Host Appliance.
  • Outbound internet access on all Cloud Connector VM’s to download Windows updates, or, access to WSUS server as defined in Cloud Connector configuration file.
  • Skype for Business Online PowerShell Module installed on Host Appliance.
  • CCE Management Service is running on Host Appliance.
  • Group Policy to prevent forcefully unloading user registry at log off (required for 1.4.1).
  • Skype for Business Tenant Admin account.

Initial Setup

When the first Cloud Connector appliance is registered, a PSTN site is configured in the Office 365 Skype for Business Tenant, with the name of the Site as defined in the Cloud Connector configuration file, Auto update is enabled, and default time windows are configured for both the software (bits) and operating system (windows) with corresponding Tenant Update Time Windows that are configured in the tenant as part of this registration process. To view the PSTN site settings, run Get-CsHybridPSTNSite in Skype for Business Online PowerShell. To modify, use Set-CsHybridPSTNSite -Identity <Site Name>.


Confirm or Modify the Update Schedule for Hybrid PSTN Site(s)

To confirm the schedule for updating Cloud Connector software, administrators can use Remote PowerShell as noted above, or can view the Hybrid PSTN site update schedule in Skype for Business Admin Center in the on premises PSTN tab of the Voice section. Note that updates will run based on the local host time of the Cloud Connector appliance.

Please be sure to confirm that auto update is enabled and that a bits update time window is set to correspond to the maintenance window that you want the updates to run. The time that updates will occur is based on the local time of the Cloud Connector host appliance. For example, if the update time window is set for 11PM and the Cloud Connector appliance is in Amsterdam, the updates will occur at 11PM CET (UTC+1).

For details on how to configure update time windows, please refer to Modify the configuration of an existing Cloud Connector deployment.

Cloud Connector Auto Update Process

When auto updates are enabled, the Cloud Connector management service will check for updates during the update time window configured. If updates are found, then the update process will proceed with the update.


The CCE Management service uses cached update time window information stored in the root of the CCE Site Directory\Tenant_<EdgeFQDN> file when checking if updates run. This file is updated from O365 tenant every 30 minutes. Therefore, if you modify the schedule online, it can take up to 30 minutes for the change to be implemented on the host appliance.

Auto Update Process Overview

  1. The auto update process will run on the schedule set by Tenant Administrator based on local host appliance clock.
  2. Update detection will continue to run for the duration specified in the update time window.
  3. If an update is detected, the update process is invoked.
  4. The appliance will be put in maintenance mode and only one appliance per site can enter maintenance mode. The maintenance mode lock is written to the root of the CCE Appliance Directory\CceSevicePersistent file. Values for the AutoMaintenanceStatus in this file are: 0=None, 1=Bits Update, 2=OS Update, 3=RecoveryMode
  5. Update tasks will run.
  6. Once updates are completed and all services are confirmed running, the Appliance will be taken out of maintenance mode.
  7. Repeat steps for the next appliance in site.

Monitor Update Process

The Cloud Connector management service will log events to the Windows Application log with a source of CCEManagementService and detailed information will be written to "C:\Program Files\Skype for Business Cloud Connector Edition\ManagementService\CceManagementService.log".

Note: the CCEManagementService.log can grow quite large, so you might want to stop the CCE Management Service, and rename this log periodically. There are plans to modify logging in the future to prevent log growth. If the log file size becomes too large to open in a text editor, you must use a text file splitter to break into smaller segments.

You can also see the status of the appliance by running Get-CsHybridPSTNAppliance in Remote PowerShell or by viewing in on premises PSTN tab in the Voice section of the Skype for Business Admin Center.

Bits Update Process

During this process, the running version remains in service, and an interim switch is used to connect to the new VM’s. Once the new version installation is complete and services are confirmed to be running, the old version is drained stopped and the network connections are switched to the new version.

  1. Bits update is detected based on the scheduled time window.
  2. Bits update task is triggered.
  3. The Cloud Connector download site is queried and if a new build is detected, then the update will occur.
  4. The appliance is put in maintenance mode, and the appliance status is updated in the Tenant showing Status of Maintenance, and DeploymentStatus of Upgrading, with the new version and the start time that the update began.
  5. Cloud Connector bits are downloaded.
  6. The CCE management service is stopped.
  7. The Skype for Business Online Cloud Connector edition software is updated which requires uninstalling the old version and installing the new version.
  8. New virtual machines are built from the existing VHDX file. If the VHDX is detected to be older than 90 days, the Install Instance script will log the following warning:
    SFBServer.vhdx was generated more than 90 days before. Use Convert-CcIsoToVhdx to generate it again and apply windows updates. 

    Note: It is recommended that a new VHDX be built periodically to reduce the amount of time to perform Windows updates for new and updated Cloud Connector machines. It’s not supported to update the VHDX with Windows update and re-run Sysprep as there are a limited number of times that Sysprep can run on a computer.

  9. Once the deployment of the new Cloud Connector is completed and services confirmed running, the switch to the new version will occur as follows:
    1. Change virtual network connections to new Cloud Connector virtual machines.
    2. Shut down the N+1 version.
    3. Remove N+2 version and delete the virtual disks.
  10. The appliance will be taken out of maintenance mode, and the appliance status is updated in the Tenant to reflect updated Status of running, Version number of new build, and DeploymentStatus of Upgraded.
  11. Detailed logs for the download, upgrade of the Cloud Connector software, new version installation and switch to new build will be written to the Logs folder located in the root of the Appliance directory.

Windows Update Process

Windows update process is performed on the active running version. Therefore, when a windows update is detected, the appliance is drained stopped and put in maintenance mode.

  1. OS update is detected during scheduled time window.
  2. OS update task is triggered.
  3. The appliance is put in maintenance mode, and the appliance status is updated in the Tenant showing Status of Maintenance, and OsUpdateStatus of Upgrading, with start time.
  4. The RTCSRV service on Edge and the RTCSRV and RTCMEDSRV services on Mediation server are drained stopped.
  5. OS update PowerShell script is copied to the root of the System drive on all CCE VM’s.
  6. Local windows update service is triggered to check for updates either against Windows Updates Internet service, or the local WSUS server defined in Cloud Connector configuration file.
  7. Updates are installed and a check for virtual machine restart is run.
  8. If a restart is required, all Cloud Connector virtual machines are restarted, then a second check for restart is run.
  9. Once updates are completed on all virtual machines, the updates are run on the host appliance and its restarted.
  10. Once the host has been restarted and no additional restarts are confirmed, the appliance is taken out of maintenance mode, and the appliance status is updated in the Tenant to reflect updated Status of running, and OSUpdateStatus of Updated.

Troubleshooting Auto Update

CCE Management Service Logging Level: If you need more diagnostic logging, you can modify the logging level to verbose for the following two settings in the "C:\Program Files\Skype for Business Cloud Connector Edition\ManagementService\Microsoft.Rtc.CCE.ManagementService.exe.config“ (This will cause rapid log growth):

<add name="serviceSwitch" value="Information"/>

<add name="powershellSwitch" value="Warning"/>

If updates are not running because another maintenance task is detected, check the status of the CCE Appliance Directory\CceSevicePersistent file to determine what task is running.


0=None, 1=Bits Update, 2=OS Update, 3=RecoveryMode

Bits update failed to switch version is logged by the CCE Management Service with following error:
CceService Error: 20003: Bits update failed to switch version. Appliance running status: Running, error detail: Failed to drain services with exception: [] Connecting to remote server failed with the following error message: Access is denied

Check the networking status on the virtual machines and be sure there are no duplicate IP’s configured.

Comments (10)
  1. Afkar Maliki says:

    Hi Carol,
    Firstly, great articles and appreciate for sharing them.
    Would the CCE autoupdate fail if the Windows Server for the CCE host & VMs are not activated? I deployed it for Proof of Concept but run with production O365.


    1. Hello Afar,
      Thank you for the feedback.
      When you say VM’s not activated, do you mean as in license not activated? Then in this case auto-update should work but I haven’t tested this in lab.

      You’re welcome.

      1. Afkar Maliki says:

        Hi Carol.
        I tried to do manual update to CCE 1.4.2 follow the steps https://technet.microsoft.com/en-us/library/mt740656.aspx. But I got error in the Power Shell, at the step Register-CcAppliance :

        Get-CsWebTicket : Logon failed for the user ‘cceadmin@xxxxxxx’. Please create a new credential object, making sure that you have used the correct user name and password.
        At C:\Program Files\Common Files\Skpe for Business Online\Module\SkypeOnlineConnector\SkypeOnlineConnectorStartup.psm1:107 char:18
        + $webticket = Get-CsWebTicket -TargetServer $TargetServer -Credential $Creden …

        I knew the CCE Admin password has expired and changed to new one. But before I run above command, I first run “$credential = Get-Credential” and enter the credential pop up with the new password.

        1. Please see here, https://technet.microsoft.com/en-us/library/mt740655.aspx#Anchor_3, for instructions on updating cached tenant admin credentials used by CCE.

  2. Tonino Bruno says:

    Hi Carolyn,

    thanks for the detailed articles, much appreciated 🙂

    Now I have reviewed all possibilities (account are non-expiring, profile unload is correctly set, bypass proxy list is set correctly etc.) but for some reason the process to update the VM’s takes a very long time to complete and I see “Failed to update VM Timed out” events in the log file.

    Any idea what this could be?

    And a second question, is there any other way to “invoke” the CCE update process, other then changing the Schedule window on the PSTN Appliance object in SFBO?

    Thanks for your help…

    Tonino Bruno

    1. Tonio,

      Please send me an email with your cloud connector management log from “C:\Program Files\Skype for Business Cloud Connector Edition\ManagementService\CceManagementService.log” and Installation logs from the Appliance Directory\Log folder to cbland@microsoft.com.

      The auto update will trigger based on time window. The information is cached locally in file starting with name Tenant_EdgeFQDN in the root of the site directory. We use information stored there for auto update schedule and that file is updated every 30 minutes from online settings. You could either change the schedule, or if you want to start manually, you can follow manual upgrade process: https://technet.microsoft.com/en-us/library/mt740656.aspx.

  3. Fabio Ricci says:

    Hello Carol. Let me thank you for this article. There are still so many things about CCE that are unclear and people like you save us a lot of problems with these blogs. THANKS!

    I have a question. We installed CCE 1.4.1 arround feb, march this year. Realized a few weeks ago, the CCE is not updating. The log file is as old as march, so nothing happen there. I renamed the log file and restarted the service (even rebooted the host server), but no log file is being created at C:\Program Files\Skype for Business Cloud Connector Edition\ManagementService\CceManagementService.log

    No error on the event viewer, nothing. CCE works fine, but running 1.4.1. Autoupdate is set as default:

    RunspaceId : 9bf800a6-2323-3232-9ac1-83aa858c7ad6
    Identity : SitePrincipal
    EdgeFQDN : accessedge.xxxxxxxx.com
    Index : 1
    EnableAutoUpdate : True
    LastTopologyUpdateTime : 2/25/2017 12:40:40 AM
    BitsUpdateTimeWindowList : {BitsUpdateDefault}
    OsUpdateTimeWindowList : {OsUpdateDefault}

    the cceservicepersisten file has:


    Host server can browse unrestricted…..

    not sure where to look. Suggestions? Ideas?

    thanks again for your support to the community!

    1. Hi Fabio,

      Thanks for the feedback. Based on the information that you provided I suspect that the upgrade from 1.4.1 to 1.4.2 failed after uninstall of the Cloud Connector software module. Prior to 1.4.2, it was necessary to have a group policy defined on the host appliance to ensure that the user profile for the CCEService account wasn’t unloaded when uninstalling the CCE Management service. From 1.4.2+ this is no longer necessary. The Auto Maintenance status shows 1 which = updating and the CCE Management Service log isn’t being generated, so seems like the service isn’t running.

      Please check if CCE Management Service is showing in Services.msc snap in. I suspect that it’s not.

      First step to resolve this issue, please Confirm Group Policy is Configured:
      To ensure Cloud Connector successfully automatically updates, confirm that all Cloud Connector host appliance computers have the local Group Policy (GP) applied as documented in the Prepare you environment for Cloud Connector.

      Unfortunately we don’t have a support auto upgrade path from 1.4.1 to current build, therefore, in place upgrade from versions < 1.4.2 is NOT supported. To upgrade from CCE prior to 1.4.2:
      Unregister appliance with – Unregister-CcAppliance, or Unregister-CcInstance
      Uninstall appliance with – Uninstall-CcAppliance, or Uninstall-CcInstance
      Follow instructions for deploying new CCE Appliance – Upgrade to new version of Cloud Connector

      Let me know if you have any questions.

      1. Fabio Ricci says:

        Carolyn. Thanks so much for your reply.

        Checked as you suggested:

        CCE Management service is there. I can stop it and restart it no problem.
        GP is also there.

        I’m trying to avoid deploying a new appliance as that would mean downtime (it takes about 6 hours for the deployment, and if bits need to be downloaded, even more!).


        1. Hi Fabio,

          Unfortunately upgrading from 1.4.1 -> 2.1.0 will require installing new bits. You can following manual instructions to upgrade w/o uninstalling existing, but engineering advised that there are differences that may cause issues with this approach. Whether upgrading automatically or manually we will build new version of VM’s then switch Hyper-V network connections from old to new once new build is up and running. When running Install-CcAppliance with -Upgrade switch, the upgrade won’t happen automatically and will enable you to verify new VM’s before manually running Switch-CcVersion to cut over from old to new. The download of bits and installation typically completes within 2 hours. The big lead time for new deployments is building the base VM. We do recommend rebuilding that every 6 months to insure that running Windows Updates doesn’t take long time but you can do that whenever you want using the Convert-CcIsoToVhdx cmdlet; doesn’t have to be at same time you are upgrading.

Comments are closed.

Skip to main content