Dialogue Cloud Neo vendor hardening guide

Use this security baseline to prepare and maintain a Dialogue Cloud Neo deployment. It helps customer and partner administrators restrict access, protect credentials and data, and verify security-sensitive configuration. Follow the linked component procedures for implementation.

Scope and responsibilities

Apply the shared controls across your deployment. Apply component-specific controls only where that component is used. Record your connect model, region, bundle version, enabled components, integrations, and data stores before completing the checklist.

• AnywhereNow manages the hosted back-end infrastructure.
• The customer manages its Microsoft 365 and Azure tenants, identities, permissions, customer-owned storage, and customer-side telephony infrastructure. A partner can perform agreed configuration and operational tasks.
• Agree who owns each control, renewal, monitoring activity, and incident escalation. Use the applicable RASCI Customer - AnywhereNow for Operational Support or RASCI Partner - AnywhereNow for Operational Support alongside your service agreement.

Start with the Dialogue Cloud Neo (Connect) prerequisites or the Dialogue Cloud Neo (Unify) onboarding guide. A control for an optional or existing component is not a requirement to add that component.

How to interpret the controls

• Product requirement: a configuration dependency described in the linked product procedure. It applies when you use that component or configuration.
• Recommendation: the recommended security practice. Assess compatibility and record any exception with its owner and review date.
• Customer policy: a decision your organization makes, such as recording consent, retention, or access-review frequency. Configure and verify the product against that decision.

Identity and access

Recommendation: Give administrators and users only the access needed for their role. Review OnePortal access, Microsoft Entra ID group membership, SharePoint access, reporting access, and integration permissions. Remove access when a person leaves or changes roles.

Use AnywhereNow Authentication for the components covered by the AnywhereNow Authentication Service. Agree multi-factor authentication (MFA) and Conditional Access policies with your identity and security administrators, then test the actual sign-in paths.

Product requirement: Grant WebAgent consent to the application that matches your connect model. For Dialogue Cloud Neo (Unify), use the correct regional front-end enterprise application. Follow Configure Sign-in for WebAgent rather than reusing a consent link from a different model.

Dialogue Studio permissions

Recommendation: Use AnywhereNow Authentication and separate read-only access from permission to change flows.

Product requirement: When configuring AnywhereNow Authentication for Dialogue Studio, use the Reader and Writer security-group object IDs. Read-only users belong to the Readers group. Users who need write access belong to both the Readers and Writers groups.

Verify: Test with a reader, a writer, and a user outside the configured groups. Confirm that readers cannot change flows and that the unassigned user cannot access the portal. Repeat access checks after group or authentication changes.

Public-facing services and Web Wallboard

Recommendation: Inventory enabled web interfaces and application programming interfaces (APIs). Enable only the services you need, configure their documented authentication, and test access without an existing signed-in session. An HTTPS address encrypts the connection; it does not by itself restrict who can view the data.

Changing authentication can affect other applications on the same UCC service. Test all affected clients using the linked procedure. Web Wallboard is not available for Dialogue Cloud Neo (Unify); use Dialogue Workspace instead. See Installing Web Wallboard.

Network and telephony

Recommendation: Limit customer-managed firewall rules to the documented destinations, protocols, and ports needed by your deployment. Use the current model-specific prerequisites and confirm regional endpoints with your delivery contact or Support. Recheck connectivity after changing firewall rules.

Customer SBC connections

Apply this section when a customer Session Border Controller (SBC) connects to the Dialogue Cloud Neo SBC, as in the Direct Routing architecture for Dialogue Cloud Neo (Connect).

• Recommendation: Encrypt Session Initiation Protocol (SIP) signaling with Transport Layer Security (TLS) and media with Secure Real-time Transport Protocol (SRTP). The SBC procedure documents TLS 1.2 and 1.3, certificate trust, cipher profiles, and media settings.
• Product requirement: Activate SRTP only with SIP over TLS because the media encryption keys travel in SIP signaling.
• Recommendation: Follow the vendor-compatible SRTP settings in the canonical procedure. Agree a Strong-TLS profile before setup if needed; that profile is not supported by Ribbon SBCs. Do not assume one cipher profile works with every SBC.

Use 5 IP Planning and Firewall settings for the current regional addresses and port ranges, and 6 Session Border Controller Configuration for encryption and trust settings. Keep the customer's SBC software and certificates within the SBC vendor's supported lifecycle.

Verify: Confirm the negotiated signaling and media protection on representative inbound and outbound calls. Test audio in both directions and transfers after changes. Record the SBC profile and regional rule set used.

Customer-owned Azure SQL Database connectivity

Where customer-owned databases are used, follow How to connect to Azure SQL. Azure Private Link and Private Endpoint are not supported by that integration. Do not replace the documented connection path with a private-only endpoint without a supported design.

Secrets and application credentials

Recommendation: Keep an inventory of application credentials and certificates, including their purpose, owner, expiry date, and renewal procedure. Rotate them before expiry and verify each dependent component afterward. Restrict access to secret values, tokens, connection strings, and exported configuration.

Use the supported application permissions from each setup procedure. Least privilege does not mean removing permissions required for the component to operate. For SharePoint UCC access, follow the Migrating from ClientSecret to Dialogue Cloud Certificate Authentication; do not retain the retired Azure Access Control Service (AACS) client-secret connection method.

Secure Vault for supported database connections

Recommendation: Use Secure Vault for supported Azure SQL Database connections. Secure Vault activation requires bundle DC2025.01 or later and uses one vault per region. Its documented database support is not a general-purpose replacement for every integration credential.

1. Create the service principal and database permissions using the Secure Vault procedure.
2. Create the database secret profile and assign it to the correct service or contact-center component.
3. Restart the UCC service with a cleared cache, as required by that procedure.
4. Verify every configured function that uses the new profile. Only after successful verification, remove the superseded plaintext connection-string references from SharePoint.

Verify: Check service startup and the affected database-dependent functions after activation or credential renewal. Assigning a profile alone is not proof that the migration works.

Data protection, privacy, and retention

Customer policy: Identify which data you collect, who can access it, where it is stored, and when it is deleted. Set access, recording consent, retention, and recovery requirements with your privacy and security owners.

Use Data storage and ownership to identify the actual data stores. Dialogue Insights uses customer-specific Microsoft Fabric resources in the AnywhereNow-managed tenant, not a customer-owned Call Detail Records (CDR) database. New customers use Dialogue Insights rather than a customer-owned CDR database. Apply customer-owned database controls only where those databases are part of the deployment.

• Recommendation: Restrict access to customer-owned SharePoint libraries, recordings, text-channel databases, and reporting resources to authorized roles. Review sharing links and exports as well as application access.
• Customer policy: Define retention separately for recordings, text conversations, reports, and diagnostic evidence. The Retention Policy for Dialogue Manager Database deletes eligible text-conversation data from its database; it is not a platform-wide retention policy.
• Recommendation: For customer-owned storage, verify the agreed backup and recovery arrangements. Check that deletion processes and retained copies meet your policy before running cleanup.

UCC recording and translation settings

For deployments using UCC Core settings, review each relevant call flow. UseAudioRecording defaults to FALSE, but it is not the only recording setting. Use the UCC Call Recording Scenarios for inbound, outbound, and intercepted calls. Decide whether agents may pause, stop, or start recordings with AgentCanEditAudioRecording.

EnableTextTranslatorLogging and UseTranslationRecording both default to false. The first logs translated text to the UCC log; the second writes translations to a JSON file. Enable them only for an agreed purpose and protect the resulting content. See Configure UCC translation.

Product requirement: Where an existing customer-owned CDR database is used with UseCallDetailRecording=True, its effective connection configuration must allow database initialization before the UCC can complete startup. Secure Vault can supply that configuration. Follow the CDR connection required for startup When UseCallDetailRecording is set to True, the UCC must initialize the CDR database before it can complete startup. A missing or invalid CDR connection configuration prevents the UCC from completing startup. Check the CdrConnectionString setting in SharePoint, or the database connection configuration in Azure Key Vault if your environment uses it.. CDR database recording is separate from audio recording; do not change it as an audio-privacy control.

Verify: Test the agreed recording behavior on representative call flows, including announcements and agent controls. Check who can retrieve stored recordings and text content, and verify the configured retention process.

Integrations and APIs

Recommendation: Inventory each integration and custom Dialogue Studio flow, including its owner, destinations, credentials, permissions, and data exchanged. Use the authentication method documented for that interface. Use HTTPS for customer-managed web endpoints and avoid placing credentials or access tokens in URLs, debug output, or shared flow exports.

Product requirement: Generic Dialogue Provider (GDP) API requests require a bearer JSON Web Token (JWT) in the Authorization header. Follow the Generic Dialogue Provider (GDP) Developer Guide, including its Authentication Service prerequisites. This requirement does not describe the authentication of every other API or callback receiver.

Verify: Test expected access and rejected access for each integration using its documented method. Review customer-managed callback authentication separately. Confirm that flows exchange only the intended data and do not expose secrets in exported configuration or routine diagnostics.

Logging, monitoring, and incident handling

Recommendation: Assign owners to review available identity sign-in events, customer-resource alerts, credential expiry, and service failures. Agree who investigates unexpected access, recurring authentication failures, and database-connectivity errors.

Limit elevated diagnostic logging to the investigation period and restore normal settings afterward. OnePortal provides temporary log-behavior changes through the Actions Menu per UCC Service. Restrict access to collected logs, review them for credentials and personal data before sharing, and retain only the evidence needed by your policy.

Use your organization's security incident process for suspected compromise and the agreed customer or partner support route for product assistance. Follow the Case filing process and Dialogue Cloud Incident Reporting Guidelines. Include the affected UCC, region, version, impact, UTC timestamps, and relevant correlation details. Do not include passwords, client-secret values, or bearer tokens.

Verify: Confirm that monitoring owners receive alerts and can use the escalation route. Record where incident evidence is stored and who can access it.

Release management and periodic review

Recommendation: Run a fully supported bundle that receives security updates. The AnywhereNow Bundle Support, End-of-Support Policy distinguishes full support for N+1, N, and N-1 from functional-only support for N-2 and N-3. Functional-only support does not include security updates. Review the current Bundle Release Notes and Dialogue Cloud Release Notes Glossary when planning an update.

Check the AnywhereNow Product Lifecycle Policy as well as the bundle version. An optional component can have its own retirement or replacement path.

Repeat the applicable checks after bundle updates, authentication changes, credential renewals, network changes, and integration changes. Agree a periodic review interval with your security owner. Record approved exceptions, compensating controls, owners, and review dates.

Go-live and operational review checklist

Copy this checklist into your change or security-review record. For each applicable row, record the result, evidence, owner, and review date. Mark a row not applicable only with a reason. Resolve failed product requirements and obtain security-owner approval for exceptions to recommendations before accepting the review.