What's new in version 39?

The Teams Connector has a new authentication model with Pexip Infinity due to the deprecation of TLS client certificates by public Certificate Authorities.

All customers using Teams Connectors must upgrade their Pexip deployment — both the Pexip Infinity platform and the Pexip Teams Connector — to version 39 before May 2026.

See Pexip Infinity v39 changes in functionality for more information.

Pexip's Cloud Video Interop (CVI) integration with Microsoft Teams also contains the following enhancements:

• Calls from your Zoom Rooms can now be treated as trusted/registered devices and allowed directly into the Teams meeting (i.e. bypassing the lobby). This requires a new zoomtrustedjoin license to be installed in Pexip Infinity, and configuration of your Zoom customer account number (Call control > Trusted join).

Microsoft Hyper-V 2025 is now supported. It must be deployed manually using the generic Management Node and Conferencing Node images.

From version 39 only Hyper-V 2025 is supported (i.e. Hyper-V 2019 is no longer supported).

The default minimum PIN length for VMRs has changed from 4 digits to 6 digits.

This applies to new installations of Pexip Infinity only. There is no impact to existing systems on upgrade.

PINs may still be between 4–20 digits long, subject to the new Minimum PIN length setting in Platform > Global settings > Service configuration.

You can set an in-conference timer or countdown clock that is displayed at the top of the screen to all conference participants. There are 3 types of timer that can be displayed:

• Elapsed time since the start of the conference
• Time remaining countdown
• Current time (UTC)

There are several updates to themes in support of the new external media collection indicators for Google Meet:

• New audio files: conf-external-media-processing-start_48kHz_mono.wav and conf-external-media-processing-stopped_48kHz_mono.wav.
• New fields in the themeconfig.json file: "disable_external_media_proc_indicator" and "external_media_proc_indicator_text".

Rules and requirements for customized themes

This release contains the following administrative improvements:

• The registration status and registration history pages now include vendor information for the registered device.
• All cosmetic references to Microsoft Lync have been removed from the Administrator interface, and thus all labels and messages now refer to only Microsoft Skype for Business / SfB.
• When uploading an upgrade package, Administrators are now presented with a progress bar.

Server design recommendations

Viewing current and historic registrations

Prior to joining a meeting, participants can now open and select from a list of alternative joining methods. By default the options are Video, Audio-only and Presentation only.

Administrators can disable this feature, and change the options that are offered and the order in which they appear, via the new availableCallTypes setting in the defaultUserConfig section of the branding manifest. Additionally, administrators can change the text that is used to describe each option via the new joining-options[...] tokens within the media section of the language file.

The options under the Settings menu have been reorganized and added to:

• A new Advanced menu, which includes some options previously under Additional settings, Video and sound, and Meeting settings.
• A new Joining menu, where users set pre-join defaults such as their name and whether their camera and mic are enabled.
• The Quality menu includes the options to enable Noise suppression and Prioritize sharing motion.
• The option to Lock the meeting is now available from the toolbar only.
• The About menu includes a customizable Privacy policy link. By default this directs to Pexip's privacy policy.

Settings menu

Previously, the callType option (which determined whether the participant was able to send or receive audio or video) was specified via a numerical list that mapped on to the available combinations. Now, this list uses enumerations, and presentation is also included as an option.

callType is used when customizing the default user settings and in preconfigured URLs to specify the call type used when joining a call. It is also used when specifying the options available when using the new availableCallTypes setting.

The previous numerical format will continue to be supported to provide backwards compatibility.

When a participant mutes their video, their camera is released and no longer appears as still in use (according to the camera's indicators and the device's OS), thus reassuring users that they are no longer sending video. When video is re-enabled, the camera is requested again. However, this does mean that another application may take over use of the camera while it is muted.

This option is enabled by default, but there is a new option to disable this feature via customization, using the stopCameraAsMute setting within defaultUserConfig.

Public Certificate Authorities are stopping issuing certificates with client authentication EKU (Extended Key Usage) capabilities, due to a change in web browser trusted CA policy. By May 2026, it will be impossible to acquire new certificates with both client and server authentication EKUs from public CAs.

Prior to version 39, certificates with client authentication capabilities were required for communicating with the Teams Connector. This requirement has been removed in v39 (see below), and therefore, certificates with client authentication capabilities are now typically not required in most Pexip Infinity deployments. However, in advanced scenarios your Conferencing Nodes' certificates may require a client authentication EKU when responding to SIP/TLS client certificate challenges.

Therefore if your environment requires your Conferencing Node certificates to have client (and server) EKU then you will need to manage this in the future through your own private Certificate Authority.

Version 39 of Pexip Infinity contains the following related changes:

• When configuring a Conferencing Node there is a new optional Client TLS certificate setting that may be assigned. This is the TLS certificate to use on this node when responding to SIP/TLS client certificate challenges.

  If your deployment receives SIP/TLS client certificate challenges then you must assign an appropriate Client TLS certificate to your Conferencing Nodes after upgrading to version 39.

• When generating a CSR (Certificate Signing Request), only server authentication EKU is now requested by default. You can optionally also request client authentication EKU. Previously all CSRs requested server and client EKU.

Teams Connector integrations

Customers who use Pexip's Teams Connector will be affected by this change to EKU:

• In version 38 and earlier, a Teams Connector deployment used TLS certificates with both server and client capabilities for validating device identities (Pexip Infinity nodes and Teams Connectors), known as mutual TLS.
• Version 39 and later uses a new JWT-based authentication model that does not use mutual TLS. This means that the TLS certificates on Pexip Infinity nodes and Teams Connectors are no longer required to have client capabilities.

All customers using Teams Connectors must upgrade to v39 before May 2026.

From version 39 onwards, only the following key types are supported in the certificate that is installed on Conferencing Nodes that are used to communicate with a Teams Connector:

• RSA
• ECDSA with the following NIST curves:
  • P-256
  • P-384
  • P-521

Note that the certificate installed on your Teams Connectors must use RSA keys only.

Managing TLS and trusted CA certificates

Network and certificate requirements (Teams Connector)

Managing administrator access via LDAP

Configuring an LDAP data source

In a future release we will remove the OAuth (delegate access with a service account) Authentication method option when configuring a Secure Scheduler for Exchange Integration.

This is because from February 2025 Microsoft disabled Application Impersonation role assignments to service accounts (for more information, see Microsoft's announcement). Therefore:

• One-Touch Join customers using O365 with an OTJ Exchange Integration must migrate to using Graph API instead. For full instructions, see Migrating from EWS API to Graph API for One-Touch Join.
• Secure Scheduler for Exchange customers still using O365 with a service account to access equipment resources and mailboxes must migrate to using app permissions instead. For full instructions, see Configuring Office 365 for scheduling using app permissions.

In a future release we will remove the {{start_time}} and {{end_time}} variables from the following Secure Scheduler for Exchange jinja2 template fields:

• Accept new single meeting template
• Accept edited single meeting template
• Accept new recurring meeting template
• Accept edited occurrence template
• Accept edited recurring meeting template

If you are using these variables, please update your templates to remove them.

Certificate-based authentication (CBA) is now the default method to authenticate the Teams Connector CVI application towards MS Graph. You can still use the previous password-based authentication method, but we plan to deprecate it in a future release, thus we recommend using CBA for new installations, or migrating to CBA as soon as practicable when upgrading existing deployments.