Inventory the installed owner before provisioning
Record the FreePBX version, installed Endpoint Manager module version and signature state, licensing or activation status, phone vendor and exact model, hardware revision, installed firmware, MAC address, extension and current provisioning method. The commercial Endpoint Manager, its free use for supported Sangoma D and P phones, legacy Sangoma Phones Config module and community OSS modules are not interchangeable owners.
Sangoma's DPMA guide says the older Sangoma Phones module and DPMA through Endpoint Manager must not be enabled together because two modules can attempt to modify phone configuration. Preserve the existing owner and backup before migrating; a menu named Endpoint Manager does not prove which module, feature set or device catalogue is active.
Keep mapping, template, generated file and runtime separate
Endpoint Manager maps a physical device to an extension and a template. The template expresses intended settings; rebuilding writes device configuration; updating asks a reachable phone to retrieve it. The phone's active value is a fourth state. A saved GUI field therefore does not prove that the correct MAC used the intended template, that a current file was generated, that the phone fetched it or that the phone accepted it.
For one pilot phone, retain the extension mapping, selected brand and model, template name, effective base-file overrides, generated file identifier and sanitized fetched result. Verify one visible low-risk value before applying a template to a larger group.
Choose one discovery and delivery path deliberately
Sangoma documents manual configuration, DHCP Option 66 and zero-touch redirection for supported phones, while DPMA uses PJSIP for supported Sangoma D and P devices instead of opening separate TFTP or HTTP provisioning ports. These are different discovery and delivery models. Do not expose TFTP, HTTP, HTTPS or FTP merely because another template uses it, and do not infer DPMA support for an unlisted model.
Record the server address, protocol, port, certificate hostname and trust, credential owner, network path and firewall boundary. Keep discovery separate from delivery: a phone can learn a URL but fail to authenticate, fetch an old file or reject the returned configuration.
Understand save, rebuild and update as separate actions
The Endpoint Manager admin guide distinguishes saving template data, rebuilding configuration files and updating mapped phones. Use the smallest action that matches the change and preserve its timestamp and result. An update notification is not proof that a sleeping, offline, mis-mapped or unsupported device fetched and applied anything.
Avoid repeated global updates while diagnosing one endpoint. Compare the expected file with one bounded server request and the device's post-fetch runtime. If a restart is required by the vendor or setting, schedule it and preserve active calls; do not turn every stale field into an unplanned reboot or factory reset.
Treat firmware slots as selection, not validation
Endpoint Manager can assign firmware by brand and template. Sangoma's custom-firmware page says an uploaded image is unsupported, that Endpoint Manager copies it to the location a phone reads, and that Endpoint Manager cannot validate the file or filename. The administrator remains responsible for the correct model image.
Verify vendor origin, exact model and hardware revision, checksum or signature when published, upgrade prerequisites, intermediate releases, configuration retention, power and network stability, rollback path and representative pilot. Selecting slot 0.0 or another slot does not prove compatibility, installation or a successful boot.
Harden claim and administration credentials
Sangoma's DPMA guide says the default phone-claim method can allow any user to claim an available configuration and recommends a Global PIN option. A FreePBX security advisory for the Endpoint module says fixed version 17.0.10 randomizes new-install phone admin, user and DPMA defaults and warns about weaker passwords. Confirm the installed module and rotate weak or inherited secrets rather than assuming a new-install default applies to an upgraded system.
Restrict the telephony and provisioning network, remove unused extensions and users, protect configuration files and captures, and grant only required administrator access. A long phone password does not establish TLS, SRTP, network isolation or correct dialplan authorization; verify each control separately.
Sources & applicability
Primary references for the technical details above. Operational examples and planning checklists are VoIP.info editorial guidance.
- Sangoma Endpoint Manager ↗
- Sangoma Endpoint Manager admin guide ↗
- Sangoma EPM and DPMA for D and P phones ↗
- Sangoma Endpoint Manager custom firmware ↗
- Sangoma Option 66 precedence after EPM provisioning ↗
- FreePBX Endpoint module password advisory ↗
Examples require adaptation to your topology. No live PBX or hardware testing is claimed.