AXIS Audio Manager Pro

AXIS Audio Manager Pro lets you control large and advanced audio installations from a single point, managing zones, audio sources, schedules, paging, and SIP-based communication across an entire site. With that level of centralized control comes responsibility: a compromised audio management server could allow an attacker to access and misuse the public address systems, eavesdrop on calls, or pivot deeper into your network.

This guide walks you through the practical steps needed to harden your AXIS Audio Manager Pro deployment from the ground up. It covers everything from operating system preparation and network design to certificate management, SIP security, and ongoing maintenance.

This guide is written for system administrators and integrators who are responsible for deploying and maintaining AXIS Audio Manager Pro installations. We assume intermediate familiarity with Windows Server administration, networking concepts (VLANs, firewalls, TLS), and general cybersecurity principles.

This guide should be read alongside the official product documentation:

• AXIS Audio Manager Pro — User manual

• AXIS OS — Hardening guide

• Cybersecurity with Axis Network Audio (whitepaper)

• Axis cybersecurity overview

It is assumed that the recommendations and procedures defined and described in the AXIS OS hardening guide are understood and followed.

• AXIS OS — Hardening guide 

Software hardening matters little if an attacker can walk up to the server or a speaker and tamper with it directly.

House the AXIS Audio Manager Pro server in a locked server room or cabinet with controlled access, e.g. badge, key, or biometric. Disable USB mass-storage class drivers on the server to prevent data exfiltration or malware introduction via USB devices. Enable BIOS/UEFI passwords and configure the server to boot only from the internal disk, not from USB or network sources.

Mount speakers and microphones in locations that are difficult to reach without tools or ladders. Axis audio devices are often installed in ceilings and other elevated positions, which already provides a degree of physical protection. Use tamper-resistant mounting hardware where available.

Secure network switches and patch panels in locked cabinets. Disable unused switch ports to prevent unauthorized devices from being connected to your network. Pair this with IEEE 802.1X port authentication to ensure that only authorized devices can communicate on the network, even if someone gains physical access to a port.

Grant users only the access required for their specific responsibilities, and review account privileges regularly to prevent privilege creep. Avoid shared accounts, as these make auditing impractical and increase the risk of unauthorized access. On the Windows host, maintain separate accounts for network administrators and system administrators, disable the default Windows Administrator account after initial setup, and ensure administrator credentials are limited to those who require them.

Where possible, use Microsoft Active Directory to centralize user and group management, enforce password policies, and apply role-based access controls across the domain. If local accounts are required, create a unique account for each user and limit access to only the resources they need.

Every Axis audio device maintains its own local accounts, independent of the AXIS Audio Manager Pro server. Limit these to the minimum number of accounts necessary and enforce strong, unique passwords on each device to reduce the risk of unauthorized access. Axis device accounts are primarily for computer/client access, with the AXIS Audio Manager Pro server being the only client that should connect during normal operation. While a common strategy is using the same password across all devices for simplicity, it is recommended to use unique passwords, which can be managed through AXIS Device Manager. During normal operation, the AXIS Audio Manager Pro server does not need access to the device password after onboarding.

AXIS Audio Manager Pro runs on a standard Windows environment. Installing unrelated third-party applications on the same machine increases the attack surface and may introduce malware or unpatched vulnerabilities, potentially leading to system downtime or unauthorized access. Install only software required to operate and maintain AXIS Audio Manager Pro on the host machine.

Do not run anything other than AXIS Audio Manager Pro server software and trusted third-party integrations on the host hardware. If the physical hardware should be utilized for other purposes, it is recommended to use multiple virtual server instances and run the AXIS Audio Manager Pro server software in one virtual machine and the third-party non-related software in another virtual machine.

Consider deploying anti-virus software on all servers and computers that connect to the AXIS Audio Manager Pro server and ensure they are kept up to date with the latest operating system patches. For mobile devices, ensure the latest operating system updates are applied.

A system that was secure at deployment will drift out of compliance over time if it isn't actively maintained. An outdated system is a liability on multiple fronts. Unpatched vulnerabilities give attackers a well-documented road map to exploit your infrastructure, risking data breaches and downtime. Compatibility with modern services and security protocols will degrade over time, causing functional failures. Running outdated software can also result in regulatory non-compliance, exposing the organization to additional risks.

Keep the entire stack up to date. This means three things happening on a regular cadence:

• Windows Security updates - install the latest updates.

• AXIS OS device software - update all managed audio devices whenever Axis releases new device software. Check www.axis.com/support/device-software for the latest AXIS OS version for your devices. Consider using AXIS Device Manager for efficient device management.

• AXIS Audio Manager Pro server - install the latest version. Check axis.com for latest version. If the server is connected to the internet, it automatically runs update checks so you're always aware of new releases. The installer executable is always signed with an Axis certificate.

Subscribe to Axis security advisories and the Microsoft Security Response Center (MSRC) feed. When a security advisory is published, treat it with urgency. Test patches in a staging environment when possible before rolling them out to production, but don't let that step become a reason to delay indefinitely.

Start by placing all Axis audio devices on a dedicated Audio VLAN, separate from user workstations, video surveillance, and other infrastructure. The AXIS Audio Manager Pro server itself should sit on a management network segment with routed (not bridged) access to the Audio VLAN.

If SIP phones or external SIP trunks are part of the deployment, create a separate SIP/Voice VLAN and apply inter-VLAN firewall rules to control traffic flow between segments.

For additional protection at the network edge, implement IEEE 802.1X port-based network access control on switch ports connecting audio devices. Axis devices support EAP-TLS authentication using device certificates, which means only devices with valid, enrolled certificates can communicate on the network, even if someone physically connects a rogue device to a port.

Configure both the Windows host firewall and any upstream network firewalls to allow only the traffic AXIS Audio Manager Pro requires. A list of required ports is available in the AXIS Audio Manager Pro user manual. Restrict access to the web UI to the management subnet, allow communication between the server and audio devices on the Audio VLAN, and ensure SIP and RTP traffic is permitted if telephony integration is in use.

Also account for services that require internet access, such as license synchronization, web radio streaming, and update notifications.

The AXIS Audio Manager Pro web interface should never be exposed directly to the internet. If remote administration is necessary, route access through a VPN gateway with multi-factor authentication or through a hardened jump host on the management network.

Bonjour (mDNS) can simplify initial device discovery, but it also broadcasts service information across the network. Once onboarding is complete, evaluate whether discovery is still needed. If it isn't, disable Bonjour on the audio devices to reduce unnecessary broadcast traffic and limit service exposure.

All sensitive data used by the system and traversing the network should be encrypted:

• Server ↔ Devices: Encryption is enabled by default in AXIS Audio Manager Pro and applies equally to data channels as well as unicast and multicast audio streaming. Verify that it remains enabled after installation and after any major configuration change.

• Web UI: The server only allows HTTPS access by default.

• SIP: Enable TLS as the SIP transport protocol in SIP Settings and disable less secure transports (plain UDP and TCP). Upload proper CA-signed certificates via SIP Settings → New/Edit → Certificate.

• TLS Version: Use TLS 1.2 or higher across the board. Disable TLS 1.0 and 1.1 both in Windows and in AXIS Audio Manager Pro configuration where applicable.

Database encryption: Sensitive data stored in the server database is encrypted.

Certificates establish secure connections between the AXIS Audio Manager Pro server and clients like web browsers and SIP phones. A default self-signed SSL certificate is generated upon installation, but using certificates from a private or public Certificate Authority (CA) is recommended for production environments. Trusted certificates eliminate the browser warning users see when accessing the web UI with the default self-signed certificate.

We recommend installing root certificates generated by the CA on the client devices, ensuring that the clients trust the server certificate.

The Session Initiation Protocol (SIP) is a signaling protocol used for initiating, maintaining, and terminating communication sessions, and AXIS Audio Manager Pro uses it to make announcements to zones or set up two-way calls with individual devices. For secure SIP communication, we recommend enabling TLS as the communication protocol and disabling less secure options like TCP and UDP if possible.

Additionally, requiring RTP encryption (SRTP) for SIP clients ensures that audio between clients and the server is encrypted, preventing eavesdropping and tampering while denying unencrypted calls. To further mitigate the risk of unauthorized access, SIP client authorization should be enabled with strong passwords enforced for all clients. These combined measures help establish a robust and secure SIP environment within AXIS Audio Manager Pro.

IP filtering lets administrators control server access by creating rules that block or allow specific IP addresses, strengthening security against unauthorized access and brute-force login attempts. The system also automatically blocks IP addresses temporarily after repeated failed login attempts, providing protection without manual intervention. Filtering can be configured separately for SIP-based and web-based services.

Logging and monitoring are essential components of a secure deployment. They provide visibility into system activity, support incident investigation, and help detect unauthorized access or configuration changes.

The AXIS Audio Manager Pro logs include the following events:

• User login and logout activity.

• Configuration changes, including who made the change and when.

• Playback events, what was played and where.

Periodically review the log to identify unusual activity, such as repeated failed login attempts or unexpected configuration changes.

We recommend establishing a regular backup policy for the AXIS Audio Manager Pro database that documents backup frequency, retention periods, and restoration procedures. Always store backups in a separate, access-controlled location, never on the same server they came from. Encrypt all backup files to protect them from unauthorized access.