Cisco TelePresence Administrator's Manual page 107

Note that:
Initial provisioning authentication (of a subscribe message) is controlled by the authentication policy setting
n
on the Default Zone. (The Default Zone is used as the device is not yet registered).
Subsequent messages, including registration requests, phone book requests and call signaling messages
n
go through the Default Subzone (or relevant alternate subzone).
VCS Starter Pack Express
The Provisioning Server on a VCS Starter Pack Express operates in the same manner as for TMS
Provisioning Extension mode – it does not challenge provisioning requests. It provisions devices only if the
request has already been authenticated by the VCS (at the zone or subzone entry point).
Cisco VCS Administrator Guide (X7.2)
Device authentication
Page 107 of 498