RingCentral Security: Roles, SSO, Apps and Toll Fraud

A RingCentral account controls the company's phone numbers, call routing, messaging and calling spend, so admin roles, sign-in policy and outbound calling permissions decide both who can change the phone system and how much an unauthorised caller could cost you. This guide covers the customer-side controls in RingCentral RingEX: predefined and custom roles, SAML single sign-on, international calling and premium-number permissions as toll fraud controls, developer apps and JWT credentials, and the Audit Trail. It is written for RingCentral administrators, IT and telecoms teams, and security staff who need a practical baseline and a way to check it is holding. For the wider set of collaboration and voice controls, see the Unified Communications Security Guide.

This is an independent guide from NHI Mgmt Group, based on RingCentral's public documentation as of November 2026. It is not sponsored or reviewed by RingCentral. Product features change, so confirm settings against RingCentral's current documentation.

Key takeaways

Change the default role. New users receive Standard (International), which can dial international and premium numbers; on plans that allow it, make a role without international or premium dialling the default and grant international calling by exception.
Enforce SSO once it works. Set Manage Your Login to Enforce SSO login only so people sign in through your identity provider and its MFA, rather than with a phone number and password.
Keep Super Admin rare. Super Admin has full system access and controls roles; use User Admin, Phone System Admin and Billing Admin for day-to-day work and review holders quarterly.
Know your fraud switch. International Calling and International SMS can be turned off account-wide under Outbound Rates during an incident; re-enabling requires RingCentral support, so plan that call into your runbook.
Export the Audit Trail. It keeps up to 180 days and displays at most 10,000 records, so download filtered CSVs regularly and send them to your SIEM.

How identity and access work in RingCentral

Each user has an extension, and each extension has a role that bundles permissions: what the person can administer and what numbers they can dial. Roles are viewed in the Admin Portal under Users, Roles. Sign-in can be through RingCentral credentials or through SAML SSO, and applications authenticate through OAuth flows registered in the Developer Console.

Identity	How it authenticates	Customer control
Users	SAML SSO, or phone number or email with password; RingCentral describes a security code by email or voice call for two-factor checks at three-legged login	Enforce SSO login only; MFA in the IdP
Administrators	Same sign-in, with an admin role	Few Super Admins; scoped admin roles
User-facing apps	Authorization Code with PKCE	Approve apps; review scopes
Server integrations	JWT credential acting as a predetermined user	Dedicated low-privilege user; private app; vaulted JWT
Phones and devices	Device registration to the account	Track device inventory; disable international calling if registration theft is suspected

Microsoft documents automatic user provisioning for RingCentral from Microsoft Entra ID, so joiners and leavers can follow your directory. See the SCIM Provisioning Guide and the Joiner-Mover-Leaver Guide.

Admin roles and privileged access

RingCentral ships predefined roles whose permissions cannot be modified. Advanced and Ultra customers can create custom roles and change the default role assigned to new users.

Predefined role	What it allows	Calling rights included	Guidance
Super Admin	Full system access; on initial setup only Super Admin can change roles and permissions	All	Two or three named people; the Super Admin user cannot be deleted
User Admin	Manages all user and group extensions	Standard (International)	Service desk; consider a custom variant without international dialling
Phone System Admin	Phone system access	Standard (International)	Telecoms team
Billing Admin	Billing tasks plus Manager permissions	Standard (International)	Finance; can view the Audit Trail
Manager	Company reporting	Standard (International)	Team leads who need call reports
Standard (International)	User-level access with international dialling including premium numbers	International and premium	The default for new users; restrict
Standard (International without Premium)	User-level access with international but not premium dialling	International	Staff with genuine overseas callers
Standard	User-level access without international dialling	Domestic	Suggested default where premium is also blocked
Standard (no Premium)	User-level access without international or premium dialling	Domestic, no premium	Our recommended default for most users

Custom roles: where your plan allows, build admin roles that carry Standard (no Premium) calling rights, so the service desk can manage extensions without inheriting international dialling.
Remove leftover admin access: RingCentral advises removing admin access to other extensions where it is not needed, through Set User Permissions.
Break-glass: keep one Super Admin able to sign in if SSO fails. With Enforce SSO login only, confirm with RingCentral support how emergency access works for your account before you need it, and record the procedure.
Reviews: list role holders each quarter and compare with Audit Trail entries for role changes. See the Access Reviews Guide.

Single sign-on

Configure SSO at More, Security and Compliance, Single Sign-on, using Set Up in the "Set up SSO by yourself" section (or Edit if it already exists). Upload your IdP metadata file or paste its metadata URL, choose the email attribute mapping (or Custom), upload the signing certificate under Certificate Management, and import RingCentral's service provider metadata into your IdP. RingCentral publishes provider guides including Okta and Microsoft Entra ID. Then select Enable SSO Service.

Manage Your Login option	Effect	When to use
Allow users to log in with SSO or RingCentral credentials, keeping passwords (Yes)	Users can still create or change extension passwords	Pilot only
Allow SSO or RingCentral credentials, passwords not kept (No)	New or changed passwords are blocked, existing passwords still work	Transition while users move to SSO
Enforce SSO login only	Users cannot sign in with phone number and password	Target state

Until SSO is enforced, follow RingCentral's own advice to update passwords, PINs and security questions regularly and reset extension passwords periodically. See the Identity Provider and SSO Security Guide.

International calling and toll fraud controls

Toll fraud is the use of someone else's phone system to place calls, often to international or premium-rate numbers, so that the account owner pays. In a cloud phone system the routes in are usually a stolen user credential, a misused device registration or an over-permissioned extension. The controls that limit the cost are customer-side calling permissions. See the VoIP and SIP Security Guide.

Control	Where	What it does	Suggested use (NHI Mgmt Group recommendation)
Role calling rights	Users, Roles	Standard roles with or without international and premium dialling	Standard (no Premium) for most users
Default role	Users, Roles (Advanced and Ultra)	Role given to new users	Set to a role without international or premium dialling
Account-wide International Calling and International SMS	Account, Inventory & Usage, Calling Rates, Outbound Rates	Turns international calling or SMS off for the whole account; support re-enables	Incident switch, or permanently off for domestic-only businesses
Per-user, per-country and per-site restrictions	Documented in separate RingCentral articles	Block specific users, countries or area codes; site country lists on multi-site accounts	Allow only the countries you call
Blacklisted Destinations	Applied by RingCentral	Calls to these destinations are blocked by default	Leave in place

Fraud response steps

Spot it: RingCentral lists signs of compromise such as unexplained calling credit purchases and unsolicited calls. Add call volume to new countries and out-of-hours international calls to your watch list.
Contain: turn off International Calling (and SMS if affected) under Outbound Rates. RingCentral suggests this when devices have been reconfigured or a device registration may have been stolen.
Identify the source: filter the Audit Trail by user and item for recent changes to forwarding, devices or roles, and check failed logins and locked accounts.
Eradicate: reset passwords and PINs for the affected extensions, remove unknown devices, and correct roles.
Recover: ask RingCentral support to re-enable international calling once fixed, and review your per-country allow list.

Callers impersonating your help desk are a related risk; see the Vishing and Help Desk Social Engineering Awareness Guide.

Integrations, API tokens and service accounts

Integrations are registered as apps in the RingCentral Developer Console. RingCentral's guidance is to use Authorization Code with PKCE when individual users sign in to an app, and JWT for server apps or command-line tools that act on behalf of a predetermined user, typically an admin, across the account. RingCentral notes JWT is not designed for authenticating many individual users.

Dedicated service user: the JWT acts on behalf of a predetermined user, with that user's role. Create a dedicated user with a custom role carrying only the permissions the integration needs, rather than issuing a JWT as a Super Admin. See the Service Account Security Guide.
Private apps: mark internal apps as private so they can only be called with credentials from your own account.
Secret storage: keep the Client Secret and JWT in a secrets manager. Send access tokens in the Authorization: Bearer header, not as a query parameter, because proxies and gateways can log URLs. See the API Key Management Guide.
Refresh and revoke: refresh tokens are single use. Revoking a token through POST /restapi/oauth/revoke ends the whole authorisation session, which is the action to take when a credential may be exposed.
Third-party apps: review which marketplace and custom apps hold access to your account and remove those without an owner. See the SaaS and OAuth App Governance Guide.

Logging and detection

The Audit Trail is on by default for RingEX and Video Pro+ accounts and records configuration changes made in the Admin Portal by admins and users, along with failed logins and locked accounts. Super Admins and Billing Admins can view it at More, Service Console, Audit Trail, filter by Change by, Change to and Items Affected, and download a CSV with Date/time (UTC), Change made by, Role, Change made to, Item affected, Change details, Endpoint and IP Address. Records are kept for up to 180 days and the view shows at most 10,000 records, so busy accounts should export at least weekly.

Event to watch	Why it matters	ATT&CK
Role changed to Super Admin or another admin role	Privilege escalation or a missed review	T1098
Failed logins and locked accounts	Password guessing against extensions	T1110
Admin changes from an unfamiliar IP address	Possible use of a stolen admin account	T1078.004
International calling or outbound rate settings changed	Fraud set-up or an unapproved change	None
SSO settings changed	Sign-in trust altered	T1556

Metrics

Users with international or premium dialling: count and percentage, trending down to the approved list.
Super Admin count: target two or three named people.
SSO enforcement: Enforce SSO login only set; users still on passwords, target zero.
Audit export gap: days between Audit Trail exports, target seven or fewer.
Integration ownership: share of apps and JWT credentials with a named owner, target 100%.

Hardening baseline

Inventory: export users with roles, list devices, apps and JWT credentials, and record current outbound rate settings.
Roles: reduce Super Admins, move admins to scoped roles, and on Advanced or Ultra set a default role without international or premium dialling.
Calling: turn off international calling account-wide if you do not need it; otherwise restrict by user, country and site.
SSO: configure SAML, pilot with the allow-both option, move to passwords not kept, then Enforce SSO login only.
Integrations: move JWTs to dedicated low-privilege users and private apps; revoke unused sessions.
Monitoring: schedule Audit Trail exports and alerting on the events above.
Rollback: make one change at a time and confirm in the Audit Trail; for international calling, remember re-enabling needs RingCentral support, so agree that route before turning it off in production hours.

Common misconfigurations

Default role left as Standard (International): every new user can dial international and premium numbers without anyone deciding they should.
Admins with international dialling by inheritance: predefined admin roles carry Standard (International) rights; use custom roles where your plan allows.
SSO enabled but not enforced: passwords keep working, so a stolen password bypasses your IdP's MFA.
JWT issued as a Super Admin: an integration that reads call logs ends up with full system rights.
No fraud runbook: nobody knows where the Outbound Rates switch is, or that re-enabling needs support.
Audit history not kept: the 180-day and 10,000-record limits remove the evidence an investigation needs.

Framework mapping

RingCentral control	NIST SP 800-53 Rev 5	NIST CSF 2.0	CIS Controls v8.1	ISO/IEC 27001:2022 Annex A
SSO enforcement and passwords	IA-2, IA-5	PR.AA-01	6.3, 6.7	A.5.17, A.8.5
Roles and custom roles	AC-2, AC-6	PR.AA-05	5.4, 6.8	A.5.15, A.5.18, A.8.2
International and premium calling restrictions	AC-3, CM-6	PR.PS-01	4.1	A.8.9
Apps and JWT credentials	IA-5, AC-6	PR.AA-01	5.2	A.5.17
Audit Trail and export	AU-2, AU-6, AU-11	DE.CM-03	8.2	A.8.15

Practitioner checklist

Limit Super Admin to two or three named people and use scoped admin roles for daily work.
Set the default role to one without international or premium dialling where your plan allows.
Grant international calling by exception and restrict it by country and site.
Write the account-wide International Calling switch and the support re-enable step into your fraud runbook.
Configure SAML SSO and move to Enforce SSO login only.
Run integrations under dedicated low-privilege users with private apps and vaulted JWTs.
Export the Audit Trail at least weekly and alert on role, SSO and calling rate changes.
Apply vendor security updates to desk phones, softphones and apps promptly.

RingCentral Security: Roles, SSO, Apps and Toll Fraud Controls Done Right