Zoom Security: Meetings, Phone and Admin Controls

A Zoom account is only as safe as the sign-in policy, admin roles, meeting defaults and app approvals its administrators set, and most of those are customer-side choices. This guide explains how to configure Zoom Workplace for a business account: SSO and two-factor sign-in, role management, Server-to-Server OAuth apps and Marketplace approvals, meeting and webinar defaults, Zoom Phone recording retention, AI Companion controls and the reports that show what changed. It is written for Zoom administrators, identity teams and security engineers who own the tenant. For the wider discipline of securing voice, video and chat platforms, see the Unified Communications Security Guide; this page stays with Zoom's own settings.

This is an independent guide from NHI Mgmt Group, based on Zoom's public documentation as of November 2026. It is not sponsored or reviewed by Zoom. Product features change, so confirm settings against Zoom's current documentation.

Key takeaways

Enforce SSO on a managed domain first. Zoom requires an approved vanity URL and an associated, managed domain before SSO can be enforced under Sign-in Methods, and once enforced, users on that domain are redirected to your identity provider.
Turn on two-factor sign-in for anyone who keeps a password. The "Sign in with Two-Factor Authentication" setting can target all users, specific roles or specific groups, with TOTP authenticator apps or codes by SMS or phone call.
Build custom admin roles, not more owners. Role Management lets you grant View and Edit per setting area, so help desk, telephony and reporting staff each get only the areas they run.
Treat Server-to-Server OAuth apps as service accounts. Each app holds an account ID, client ID and client secret that mint one-hour tokens with the scopes you approved, so give each integration its own app and the smallest scope set.
Lock meeting defaults at account level. Waiting Room, passcodes, authenticated-only joining, recording permissions and Marketplace app pre-approval stop uninvited people and automated tools before a host has to react.

How identity and access work in Zoom

Zoom supports SAML, OAuth (for example Google or Apple sign-in) and password-based authentication, and each can be enabled or disabled individually for the account. For a business tenant the target state is simple: users on your corporate domains authenticate through your identity provider, and the few accounts that must keep a password use two-factor sign-in.

SSO and domains

Vanity URL: Zoom's SSO Field Guide states that an account must have an approved vanity URL before configuring SSO. SSO settings sit on the SSO configuration page under the advanced options.
Associated and managed domains: enforcing SSO needs the email domain to be associated and managed. Associated domains are also a prerequisite for SCIM provisioning.
Enforcement: set under Sign-in Methods on the security page. Exemptions are managed in Admin center, Security and trust, General, by editing the enforced domains list. Zoom notes that exempt users with the admin role can still sign in at admin.zoom.us during an IdP lockout, which makes a small exemption list your break-glass path.
Session length: the inactivity timeout for the web portal is set with "Set period for inactivity on the web (minutes)".

Provisioning and group mapping

Zoom offers two SSO provisioning modes: At Sign-In (just-in-time, which creates the user and SSO login type on first authentication) and Prior to Sign-In (the account must already exist). SCIM runs alongside either mode and can create, update, deactivate and delete users; Zoom lists Entra ID, Okta, JumpCloud, OneLogin and Ping Identity among supported providers, and offers an AD Sync Tool for on-premises Active Directory. Use SCIM deactivation so leavers lose Zoom access when they lose IdP access. See the SCIM Provisioning Guide.

SAML response mapping has Basic Mapping (profile fields) and Advanced Mapping (licences, add-ons, user groups and user roles). Standard mapping applies the first matching rule; Multi-mapping applies every match up to 50 rules and is enabled through Zoom Support. Because Advanced Mapping can assign roles, an IdP group that maps to an admin role is effectively a privileged group: govern it in the IdP with the same care as the Zoom role itself.

Sign-in population	Zoom setting to use	Notes
Staff on corporate domains	SAML SSO enforced under Sign-in Methods	MFA and conditional access are applied by your IdP
Break-glass admins	Exempt from the enforced domain list, password plus "Sign in with Two-Factor Authentication"	Keep to two named accounts; review sign-ins monthly (our recommendation)
Contractors on other domains	Password or OAuth sign-in with two-factor sign-in scoped to their group	Prefer guest access to meetings over a licensed account where possible
Integrations	Server-to-Server OAuth app	No interactive sign-in; tokens expire after one hour

See the How Single Sign On Works and the MFA Guide.

Admin roles and privileged access

Role Management lets you add custom roles. Zoom's Delegated Administration Field Guide shows the path: User Administration, Roles, +Add Role, then View and Edit permissions for each setting area. Permission areas include User and Permission Management (Users, User Advanced Settings, Role Management, Role Management - Phone, Groups), Account Management (Account Profile, Account Settings, Webinar Settings), Zoom Rooms Management, Dashboard, Reports, Advanced features and Zoom Phone.

Keep the owner account for ownership: use it for billing and account recovery, protect it with SSO exemption plus two-factor sign-in, and do daily work from named admin accounts.
Scope roles by job: a help desk role needs Users (Edit) and Reports (View); a telephony role needs Zoom Phone and Role Management - Phone; a compliance role needs Reports and Dashboard (View). Withhold View on billing and chat history where the job does not need it, as Zoom's own guide suggests.
Treat Role Management as tier zero: any role with Edit on Role Management can grant itself more. Restrict it to the smallest group.
Delegated administration for partners: Zoom notes that a delegate's sub-delegates are not notified to the inviting company and do not appear on the delegate list. Review partner delegations on a schedule and remove them when the engagement ends.
Require two-factor sign-in by role: the two-factor setting can target specific roles, so apply it to every admin role even if broader rollout is still in progress.

See the Privileged Access Management Guide for the wider model.

Integrations, API tokens and service accounts

Zoom integrations reach your account through apps registered on the Zoom App Marketplace. For internal automation the main pattern is the Server-to-Server OAuth app, which Zoom describes as two-legged OAuth with no user interaction. Each app holds an Account ID, Client ID and Client secret. Your server sends the client ID and secret in a Basic Authorization header with the account_credentials grant type and receives an access token that expires after one hour. There is no refresh token: the service requests a new token with the same grant. Tokens stop working when the app is deactivated.

Credential or object	What it can do	Customer-side control
Server-to-Server OAuth client secret	Mint access tokens with every scope granted to the app	Store in a secrets manager, one app per service, deactivate the app to cut access at once
Access token (one hour)	Call Zoom APIs within granted scopes	Never log or share across apps; Zoom advises sharing tokens only within one app
Marketplace app installed by a user	Act on that user's data within approved scopes	Pre-approve or restrict under Admin App Management, Permissions
Automated meeting tools (notetakers, bots)	Join meetings and capture content	Waiting Room, authenticated-only joining, Active Apps Notifier Report

One app per integration: Zoom's own guidance is to create a separate app for each service so permissions, usage and logs are easier to monitor, give app owners only the permissions they need and request only the scopes the integration requires.
Approve scopes centrally: Zoom states that account administrators authorise the scopes available to developers building these app types. Make that an approval step with an owner and an expiry date.
Rotate on a schedule: as our recommendation, rotate client secrets at least every 90 days and immediately when a developer with access leaves; confirm the current rotation steps in Zoom's developer docs.
Govern user-installed apps: on marketplace.zoom.us, Manage opens Admin App Management. Apps on Account lists installed tools with their logs; Permissions controls pre-approval and restriction; Notifications controls how admins hear about approval requests.
Review call logs: Marketplace Call Logs show the most recent 100 API requests per app, which is useful for troubleshooting SCIM and confirming an app's behaviour.

See the Service Account Security Guide and the Consent Phishing and Illicit OAuth Grants Guide.

Hardening baseline

Meetings and webinars

Set these at account level and lock them so groups and users cannot weaken them. Zoom documents that admins and owners can enable and lock these for groups or the whole account.

Setting (Zoom name)	Baseline	Why
Waiting Room	On, locked	Host admits each participant, including automated tools
Require meeting passcode	On, locked, with minimum passcode requirements set	Meeting ID alone is not enough to join
Only authenticated meeting participants and webinar attendees can join meetings and webinars	On for internal meetings, optionally restricted to your domains	Ties attendance to a signed-in identity; also required for watermarks
Generate Automatically (meeting ID)	Default for scheduled meetings	Random IDs cannot be reused for 30 days after the meeting ends
Personal Meeting ID settings	Restrict PMI use	Long-lived IDs are easy to share beyond the intended audience
Who can request host permission to record	Exclude external participants	Limits local recordings leaving the organisation
Block dial-in users when Waiting Room is disabled	On	Closes the phone path into unprotected meetings
Image and audio watermarks	On for sensitive groups (board, legal, HR)	Traces leaked recordings and screenshots
End-to-end encryption	Available per group for sensitive meetings	Participants must join from the Zoom app or a Zoom Room; phone, SIP/H.323 and web client access are blocked

Teach hosts the in-meeting controls on the Security icon: Lock Meeting stops new joins even with the ID and passcode, Suspend Participant Activities halts video, audio, sharing, chat, file access and recording at once, and Remove Participant prevents rejoining. Report sends the participant to Zoom Trust and Safety. The Active Apps Notifier tells everyone when an automated tool joins and what it accesses.

Zoom Phone

End-to-end encrypted calls: Zoom Phone supports E2EE for calls between two Zoom Phone users in the same account when both meet the requirements; enable it for groups that handle sensitive calls.
Recording retention: call recording retention defaults to indefinite and can be set from 1 to 4,000 days. Set a retention period that matches your records schedule at account, group and extension level.
Storage location: Customer Content Storage settings control where recordings and transcripts are kept, at account, group, user, Auto Receptionist, Call Queue and Shared Line Group level.
Information barriers: block restricted groups from searching, calling or texting each other where regulation requires separation.
Calling restrictions: confirm international calling and emergency address settings against Zoom's current Phone admin documentation, and pair them with the controls in the VoIP and SIP Security Guide.

AI Companion

Owners and admins enable or disable Zoom AI features for the account, choose which groups receive them and lock availability so users cannot change it. For data handling, Zoom documents Zero Data Retention for Meeting Summary (disable and lock "Meeting transcript", or set transcript retention to 0 days), personal data redaction for meeting summaries via a support ticket, and custom disclaimer messages with separate internal and external versions. Hosts can turn off summaries others started and delete transcripts and summaries. See the AI Meeting Assistant Security Guide.

Logging and detection

Zoom's Reports area includes Admin Activity Logs, User Activity Reports and Sign In/Sign Out. Zoom Phone keeps web audit logs for retention policy changes and automated deletions of voicemails, recordings and SMS. The Active App Notifier Report shows tools that accessed meeting or webinar content in the past 30 days. Pull these into your SIEM through a Server-to-Server OAuth app with read-only report scopes, which is itself an integration to govern.

Signal	Source	What to alert on
Role or permission change	Admin Activity Logs	Edits to Role Management, new admin role assignments, changes outside change windows
Sign-in policy change	Admin Activity Logs	SSO enforcement disabled, enforced domain list edited, two-factor setting changed
Unusual sign-in	Sign In/Sign Out report, IdP logs	Exempt break-glass accounts signing in, sign-ins from new countries
New integration	Apps on Account, Marketplace notifications	New Server-to-Server OAuth app or newly approved app with broad scopes
Meeting setting unlocked	Admin Activity Logs	Waiting Room or passcode lock removed at group or account level
Bulk deletion	Phone web audit logs	Retention policy shortened or recordings deleted outside policy

Metrics that show the baseline is holding (our suggested set):

Percentage of licensed users signing in through enforced SSO (target above 98%).
Number of accounts with Role Management Edit (target: two or three).
Server-to-Server OAuth apps with a named owner and a secret rotated within 90 days (target 100%).
Locked meeting defaults that drift from baseline per quarter (target zero).
Automated tools in the Active App Notifier Report that were not pre-approved.

See the CIS Control 8 Audit Log Management Guide.

Common misconfigurations

SSO configured but not enforced: users keep password sign-in alongside SSO, so the IdP's MFA and leaver process can be skipped. Enforce on managed domains and keep a short exemption list.
Large exemption list: the enforced domain exemption becomes a habit for convenience. Limit it to break-glass accounts with two-factor sign-in and review it quarterly.
IdP groups mapped to admin roles without governance: Advanced Mapping assigns roles from SAML attributes, so a loosely managed IdP group becomes a route to Zoom admin. Put those groups under access review.
One Server-to-Server OAuth app for everything: a single app with broad scopes serves reporting, provisioning and recording export, and its secret sits in several pipelines. Split by service and cut scopes.
Meeting defaults set but not locked: groups or users switch Waiting Room or passcodes off. Lock them at account level and grant exceptions per group.
Recording retention left at indefinite: Phone recordings accumulate with no deletion. Set retention to match your records schedule.

Rolling out the baseline

Inventory: export users, roles, groups, Server-to-Server OAuth apps and Apps on Account; record current Sign-in Methods and locked settings.
Protect admins first: create custom roles, move staff off the owner account and apply two-factor sign-in to admin roles.
Pilot SSO enforcement: associate and manage the domain, enforce for a pilot group, confirm the break-glass exemption works, then extend to all domains. Roll back by removing the domain from enforcement.
Turn on SCIM: connect your IdP and test deactivation with a pilot leaver.
Lock meeting defaults: apply the table above to a pilot group for two weeks, gather host feedback, then lock at account level.
Govern apps: move Marketplace approval to pre-approval, split integrations into one app each and move secrets to a vault.
Wire up logging: send Admin Activity Logs and sign-in reports to the SIEM and set the alerts above.

Framework mapping

Zoom control	NIST SP 800-53 Rev 5	NIST CSF 2.0	ATT&CK risk addressed
SSO enforcement, two-factor sign-in	IA-2, IA-5	PR.AA-01	T1078.004 Cloud Accounts
Custom roles, SCIM deactivation	AC-2, AC-6	PR.AA-05	T1078.004 Cloud Accounts
Server-to-Server OAuth app governance	IA-5, AC-6	PR.AA-01	T1528 Steal Application Access Token, T1550.001 Application Access Token
Locked meeting defaults	CM-6, CM-7	PR.PS-01	Unwanted access to meetings by uninvited participants
E2EE, watermarks	SC-8, SC-13	PR.PS-01	Interception or leak of meeting content
Admin Activity Logs to SIEM	AU-2, AU-6	DE.CM-03	Detection of the above

Practitioner checklist

Approve the vanity URL, associate and manage your domains, and enforce SSO under Sign-in Methods.
Keep two break-glass admins exempt from SSO enforcement, each with two-factor sign-in.
Apply "Sign in with Two-Factor Authentication" to all admin roles and any password-based users.
Replace shared admin use with custom roles; restrict Role Management Edit to two or three people.
Connect SCIM and confirm leavers are deactivated in Zoom.
Create one Server-to-Server OAuth app per integration with minimum scopes, store secrets in a vault and rotate them.
Move Marketplace apps to pre-approval and review Apps on Account quarterly.
Lock Waiting Room, passcodes, authenticated joining and recording permissions at account level.
Set Zoom Phone recording retention and AI Companion data settings to match your records policy.
Send Admin Activity Logs and Sign In/Sign Out reports to your SIEM with alerts on role and sign-in policy changes.

Zoom Security: Configuring Meetings, Phone and Admin Controls