Configuring with Single Sign-on (SSO)

Single sign-on allows you to log in using your company credentials. Zoom single sign-on (SSO) is based on SAML 2.0. Zoom has developed integrations for Okta, Microsoft Entra ID, and Active Directory On-Prem (refer to the Managing the AD Sync Tool and Configuring Zoom SSO with ADFS articles). Zoom SSO also works with Identity Providers (IdP) such as Centrify, Microsoft Active Directory, Gluu, OneLogin, PingOne, Shibboleth, and many others. Zoom can map attributes to provision a user to a different group with feature controls.

Zoom acts as the Service Provider (SP), and offers automatic user provisioning. You do not need to register as a user in Zoom. Once Zoom receives a SAML response from the Identity Provider (IdP), Zoom checks if this user exists. If the user does not exist, Zoom creates a user account automatically with the received name ID.

Requirements for configuring Single Sign-On (SSO)

• Business, Education, or Enterprise account
• Approved Vanity URL
• An approved associated domain is required for pre-provisioning users using the SCIM2 protocol. If you do not have a matching associated domain, you will receive an error when attempting to pre-provision a user. All other types of provisioning, including at sign-in, will send an invitation to the user to confirm email ownership for user account provisioning.

How to configure Single Sign-On (SSO)

Note: If you don't already have an approved vanity URL, apply for your vanity URL (such as https://yourcompany.zoom.us) on your Account Profile page. You will need to wait for this to be approved before you can configure the SSO on the Zoom side.

1. Configure your IdP to send us the following:
   • Any unique identifier linked to nameID such as edupersonTargetedID, persistentID, or mail
   • (Optional) Accepted attributes are email (urn:oid:0.9.2342.19200300. 100.1.3), sn (urn:oid:2.5.4.4), and givenName (urn:oid:2.5.4.42).
2. Sign in to the Zoom web portal as an admin.
3. In the top-right corner, click your profile picture or initials, then click Admin Center.
4. In the side menu, click Security and Trust.
5. Click Single Sign-On.
6. Select the vanity URL you want to configure with an IdP.
   Note: If you have only one vanity URL, you will not see additional options. Learn about multiple vanity URLs.
7. Enter the following SSO information:
   • Issuer (IDP Entity ID): <ID of EntityDescriptor>
   • Sign-in page URL: <SingleSignOnService>
   • Sign-out page URL: <SingleLogoutService>
   • Identity Provider Certificate: <X509Certificate>
     Note: Remove the Begin Certificate and End Certificate portions before saving.
   • Signature Hash Algorithm: Select which hash algorithm is used, either SHA-1 or SHA-256
   • Security:
     • Sign SAML request: Enable this option to have Zoom sign the SAML authentication request sent to your IdP, ensuring request integrity and authenticity.
     • Sign SAML logout request: Enable this option to have Zoom sign the SAML logout request, ensuring that logout requests are verified and trusted by your IdP.
     • Support encrypted assertions: Enable this option if your IdP sends encrypted SAML assertions, adding an extra layer of security to the authentication response.
   • Service Provider (SP) Entity ID: Select the correct certificate.
     Note: You can also create a self-signed certificate instead of using the CA certificate. 
   • Binding: Choose HTTP POST or HTTP Redirect.
   • Provision User: Choose when to provision users in Zoom, either At Sign-In or Prior to Sign-In.
   • More settings:
     • Save SAML response logs on user sign-in: Enable this option to log SAML responses each time a user signs in, which is useful for troubleshooting SSO issues.
8. Click Save Changes.

With configuration complete, you can get the SP metadata XML file from https://yourcompany.zoom.us/saml/metadata/sp and users can sign in with SSO.

How to enable or disable automatic SSO certificate rotation

Admins can enable or disable a setting to automatically manage the SSO certificate. Zoom will automatically change the certificate when a new one is available. Admins can also roll back to a previous certificate. This setting is enabled by default.

For updates on new SSO certificates, see our release notes for Web.

1. Sign in to the Zoom web portal as an admin.
2. In the top-right corner, click your profile picture or initials, then click Admin Center.
3. In the side menu, click Security and Trust.
4. Click Single Sign-On.
5. Click Edit in the top-right corner.
6. In the Service Provider (SP) Entity ID section, check or uncheck Automatically manage the certificate.
   Note: One of the three Security settings below must be enabled first before the option Automatically manage the certificate appears:
   1. Sign SAML request
   2. Sign SAML logout request
   3. Support encrypted assertions