Managing Zoom on Web with network controls via proxy header policies
Organizations often need to enforce authentication requirements and restrict which Zoom accounts employees can use when accessing Zoom services. While many organizations use mobile device management (MDM), group policy objects (GPO), or property list (PLIST) configurations to manage the Zoom desktop and mobile apps, these solutions don't extend to web browsers.
Network controls via proxy header policies provide a solution that works across platforms, including desktop, mobile, and web. By configuring your SSL intercepting proxy to insert policy headers into HTTPS requests, you can enforce organization-wide Zoom policies at the network level. For example, you can require all users joining meetings from a web browser to be signed in to an approved Zoom account.
Requirements for setting up Zoom network controls via proxy header policies
- A Zoom account with at least 1,000 users
- Contact Zoom Support to request this
- An SSL intercepting proxy that you control, capable of injecting HTTP headers into outbound HTTPS requests
How network controls work
When a user on your network connects to the Zoom Cloud, the following process takes place:
- The user's device sends an HTTPS request to Zoom.
- Your SSL intercepting proxy intercepts the request and inserts an X-ZoomApps-Policy header that references your organization's policy identifier.
- Zoom reads the header and applies the policies associated with that identifier to the user's session.
Note: Network policies override any matching local GPO or MDM policies configured for Zoom clients. Only one X-ZoomApps-Policy header is accepted per request. If multiple headers are received, the HTTPS request will be rejected.
Supported policies
You can include the following policies in your network controls ("Network Control Policy").
Web browser policies
The following policies can be enforced when users access Zoom through a web browser.
| Policy | Description | When applied |
|---|
| SetEmailDomainsRestrictedToLogin |
Set the email address domains that users can sign in with, each separated by "&".
Example: zoom.us&example.com
| Works when signing in again |
| EnforceSignInToJoin | Require users to be authenticated before joining a meeting. Authentication can take place through the web portal if joining through a join URL. | Immediately |
| EnforceSignInToJoinWebinar | Require users to be authenticated before joining a webinar. Authentication can take place through the web portal if joining through a join URL. | Immediately |
| BlockAnonymousAccess | Require users to be authenticated before entering a Whiteboard session. | Immediately |
Zoom Workplace app policies
The following mass deployment controls have been designed to work with the network policy. The policy is applied at sign in. For sign in-related settings, users must sign in once before the policy takes effect.
| Policy | Description | When applied |
|---|
| SetEmailDomainsRestrictedToLogin |
Set the email address domains that users can sign in with, each separated by "&".
Example: zoom.us&example.com
| Works when signing in again |
| DisableShareScreen | Disable the ability to share your screen in meetings and webinars. This does not disable incoming screen sharing from other participants. | Immediately |
| DisableRemoteControl | Disable the remote control feature. | Immediately |
| DisableMeetingFileTransfer | Disable in-meeting file transfer (sending and receiving). | Immediately |
| DisableLocalRecording | Disable recording locally on the device. | Immediately |
| DisableMeeting3rdPartyFileStorage | Disable in-meeting third-party file transfer. | Immediately |
| DisableFacebookLogin | Remove the Facebook sign-in option. | Works when signing in again |
| DisableGoogleLogin | Remove the Google sign-in option. | Works when signing in again |
| EnableAppleLogin | Remove the Apple sign-in option. | Works when signing in again |
| DisableAnnotation | Disable and remove the ability to annotate over a shared screen. | Immediately |
| DisableInMeetingZoomDocs | Disable the ability to edit Zoom Canvas docs while in a meeting. | Immediately |
| EnforceSignInToJoin | Require users to be authenticated before joining a meeting with the desktop app. Authentication can take place through the web portal if joining through a join URL. | Immediately |
| EnforceSignInToJoinWebinar | Require users to be authenticated before joining a webinar with the desktop app. Authentication can take place through the web portal if joining through a join URL. | Immediately |
How to create a Network Control Policy
To set up a Network Control Policy, you'll need to define a policy in JSON format and submit it to Zoom Support for implementation.
Define your policy
- Choose a unique policy name using the format
zoom-control-[UniqueIdentifier]-[Number] to match Zoom's naming standards. The unique identifier can be your vanity URL or any unique string that identifies your organization. For example: zoom-control-Company1234-1 - Write your policy in JSON format, including the following fields:
policy-id : The unique policy name you created in step 1.min-client-ver : (Optional) The minimum Zoom client version required. Users on older versions will be prompted to update.feature-control : An object containing one or more policy settings and their values. Refer to the supported policies for available options.
- Review your completed policy JSON to confirm all settings are correct before submitting.
Note: Only policies from the supported policies list can be included in your Network Control Policy.
Submit your Network Control Policy to Zoom Support
- Contact Zoom Support and include your completed policy JSON.
- Zoom Support will review and validate your policy, then schedule the implementation during a maintenance window.
Note: Implementation typically takes 2–3 weeks, as changes can only be applied during scheduled downtime. Change freezes may extend this timeline.
How to apply a Network Control Policy
Once your policy has been implemented by Zoom Support, configure your SSL intercepting proxy to insert the policy header into outbound HTTPS requests to *.zoom.us.
- In your SSL intercepting proxy configuration, add an HTTP header injection rule for all HTTPS requests to *.zoom.us.
- Set the header name to
X-ZoomApps-Policy and the header value to your policy identifier. For example: X-ZoomApps-Policy: zoom-control-Company1234-1 - Save and apply your proxy configuration.
Note: Only one X-ZoomApps-Policy header is accepted per request. If your proxy inserts multiple headers with this name, the HTTPS request will be rejected by Zoom.
Example policy
The following is an example of a complete Network Control Policy in JSON format:
{
"policy-id": "zoom-control-ZoomTest-1",
"min-client-ver": "7.0.1",
"feature-control": {
"SetEmailDomainsRestrictedToLogin": "zoom.us&zoom.com&test.zoom.com",
"EnforceSignInToJoin": 1,
"EnforceSignInToJoinForWebinar": 1
}
}
This example policy does the following:
- Requires users to sign in before joining meetings and webinars.
- Restricts sign-in to the following email domains:
- zoom.us
- zoom.com
- test.zoom.com
- Requires users to be on Zoom Workplace app version 7.0.1 or later.
To apply this policy, your SSL proxy would insert the following header into requests to *.zoom.us:
X-ZoomApps-Policy: zoom-control-ZoomTest-1