Advanced SAML mapping allows you to designate a Zoom license, add-ons, user roles, user groups, or IM groups based on a value being passed using SAML. This can allow you to have certain users, for example university faculty, to receive a license during sign-in, while other users, for example university students, will be Basic (non-licensed) users after sign-in. You can also deny users access to your Zoom account using advanced SAML mapping.
Advanced SAML mapping affects new users and also existing users with member or admin privileges upon their next login using SSO. Advanced SAML mapping does not apply to the Zoom account owner.
- Account owner or admin privileges
- SSO configured
Setting up advanced SAML mapping
The SAML attributes and the corresponding values will need to be configured in your identity provider (IdP). Once you have configured them in your IdP, you can set up advanced SAML mapping in Zoom.
- Sign in to the Zoom web portal.
- In the navigation menu, click Advanced then Single Sign-On.
- Click SAML Response Mapping.
- Scroll down to the SAML Advanced Information Mapping section.
- Click Add next to the item that you want to designate based on SAML value.
- User Type: Specify if this user should receive a Basic, Licensed, On-Prem (for accounts using On-Premise) or None, which will deny the user access to your Zoom account.
- Add-on Plan: Specify if this user should receive an add-on plan, such as a Webinar or Large Meeting License. They will also need to be Licensed assigned to them to use an add-on plan.
Note: We currently only support assigning or removing add-on plans. Changing add-ons, from Webinar 100 to Webinar 500 for example, is not supported and must be done manually by an Admin on the Users page.
- Sign in to Sub Account (only available for the parent account): Specify if this sub-account user can sign in the target sub-account using the parent account’s vanity URL.
- User Role: Specify if this user should be an admin, member or a customized role. (set up in Role Management).
- User Group: Specify if this user is added to a group. Groups can limit features and permissions.
- Channel: Assign specific IdP groups to channels. When creating a new channel through SAML mapping, you are prompted to assign an existing user as the channel admin.
- Recording Location: Specify the Communications Content storage location.
- User Group Admin: Specify if this user is a group admin for the selected group.
- Zoom Rooms Admin: Specify if this user is a Zoom Rooms admin for the selected location.
- IM Group: Specify if this user is added to an IM group.
Note: See the Zoom Chat admin guide for instructions on deploying chat for the first time.
- Zoom Phone Calling Plan: Specify if this user has a Zoom Phone license and requires a calling plan (for outbound calling or direct phone numbers).
- Zoom Phone Site: Specify if this user should be assigned to a site.
- Enter the SAML Attribute, SAML Value and Resulting Value. You can add multiple SAML Attributes and/or values if you would like to designate different groups of users to receive different results.
- SAML Attribute: Enter the Attribute Name being passed by your IdP.
- SAML Value: Enter the value being passed by your IdP for this specific user or group of users.
Note: This value is not case sensitive. For example, ABC and abc will be treated as the same value.
- Resulting Value: Select how you want this user assigned in Zoom based on the SAML value.
- Add additional SAML mappings by clicking Add.
- Click Save Changes.