Configuring Zoom with Azure

You can connect Zoom with Azure to use your company's Azure credentials to login to your Zoom account via Single Sign-On (SSO). You can assign users Zoom licenses based on their group in Azure.

Note: The JWT app type will be deprecated on June 1, 2023. At this time, configuring Zoom with Azure only supports JWT. We are currently working with Microsoft to implement OAuth support for Azure Enterprise Applications and will provide updates as this becomes available.

Microsoft has advised that support for OAuth should be available to customer tenants by the end of April 2023, and as such Zoom will provide updated guidance and documentation for JWT to OAuth migration in the first week of May 2023. These dates should be considered tentative and will be updated pending any further timeline changes from Microsoft.

This article covers:

• How to add Zoom from the Azure Gallery
• How to configure Single Sign-On with Azure
• How to assign Azure Users and Groups to Zoom
• How to set up Group Mapping (Optional)
• Mapping Basic Information
• How to set up Auto Provisioning in Azure AD

Prerequisites for configuring Zoom with Azure

• Zoom owner or admin privileges
• Business or Education account with approved Vanity URL
• An Azure AD subscription
• Ability to generate a JSON Web Token (JWT)

Note: Without an approved associated domain, users will need to confirm to being provisioned on the account through an email automatically sent to them. Provisioning will take place without email confirmation for any users falling under an approved domain.

How to add Zoom from the Azure Gallery

Note: Screenshots in this article were taken using the default Azure theme. Your Azure portal will look slightly different if you changed the theme.

1. Sign in to the Azure portal.
2. Click Azure Active Directory in the left panel.
   
3. Click Enterprise Applications.
   
4. Click All Applications.
   
5. Click New Application at the top of the window.
   
6. In the Add from Gallery window, search for Zoom.
   
7. Click Zoom in the Telecommunications category.
   
8. Click the Add button on the right side.

How to configure Single Sign-On with Azure

1. In the Azure portal, on the Zoom application page, click Single sign-on.
   
   
2. Under Select a single sign-on method, select SAML.
3. Click the edit icon for Basic SAML Configuration.
4. Fill out the following fields:
   • For Identifier (Entity ID), enter your vanity URL without https://.
     Eg. yourvanityurl.zoom.us
     
   • For Reply URL, enter https://yourvanityurl.zoom.us/saml/SSO
     
     
   • For Sign on URL, enter https:// followed by your Vanity URL.
     Eg. https://yourvanityurl.zoom.us
     
5. Click Save.
6. To view the claims being passed by Azure, click the pencil icon in the UserAttributes section.
7. Under SAML Signing Certificate, click Download next to Certificate (Base 64) and save it to your computer.
   
   Note: Check that the certificate's status is active. If it is listed as inactive, click the Edit button, and click Make certificate active.
   
8. Click Save at the top.
   
9. Scroll to Set up Zoom.
   Note: You can also click View step-by-step instructions, to access the quick reference guide, and download your Azure AD Signing Certificate if you did not in step 7.
10. Open a new browser tab/window and sign in to the Zoom web portal.
11. Access the Single Sign-On page.
12. From Azure, under Set up Zoom, click Configuration URLs.
13. Copy the Login URL and paste it into the Sign-in page URL field in the SAML configuration page in Zoom.
14. Open the certificate you downloaded in Step 5 in a text editor. Copy the portion between -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- and paste it into the Identity provider certificate field in Zoom.
15. For Service Provider (SP) Entity ID, select the version of your vanity URL without https, eg. yourvanityurl.zoom.us
16. Under Configuration URLs in Azure, copy the Azure Azure AD Identifier from Azure and paste it into the Issuer (IDP Entity ID) field in the SAML configuration page in Zoom.
17. In Azure, click on All Services on the left.
18. Search for and click App registrations.
19. Click Endpoints.
    
    
20. Copy the SAML-P Sign-out Endpoint and paste it into Sign-out page URL in Zoom.
21. In Zoom, for Binding, select HTTP-Post.
22. Click Save Changes.

How to assign Azure users and groups to Zoom

1. In the Azure portal, click Azure Active Directory.
   
2. Click Enterprise Applications.
   
3. Click All Applications.
   
4. Click Zoom.
5. Click Users and groups.
   
6. Click Add user.
   
7. Click Users and groups.
   
8. Search for the user or group you want to add.
9. Click it and a check mark will appear next to the name.
   
10. Click Select.
    
11. Click Select Role.
    
12. Select the role type that you would like to designate in Azure. This information will not be passed to Zoom. The Role type in Zoom will be set based on SAML Mapping. Alternatively, you can set up group mapping to have the role type passed on to Zoom.
13. Click Select.
    
14. Click Assign.
    

 

How to set up Group Mapping (Optional) 

Follow these steps if you want to set up the Azure user role with Zoom. See the previous section for instructions on how to assign a user role.

1. In the Azure portal, click Azure Active Directory, then click Applications.
2. Click Enterprise Applications.
3. Click the previously created Zoom app.
4. In the Attributes and Claims section, click Edit.
5. Under Additional Claims, click http://schemas.microsoft.com/ws/2008/06/identity/claims/groups.
   Note: If the schema is not listed, you will need to add the schema first.
6. Under Claim Conditions, select the desired groups.
7. Click Save.
8. In the navigation menu, click Single Sign-on.
9. Find the property "groupMembershipClaims" and change the value from null to "SecurityGroup". This allows the group claim to be passed to Zoom.
   Note: The values are case sensitive.
   
10. Click Save.
11. Go back to main menu and click Azure Active Directory then Groups.
    
12. Select the group that you want to create mapping for and copy the Object ID for future use.
    
13. Log in to your Single Sign-On Configuration page in the Zoom web portal.
14. Click the SAML Response Mapping tab.
15. In the SAML Advanced Information Mapping section, click Add.
16. Enter the following information:
    • SAML Attribute: Enter  http://schemas.microsoft.com/ws/2008/06/identity/claims/groups.
    • SAML Value: Paste the Object ID from step 9.
    • ResultingValue: Select the expected user type for group members.
17. Repeat steps 15 and 16 to configure additional group mapping for each user type.

Mapping Basic Information

1. Login to your Single Sign-On Configuration page in the Zoom web portal.
2. Click SAML Response Mapping.
3. The first section of this page covers Basic SAML Information Mapping.
   
4. Add the Source Attribute listed below for the corresponding value.
   

   Name	Source Attribute
   Email Address	http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress
   First Name	http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname
   Last Name	http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname
   Phone Number	http://schemas.xmlsoap.org/ws/2005/05/identity/claims/phone
   Department	http://schemas.xmlsoap.org/ws/2005/05/identity/claims/department

How to set up Auto Provisioning in Azure AD

Auto-provisioning allows the management of users within Zoom from Azure. If a user is added to Azure and/or assigned the Zoom app, they will be provisioned in Zoom automatically. If the user is unassigned or deactivated in Azure, they will be deactivated in Zoom as well. 

1. Sign in to the Azure portal.
2. Click Azure Active Directory in the left panel.
   
3. Click Enterprise Applications.
   
4. Click Zoom.
5. Click Provisioning.
   
6. Fill in the fields under Admin Credentials:
   • For the Tenant URL enter https://api.zoom.us/scim
   • For the Secret Token, generate a JSON Web Token (JWT)** using your Zoom Marketplace key and secret.
     Note*: You must have your own method of creating the JWT. Zoom does not provide this functionality.
     Note**: The JWT app type will be deprecated in June 2023. We recommend that you create Server-to-Server OAuth or OAuth apps to replace the functionality of a JWT app in your account when the functionality becomes available. At this time, configuring Zoom with Azure only supports JWT.
   
7. Click Test Connection, to confirm that Azure is able to connect to Zoom via API. 
8. Leave the Default Mapping as below:
9. Set Provisioning Status to On.
10. Choose Scope.
11. Click Save.