Configure Zoom for UserLock Single Sign-On (SSO)

This guide explains how to integrate Zoom with UserLock Single Sign-On (SSO) using the SAML 2.0 protocol.

Once configured, Zoom logins are authenticated by UserLock against Active Directory, enabling administrators to enforce UserLock access policies (MFA, time, machine, or location restrictions) on Zoom sessions. Zoom acts as the SAML Service Provider and can create a Zoom user account when a user signs in successfully for the first time.

To request or check a Vanity URL, open https://zoom.us/account, go to Account Management ▸ Account Profile and locate Vanity URL. Zoom cannot be configured for SAML SSO until the Vanity URL has been approved.

1. In the UserLock console, go to Server settings ▸ Single Sign-On.

2. In the application list, select Zoom.

3. Complete the Zoom profile:

Save the profile.

For a Vanity URL of https://contoso.zoom.us, UserLock expects the following Zoom Service Provider values:

The Entity ID does not include https://.

Your UserLock SSO URL is displayed in Server settings ▸ Single Sign-On. In this guide, <SSO_address> is that URL without the protocol. For https://sso.contoso.com, the SSO address is sso.contoso.com. If the URL uses a custom port, include it in every endpoint: https://sso.contoso.com:450 gives sso.contoso.com:450.

1. Open https://zoom.us/signin and sign in with a Zoom account owner or administrator account.

2. Go to Advanced ▸ Single Sign-On.

3. If your account has several Vanity URLs, select the one you are configuring.

4. Click Edit.

Then choose one of the two methods below.

1. Import the UserLock SAML metadata using either option:

   • Metadata URL: enter https://<SSO_address>/metadata.

   • Metadata file: in the UserLock console, go to Server settings ▸ Single Sign-On, click Download ▸ Metadata file, then upload the file to Zoom.

2. Review the imported values against the table in Method B, and correct any field Zoom did not fill or filled incorrectly.

3. Click Save Changes.

The import includes the UserLock SAML certificate, so no certificate has to be pasted manually.

Complete the Zoom SSO configuration with the following values:

Then configure the Identity Provider Certificate:

1. In the UserLock console, go to Server settings ▸ Single Sign-On and click Download ▸ SAML certificate.

2. Open the certificate in a text editor and copy its full content, including the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines.

3. Paste the content into the Zoom Identity Provider Certificate field.

4. Click Save Changes.

With a UserLock SSO URL of https://sso.contoso.com, the sign-in page URL is https://sso.contoso.com/saml/sso, the sign-out page URL is https://sso.contoso.com/connect/endsession and the issuer is https://sso.contoso.com.

UserLock sends the user's matching email address as the SAML NameID, and provides the email address, first name and last name as SAML attributes. Configure Zoom to map them to the user profile fields.

1. In the Zoom web portal, go to Advanced ▸ Single Sign-On.

2. Open the SAML Response Mapping tab.

3. Under SAML Basic Information Mapping, configure:

   • Email Address: urn:oid:0.9.2342.19200300.100.1.3

   • First Name: urn:oid:2.5.4.42

   • Last Name: urn:oid:2.5.4.4

4. Set Default License Assignment:

   • Basic for an unlicensed Zoom user.

   • Licensed if users should receive an available paid license.

   • None only if you use Advanced SAML Mapping to grant licenses selectively.

5. Optionally enable Update at each SSO login for the first name and last name fields, so Zoom synchronizes these values on every sign-in.

6. Save the response mapping.

Keep your existing Zoom administrator session open while testing.

From a web browser:

1. Open an incognito or private browser window.

2. Open your Vanity URL, for example https://contoso.zoom.us, and click Sign in.

3. Authenticate through UserLock with an Active Directory account whose email address matches the Email domain configured in the Zoom profile.

4. Confirm that the user is redirected to UserLock, that authentication succeeds, that the user reaches the correct Zoom account with the right email address, first name and last name, and that the expected license is assigned.

From the Zoom Workplace application:

1. Open the desktop or mobile application and select Sign In with SSO.

2. Enter the company domain, which is the Vanity URL subdomain. For https://contoso.zoom.us, enter contoso, not the email domain and not the full URL.

3. Continue and authenticate through UserLock.

The standard configuration does not require Zoom to sign incoming SAML authentication requests. Leave Sign SAML request and Sign SAML logout request disabled unless your organization requires signature validation.

If you enable either setting:

1. Open the Zoom Service Provider metadata at https://<Zoom_subdomain>.zoom.us/saml/metadata/sp, for example https://contoso.zoom.us/saml/metadata/sp.

2. Locate the X.509 certificate associated with the signing key and copy its value.

3. In the UserLock console, open the Zoom application profile and paste the value into the Certificate field.

4. Save the profile.

If Zoom later changes its Service Provider signing certificate, update the Certificate field in UserLock before the new certificate is used.

Adding your email domain as a Zoom associated domain removes the email ownership confirmation for new users, and it is required before you can enforce SSO for that domain.

1. In the Zoom web portal, go to Account Management ▸ Account Profile.

2. Open the Account Profile tab.

3. Under Associated Domains, click + Add Other Domains.

4. Enter the email domain used by your Zoom users, for example contoso.com, then click Add Domains.

5. Click Verify next to the domain and select a verification method: DNS TXT record, HTML file upload, meta tag on the domain website, or manual approval by Zoom Support.

6. Once the domain is verified, enable Manage users with the same domain and save.

A recovery administrator can sign in with a Zoom password while SSO is enforced. Configure it before you require SSO.

1. Go to Advanced ▸ Security.

2. Under Sign-in Methods, confirm that Allow users to sign in with work email remains enabled. Without a second sign-in method, the bypass account cannot be used.

3. Confirm that at least one Zoom account owner or administrator has a known Zoom password.

4. Under Specify users who can bypass SSO sign-in, click + Add Users and add the recovery administrator's email address.

5. Save, then test the recovery account in a private browser window from https://zoom.us/signin.

Configuring SAML SSO does not disable password sign-in. To force users from your email domain through UserLock, the domain must first be verified and managed.

1. Go to Advanced ▸ Security ▸ Sign-in Methods and enable Allow users to sign in with Single Sign-On (SSO).

2. Select Require users to sign in with SSO if their e-mail address belongs to one of the domains below.

3. Click Select Domains and select the verified email domain.

4. Confirm that the recovery administrator appears in the SSO bypass list.

5. Click Save.

For common issues, see Troubleshooting SSO.

If the problem persists, contact IS Decisions Support.

UserLock found no email address on the authenticating Active Directory account matching the Email domain configured in the Zoom profile. Confirm that:

• The Email domain in UserLock is correct.

• The Active Directory user has an email address in that domain, present in the mail or proxyAddresses attributes.

• The address contains no typing error and no unexpected subdomain.

An Email domain of contoso.com requires an address such as user@contoso.com.

Application Domain contains more than the Vanity URL subdomain. See Step 1.

Check the three attribute mappings in Advanced ▸ Single Sign-On ▸ SAML Response Mapping against Step 3, then confirm that the Active Directory account holds the correct email address, given name and surname.

Sign SAML request or Sign SAML logout request is enabled in Zoom, and the current Zoom Service Provider signing certificate is missing or outdated in the UserLock Zoom profile. See Validate signed SAML requests. If request signing is not required, disable both Zoom settings and leave the UserLock Certificate field empty.

Open https://<SSO_address>/metadata from a browser outside your corporate network. It must be reachable over HTTPS and return the UserLock SAML metadata. If it is not, check the public DNS record, the HTTPS binding and SSL certificate, external access to the HTTPS port, and any reverse proxy or firewall rule. You can configure Zoom using Method B in Step 2 in the meantime.

Use the recovery administrator added to the Zoom SSO bypass list.

1. Open https://zoom.us/signin and sign in with the recovery administrator's work email and Zoom password.

2. Go to Advanced ▸ Security ▸ Sign-in Methods.

3. Clear Require users to sign in with SSO if their e-mail address belongs to one of the domains below and save.

Users can then sign in with another enabled method while the SSO service is unavailable. Re-enable the requirement once UserLock SSO is reachable again.

You can extend the security of SSO sessions by applying UserLock access policies in addition to authentication.

• Apply MFA on SaaS connections to require stronger authentication.

• Hour restrictions: define when users are allowed to connect.

• Geolocation rules: enforce access policies based on user location.

• Session limits: allow or deny SaaS logins entirely for specific users.