Skip to main content
Connect Zoom to Oleria to see who has access to your Zoom account and what they can reach: users and how they sign in, groups, Team Chat channels and shared spaces, roles, Marketplace apps and API users, and the whiteboards, clips and cloud recordings people share — including with external users and anyone who has the link. Oleria reads this data through a Server-to-Server OAuth app that you create in your own Zoom account, and you can take remediation actions directly from Oleria.

​
What Oleria discovers

Once connected, Oleria continuously discovers and maps the following from your Zoom account:
  • Accounts - every active and deactivated user, with their name, email address, department, role, license type, when they were created, and when they last signed in. Oleria shows each user’s sign-in methods (Zoom work email and password, single sign-on, or sign-in with Google, Microsoft, Apple, or another provider), whether two-factor authentication is required for them under your account’s 2FA policy, and whether single sign-on is required for them.
  • Non-human identities - API users, shown with the API-only user type, and the Marketplace apps added to or created in your account, shown with the Application type and the OAuth scopes each app requests. Apps your account restricts are shown as disabled.
  • External users and public links - users from other Zoom accounts who are members of your Team Chat channels or collaborators on your whiteboards and clips, and a single Anyone with the link principal for content that anyone with the link can open. An external person who has access to several whiteboards and clips appears once, matched by email address.
  • User groups - your Zoom groups, Team Chat channels, and Team Chat shared spaces, with their members. Each channel and space membership shows the member’s role (owner, admin, or member), and Oleria shows which Zoom groups were added to a channel. Channels that are open to other Zoom accounts, or private channels with external members, are labeled as external channels.
  • Roles - your account roles (Owner, Admin, Member, and custom roles) and the privileges each one grants, and which role each user holds. Oleria also shows which roles can view or manage every cloud recording or whiteboard in your account.
  • Ownership and delegation - group administrators, channel and space owners, and the owners of whiteboards, clips, and recordings. Oleria also shows scheduling assistants, who can schedule meetings and act on behalf of the user they assist.
  • Resources - whiteboard projects, whiteboards, clips, and cloud recordings, and who can access each one with which role (owner, co-owner, editor, commenter, viewer, or host). Whiteboards are shown inside their projects, and subprojects inside their parent projects.
  • Activity - Zoom admin operation logs, the sign-in and sign-out report, and single sign-on sign-in attempts, including failed ones.
Oleria refreshes data on its regular sync schedule.
Oleria doesn’t import meetings, webinars, chat messages, recording files, or Zoom Docs, Zoom Rooms, Zoom Phone, or Zoom Contact Center data.

​
Prerequisites

  • A Zoom account on the Pro plan or higher. Groups, roles, reports, and cloud recordings aren’t available on the free Basic plan. Single sign-on activity requires a plan with single sign-on.
  • A Zoom admin whose role has the Server-to-Server OAuth app permission (User Management > Roles > Advanced features) and the privileges behind the scopes below. The account Owner has these by default.
  • Admin access to the Oleria workspace.
The Server-to-Server OAuth app acts with its owner’s Zoom permissions. If the owner loses admin privileges or leaves your account, Zoom removes the app’s admin scopes and syncs stop working. Use an owner who will keep admin access.

​
Create a Server-to-Server OAuth app in Zoom

1

Create the app

Sign in to the Zoom App Marketplace (or marketplace.zoomgov.com for Zoom for Government) as an admin. Select Develop > Build App, then choose Server-to-Server OAuth App. Name it, for example Oleria.
2

Copy the credentials

On the App Credentials page, copy the Account ID, Client ID, and Client Secret. You need all three to connect Zoom to Oleria. Fill in the app’s Information page.
3

Add the scopes

On the Scopes page, add the scopes for what you want Oleria to do:Add the scopes listed under Remediation actions only if you want Oleria to take those actions. Leave them out for a read-only connection.
4

Activate the app

Select Activate your app. If your Zoom account restricts apps with an IP allowlist, add Oleria’s egress IP addresses to it.
To get Oleria’s IP addresses for your allow list, contact support@oleria.com.
Oleria skips any data it doesn’t have a scope for and keeps syncing everything else. The exact location of these settings can change over time. If the steps above don’t match what you see, refer to Zoom’s own documentation.

​
Connect Zoom to Oleria

1

Open the integration

Go to your Oleria workspace, select Integrations -> select Zoom.
2

Complete the connection form

Select Continue and provide the following:
3

Confirm the connection

Select Authenticate. Oleria requests a token, checks that the app has the three required scopes, and lists one user before it saves anything. Find the newly connected account on the Connected tab of your Oleria Integrations page.

​
Verify the integration

Confirm the Zoom account appears on the Connected tab of your Oleria Integrations page with a status of Healthy. After the first sync completes, check that users, groups, channels, and roles appear in your Oleria workspace.
When you edit the integration, you can change the Client ID and Client Secret. Leave Client Secret blank to keep the stored secret. If you change the Client ID, enter that app’s Client Secret too. To connect a different Zoom account or environment, add a new integration.

​
Remediation actions

Oleria can take these actions in Zoom. Each action needs the listed scopes on the Server-to-Server OAuth app; if a scope is missing, that action isn’t available for the integration. Disable a non-human identity needs the scopes in both of its rows, even if you only plan to disable one kind of identity. If either set is missing, the action isn’t available for API users or Marketplace apps. Keep these limits in mind when you use these actions:
  • Oleria reads the current state before it changes anything. If the user, membership, role, or setting is already in the requested state, Oleria makes no change.
  • Oleria never changes the account Owner. It never deactivates or deletes an Admin, because Zoom doesn’t allow it. It never changes the owner of the Server-to-Server OAuth app. If Zoom doesn’t tell Oleria who owns the app, Oleria refuses to deactivate, delete, or change the role of any user with an administrator role, because the app owner is always one of them. These actions show as unavailable for those users.
  • Deactivate a user and Delete a user don’t apply to API users and show as unavailable for them. Use Disable a non-human identity instead.
  • Revoke sessions works only for users who sign in with single sign-on. It signs the user out of the Zoom apps, but not out of Zoom in a web browser.
  • Delete a user permanently removes the user and their data from your Zoom account. It can’t be reverted.
  • Revoke public link access narrows the link to people in your Zoom account, so people in your account who use the link keep access. Reverting it restores the previous setting.
  • Disable a non-human identity deactivates an API user, or declines a user-managed Marketplace app for everyone, which disables the app for its users. Zoom has no API to disable admin-managed or Server-to-Server apps; disable them in the Zoom App Marketplace.
  • Reverting an action undoes only the change that action made. Removing a collaborator, revoking sessions, deleting a user, declining an app, and removing external access can’t be reverted. Restore the access manually in Zoom instead.
  • Create a user adds the person with a Basic license, and Zoom emails them an invitation. They appear in Oleria after they accept it. Assign a license in Zoom if they need one.
  • Reverting Create a user removes the user only while their invitation is still pending. Once they accept it, the revert is refused, because the account may already hold their meetings and content. Use Delete a user if you need to remove them.
  • Reverting the removal of a Team Chat channel admin adds the person back as a member. Make them an admin again in Zoom. Oleria doesn’t remove a channel’s owner.
  • Remove an external user’s access can’t change channels owned by the external user’s own Zoom account. Oleria leaves the user in those channels and reports them as skipped.
  • Shared space membership can’t be changed from Oleria.

​
Troubleshooting

If the connection check fails, the message tells you which step failed: If a sync completes but some data is missing, check the scope for that data in Add the scopes: Oleria skips anything it doesn’t have a scope for, or that your Zoom plan doesn’t include.

​
Known limitations

  • No password change date. Zoom’s API doesn’t report when a user last changed their password.
  • Two-factor authentication is shown as a requirement, not an enrollment. Zoom’s API exposes your account’s 2FA policy but not whether each user has enrolled. 2FA applies to work email and password sign-ins; users who sign in only with single sign-on or another provider rely on that provider’s multi-factor authentication.
  • Last sign-in can be up to three days behind. Zoom updates a user’s last sign-in time with a delay. Recent sign-ins appear sooner in the activity data.
  • Single sign-on failures are kept for seven days. Zoom keeps single sign-on sign-in logs for seven days, and the sign-in and admin reports for six months. Oleria imports activity on every sync, so history older than these limits isn’t available on first connection.
  • Actors are matched by email. Zoom’s reports identify the person who acted by email address. Activity from a user who was deleted or whose email changed has no actor in Oleria.
  • No app owners or credentials. Zoom’s API doesn’t report who owns or installed a Marketplace app, or list client secrets or other credentials.
  • No AI agents. Zoom doesn’t provide an API that lists AI Companion or Virtual Agent agents.
  • No whiteboard projects on Zoom for Government. Zoom for Government doesn’t support whiteboard projects, so Gov connections show whiteboards without their projects.
  • Discovery windows. Oleria discovers whiteboards and clips created in the last 36 months, and cloud recordings created in the last 30 days.
  • Pending users aren’t shown. Users who haven’t accepted their Zoom invitation have no user ID yet, so Oleria doesn’t import them until they do.
  • Classic scopes cover most of the sync. An older app that uses classic scopes, such as user:read:admin, works for users, groups, roles, account settings, reports, Team Chat, whiteboards, and cloud recordings. Single sign-on, clips, Marketplace apps, and external connections need the granular scopes listed above; without them, Oleria skips that data or action.
  • Shared rate limits. Zoom’s API rate limits are shared by every app in your Zoom account. Oleria paces its requests to leave room for your other apps, so large accounts can take longer to sync.

​
Contact us

For questions about this integration, contact us at support@oleria.com.