> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oleria.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Zoom

> Connect Zoom to Oleria to bring users, groups, Team Chat channels, roles, apps, shared whiteboards, clips and recordings, and sign-in and admin activity from your Zoom account into your identity and access graph.

Connect Zoom to Oleria to see who has access to your Zoom account and what they can reach: users and how they sign in, groups, Team Chat channels and shared spaces, roles, Marketplace apps and API users, and the whiteboards, clips and cloud recordings people share — including with external users and anyone who has the link. Oleria reads this data through a Server-to-Server OAuth app that you create in your own Zoom account, and you can take remediation actions directly from Oleria.

## What Oleria discovers

Once connected, Oleria continuously discovers and maps the following from your Zoom account:

* **Accounts** - every active and deactivated user, with their name, email address, department, role, license type, when they were created, and when they last signed in. Oleria shows each user's sign-in methods (Zoom work email and password, single sign-on, or sign-in with Google, Microsoft, Apple, or another provider), whether two-factor authentication is required for them under your account's 2FA policy, and whether single sign-on is required for them.
* **Non-human identities** - API users, shown with the **API-only user** type, and the Marketplace apps added to or created in your account, shown with the **Application** type and the OAuth scopes each app requests. Apps your account restricts are shown as disabled.
* **External users and public links** - users from other Zoom accounts who are members of your Team Chat channels or collaborators on your whiteboards and clips, and a single **Anyone with the link** principal for content that anyone with the link can open. An external person who has access to several whiteboards and clips appears once, matched by email address.
* **User groups** - your Zoom groups, Team Chat channels, and Team Chat shared spaces, with their members. Each channel and space membership shows the member's role (owner, admin, or member), and Oleria shows which Zoom groups were added to a channel. Channels that are open to other Zoom accounts, or private channels with external members, are labeled as external channels.
* **Roles** - your account roles (Owner, Admin, Member, and custom roles) and the privileges each one grants, and which role each user holds. Oleria also shows which roles can view or manage every cloud recording or whiteboard in your account.
* **Ownership and delegation** - group administrators, channel and space owners, and the owners of whiteboards, clips, and recordings. Oleria also shows scheduling assistants, who can schedule meetings and act on behalf of the user they assist.
* **Resources** - whiteboard projects, whiteboards, clips, and cloud recordings, and who can access each one with which role (owner, co-owner, editor, commenter, viewer, or host). Whiteboards are shown inside their projects, and subprojects inside their parent projects.
* **Activity** - Zoom admin operation logs, the sign-in and sign-out report, and single sign-on sign-in attempts, including failed ones.

Oleria refreshes data on its [regular sync schedule](/integrations/overview.md#sync-model).

> [!NOTE]
>
> Oleria doesn't import meetings, webinars, chat messages, recording files, or Zoom Docs, Zoom Rooms, Zoom Phone, or Zoom Contact Center data.

## Prerequisites

* A Zoom account on the Pro plan or higher. Groups, roles, reports, and cloud recordings aren't available on the free Basic plan. Single sign-on activity requires a plan with single sign-on.
* A Zoom admin whose role has the **Server-to-Server OAuth app** permission (**User Management** > **Roles** > **Advanced features**) and the privileges behind the scopes below. The account Owner has these by default.
* Admin access to the Oleria workspace.

> [!WARNING]
>
> The Server-to-Server OAuth app acts with its owner's Zoom permissions. If the owner loses admin privileges or leaves your account, Zoom removes the app's admin scopes and syncs stop working. Use an owner who will keep admin access.

## Create a Server-to-Server OAuth app in Zoom

**1. Create the app**

Sign in to the [Zoom App Marketplace](https://marketplace.zoom.us) (or [marketplace.zoomgov.com](https://marketplace.zoomgov.com) for Zoom for Government) as an admin. Select **Develop** > **Build App**, then choose **Server-to-Server OAuth App**. Name it, for example `Oleria`.

**2. Copy the credentials**

On the **App Credentials** page, copy the **Account ID**, **Client ID**, and **Client Secret**. You need all three to connect Zoom to Oleria. Fill in the app's **Information** page.

**3. Add the scopes**

On the **Scopes** page, add the scopes for what you want Oleria to do:

| Scope | Needed for |
| :- | :- |
| `user:read:list_users:admin` | Required. Syncing users. |
| `group:read:list_groups:admin` | Required. Syncing groups. |
| `role:read:list_roles:admin` | Required. Syncing roles. |
| `user:read:list_assistants:admin` | Scheduling assistants. |
| `account:read:settings:admin`, `sso:read:status:admin` | Two-factor authentication and single sign-on requirements. |
| `group:read:administrator:admin` | Group administrators. |
| `role:read:role:admin` | Role privileges and administrator detection. |
| `marketplace:read:list_apps:admin` | Marketplace apps. |
| `team_chat:read:list_user_channels:admin`, `team_chat:read:list_members:admin`, `team_chat:read:list_groups:admin`, `team_chat:read:list_shared_spaces:admin`, `team_chat:read:list_shared_space_members:admin` | Team Chat channels and shared spaces, and their members. |
| `whiteboard:read:list_projects:admin`, `whiteboard:read:list_whiteboards:admin`, `whiteboard:read:list_collaborators:admin`, `whiteboard:read:project_collaborator:admin`, `whiteboard:read:subproject:admin` | Whiteboards, projects and subprojects, and their collaborators. Without `whiteboard:read:project_collaborator:admin`, Oleria shows only each project's owners. |
| `team_chat:read:channel:admin` | Whiteboards and clips shared with a Team Chat channel. This also needs `team_chat:read:list_members:admin`. Without them, channel access to whiteboards and clips isn't shown. |
| `clips:read:list_user_clips:admin`, `clips:read:list_collaborator:admin` | Clips and their collaborators. |
| `cloud_recording:read:list_user_recordings:admin`, `cloud_recording:read:recording_settings:admin` | Cloud recordings and their sharing settings. |
| `report:read:operation_logs:admin`, `report:read:user_activities:admin`, `sso:read:list_login_logs:admin` | Activity. |

Add the scopes listed under [Remediation actions](#remediation-actions) only if you want Oleria to take those actions. Leave them out for a read-only connection.

**4. Activate the app**

Select **Activate your app**. If your Zoom account restricts apps with an IP allowlist, add Oleria's egress IP addresses to it.

> [!NOTE]
>
> To get Oleria's IP addresses for your allow list, contact [support@oleria.com](mailto:support@oleria.com).

> [!NOTE]
>
> Oleria skips any data it doesn't have a scope for and keeps syncing everything else. The exact location of these settings can change over time. If the steps above don't match what you see, refer to Zoom's own documentation.

## Connect Zoom to Oleria

**1. Open the integration**

Go to your Oleria workspace, select **Integrations** -> select **Zoom**.

**2. Complete the connection form**

Select **Continue** and provide the following:

| Field | Notes |
| :- | :- |
| Environment | Required. **Commercial** for accounts on zoom.us, or **Zoom for Government** for accounts on zoomgov.com. You can't change this after you connect. |
| Account ID | Required. The Account ID from the app's **App Credentials** page. You can't change this after you connect. |
| Client ID | Required. The Client ID from the same page. |
| Client Secret | Required. The Client Secret from the same page. Oleria stores it encrypted after it validates the credentials. |

**3. Confirm the connection**

Select **Authenticate**. Oleria requests a token, checks that the app has the three required scopes, and lists one user before it saves anything. Find the newly connected account on the **Connected** tab of your Oleria **Integrations** page.

## Verify the integration

Confirm the Zoom account appears on the **Connected** tab of your Oleria **Integrations** page with a status of **Healthy**. After the first sync completes, check that users, groups, channels, and roles appear in your Oleria workspace.

> [!NOTE]
>
> When you edit the integration, you can change the Client ID and Client Secret. Leave **Client Secret** blank to keep the stored secret. If you change the Client ID, enter that app's Client Secret too. To connect a different Zoom account or environment, add a new integration.

## Remediation actions

Oleria can take these actions in Zoom. Each action needs the listed scopes on the Server-to-Server OAuth app; if a scope is missing, that action isn't available for the integration.

| Action | Scopes |
| :- | :- |
| **Deactivate a user** and **reactivate a user** | `user:read:user:admin`, `role:read:role:admin`, `user:update:status:admin` |
| **Add a user to a group** and **remove a user from a group** — Zoom groups and Team Chat channels | `user:read:user:admin`, `group:write:member:admin`, `group:delete:member:admin`, `team_chat:read:list_members:admin`, `team_chat:write:members:admin`, `team_chat:delete:member:admin` |
| **Assign a role** and **remove a role** | `user:read:user:admin`, `role:read:role:admin`, `role:write:member:admin`, `role:delete:member:admin` |
| **Revoke sessions** | `user:read:user:admin`, `user:delete:token:admin` |
| **Delete a user** | `user:read:user:admin`, `role:read:role:admin`, `user:delete:user:admin` |
| **Create a user** | `user:read:user:admin`, `user:write:user:admin`, `user:delete:user:admin` |
| **Create a group** | `group:read:list_groups:admin`, `group:write:group:admin`, `group:delete:group:admin` |
| **Disable a non-human identity** — API users | `user:read:user:admin`, `role:read:role:admin`, `user:update:status:admin` |
| **Disable a non-human identity** — user-managed Marketplace apps | `marketplace:read:list_apps:admin`, `marketplace:update:app_request:admin` |
| **Revoke a user's access to a resource** — whiteboards and clips | `whiteboard:read:list_collaborators:admin`, `whiteboard:delete:collaborator:admin`, `clips:read:list_collaborator:admin`, `clips:delete:collaborators:admin`, `clips:read:clip:admin` |
| **Revoke external access to a resource** — whiteboards and clips | `whiteboard:read:list_collaborators:admin`, `whiteboard:delete:collaborator:admin`, `clips:read:list_collaborator:admin`, `clips:delete:collaborators:admin` |
| **Revoke public link access** — whiteboards, clips, and cloud recordings | `whiteboard:read:whiteboard:admin`, `whiteboard:update:share_setting:admin`, `clips:read:clip:admin`, `clips:update:share_setting:admin`, `cloud_recording:read:recording_settings:admin`, `cloud_recording:update:recording_settings:admin` |
| **Remove an external user's access** — removes an external user from every Team Chat channel your account owns | `zoom_chat:read:list_external_connections:admin`, `team_chat:delete:member:admin` |

**Disable a non-human identity** needs the scopes in both of its rows, even if you only plan to disable one kind of identity. If either set is missing, the action isn't available for API users or Marketplace apps.

Keep these limits in mind when you use these actions:

* Oleria reads the current state before it changes anything. If the user, membership, role, or setting is already in the requested state, Oleria makes no change.
* Oleria never changes the account Owner. It never deactivates or deletes an Admin, because Zoom doesn't allow it. It never changes the owner of the Server-to-Server OAuth app. If Zoom doesn't tell Oleria who owns the app, Oleria refuses to deactivate, delete, or change the role of any user with an administrator role, because the app owner is always one of them. These actions show as unavailable for those users.
* **Deactivate a user** and **Delete a user** don't apply to API users and show as unavailable for them. Use **Disable a non-human identity** instead.
* **Revoke sessions** works only for users who sign in with single sign-on. It signs the user out of the Zoom apps, but not out of Zoom in a web browser.
* **Delete a user** permanently removes the user and their data from your Zoom account. It can't be reverted.
* **Revoke public link access** narrows the link to people in your Zoom account, so people in your account who use the link keep access. Reverting it restores the previous setting.
* **Disable a non-human identity** deactivates an API user, or declines a user-managed Marketplace app for everyone, which disables the app for its users. Zoom has no API to disable admin-managed or Server-to-Server apps; disable them in the Zoom App Marketplace.
* Reverting an action undoes only the change that action made. Removing a collaborator, revoking sessions, deleting a user, declining an app, and removing external access can't be reverted. Restore the access manually in Zoom instead.
* **Create a user** adds the person with a Basic license, and Zoom emails them an invitation. They appear in Oleria after they accept it. Assign a license in Zoom if they need one.
* Reverting **Create a user** removes the user only while their invitation is still pending. Once they accept it, the revert is refused, because the account may already hold their meetings and content. Use **Delete a user** if you need to remove them.
* Reverting the removal of a Team Chat channel admin adds the person back as a member. Make them an admin again in Zoom. Oleria doesn't remove a channel's owner.
* **Remove an external user's access** can't change channels owned by the external user's own Zoom account. Oleria leaves the user in those channels and reports them as skipped.
* Shared space membership can't be changed from Oleria.

## Troubleshooting

If the connection check fails, the message tells you which step failed:

| Message | Cause | Fix |
| :- | :- | :- |
| Token request rejected (`invalid_client`) | The Client ID or Client Secret is wrong, or the secret was regenerated. | Copy both again from the app's **App Credentials** page. If you edit an existing connection and change the Client ID, enter the new Client Secret too. |
| Token request rejected (`invalid_request`) | The Account ID is wrong, the app isn't activated, or the **Environment** doesn't match your account (zoom.us or zoomgov.com). | Check the Account ID and Environment, and select **Activate your app** in the Zoom App Marketplace. |
| The app is missing required scopes | One of `user:read:list_users:admin`, `group:read:list_groups:admin`, or `role:read:list_roles:admin` isn't on the app, or the app's owner lost the admin privileges behind them. | Add the listed scopes to the app. If the owner's role changed, give the role those privileges back, or have an admin who keeps them own the app. |
| Listing users failed | Zoom rejected the test call even though the token and scopes are valid. A common cause is an app IP allowlist that doesn't include Oleria's IP addresses. | Add Oleria's IP addresses to the allowlist. To get them, contact [support@oleria.com](mailto:support@oleria.com). |

If a sync completes but some data is missing, check the scope for that data in [Add the scopes](#create-a-server-to-server-oauth-app-in-zoom): Oleria skips anything it doesn't have a scope for, or that your Zoom plan doesn't include.

## Known limitations

* **No password change date.** Zoom's API doesn't report when a user last changed their password.
* **Two-factor authentication is shown as a requirement, not an enrollment.** Zoom's API exposes your account's 2FA policy but not whether each user has enrolled. 2FA applies to work email and password sign-ins; users who sign in only with single sign-on or another provider rely on that provider's multi-factor authentication.
* **Last sign-in can be up to three days behind.** Zoom updates a user's last sign-in time with a delay. Recent sign-ins appear sooner in the activity data.
* **Single sign-on failures are kept for seven days.** Zoom keeps single sign-on sign-in logs for seven days, and the sign-in and admin reports for six months. Oleria imports activity on every sync, so history older than these limits isn't available on first connection.
* **Actors are matched by email.** Zoom's reports identify the person who acted by email address. Activity from a user who was deleted or whose email changed has no actor in Oleria.
* **No app owners or credentials.** Zoom's API doesn't report who owns or installed a Marketplace app, or list client secrets or other credentials.
* **No AI agents.** Zoom doesn't provide an API that lists AI Companion or Virtual Agent agents.
* **No whiteboard projects on Zoom for Government.** Zoom for Government doesn't support whiteboard projects, so Gov connections show whiteboards without their projects.
* **Discovery windows.** Oleria discovers whiteboards and clips created in the last 36 months, and cloud recordings created in the last 30 days.
* **Pending users aren't shown.** Users who haven't accepted their Zoom invitation have no user ID yet, so Oleria doesn't import them until they do.
* **Classic scopes cover most of the sync.** An older app that uses classic scopes, such as `user:read:admin`, works for users, groups, roles, account settings, reports, Team Chat, whiteboards, and cloud recordings. Single sign-on, clips, Marketplace apps, and external connections need the granular scopes listed above; without them, Oleria skips that data or action.
* **Shared rate limits.** Zoom's API rate limits are shared by every app in your Zoom account. Oleria paces its requests to leave room for your other apps, so large accounts can take longer to sync.

## Contact us

For questions about this integration, contact us at [support@oleria.com](mailto:support@oleria.com).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.