Skip to main content
Zoom has two connection versions. Check the Domain ID under your domain. If it shows zoom_ics, you are on the current connector created after July 2025 - use the main instructions below. If it shows zoom.com, you are on the legacy connection created before July 2025, so use the “Legacy connections” phase at the end.

​
After this article

You’ll be able to connect the Zoom integration to Lumos and resolve the common issues that come up during setup.

​
Capabilities

Last Activity: a user’s last login timestamp and the last meeting a user hosted that ran 40 or more minutes with 2 or more unique participants. Provisioning behavior:
  • Create: Lumos calls POST /users with action=create, which makes Zoom email the person a confirmation link. The account is created as a Basic (unlicensed) user with a display name built from the first and last name, and it stays Pending until the person confirms. Zoom doesn’t return IDs for pending users, so the account appears in Lumos after the person activates it and the next sync runs.
  • Assign a role, group, or contact group: Lumos adds the user through the matching members endpoint. Zoom reports success even when the target user doesn’t exist, so Lumos double-checks that the account exists whenever Zoom returns an empty result.
  • Licenses: Lumos toggles the license feature on or off through PATCH /users/{userId}/settings. Zoom doesn’t return an error for a license that doesn’t apply, so verify the change in Zoom if a task looks off.
  • Plans: Lumos sets zoom_one_type (Zoom Workplace) or plan_united_type (Zoom United) through PATCH /users/{userId}. Unassigning sets the plan back to none.
None of the deprovisioning or provisioning actions below work with a read-only Zoom connection.

​
Required plan and roles

You need at least the Zoom Pro plan to connect this integration. The Zoom user who connects must be the Workspace Owner. Read-only access lets the application run without elevated permissions. Lumos won’t provision in that mode, and the connection operates as read-only.

​
Read-only access vs provisioning

Is read-only possible? Yes. Zoom supports a dedicated read-only connection that uses a narrower set of OAuth scopes than a full provisioning connection. What read-only requires. A Server-to-Server OAuth app (or, for legacy connections, a custom Admin-managed OAuth app) granted only the report:read:admin, report:read:user:admin, user:read:settings:admin, user:read:user:admin, and user:read:list_users:admin scopes. Follow the read-only scope selection in Phase 2 below, or the read-only path in Phase 4 for legacy connections. What full provisioning requires. The same OAuth app type, but with all Contact Group, User, Groups, Reports, and Role permissions granted instead of the narrower read-only set. Watch out for. None of the deprovisioning actions (Downgrade License, Deactivate, Delete) or the provisioning actions work with a read-only connection, so if you want offboarding automation you need the full-scope connection instead. The legacy read-only connection also uses a different OAuth callback URL (zoom_readonly_oauth2_callback) than the default legacy connection, so switching modes on a legacy connector means registering a new OAuth app rather than changing scopes on the existing one.

​
Instructions

The current connector uses Server-to-Server OAuth. You’ll create an OAuth application in Zoom, grant scopes, then paste the credentials into Lumos. Phase 1: Create the Server-to-Server OAuth app in Zoom
  1. Sign into Zoom with a user that has Workspace Owner privileges.
  2. Create an OAuth client app. Select Server-to-Server OAuth in the Application Type dropdown, then enter a name for your reference.
  3. On the next page you’ll see the Client ID, Client Secret, and Account ID. Copy all three for use in the Lumos integration form.
Phase 2: Grant scopes and activate
  1. Open the Scopes section on the left, click Add Scopes, and select the permissions you need.
    • For full provisioning, select all Contact Group, User, Groups, Reports, and Role permissions.
    • For read-only access, add report:read:admin, report:read:user:admin, user:read:settings:admin, user:read:user:admin, and user:read:list_users:admin.
  2. Set both the Redirect URL for OAuth and the OAuth allow list to https://app.lumosidentity.com/integrations/ics_oauth2_callback.
  3. Activate the OAuth 2.0 application in the last step.
Phase 3: Connect in Lumos
  1. Find the Zoom card in your Lumos integrations (reconnect an existing card or add a new one).
  2. Paste the Client ID and Client Secret from Zoom into the matching fields in Lumos.
  3. Fill in the remaining connection fields:
    • Account ID: the Account ID of the Zoom account you’re connecting. It’s on the OAuth Application page shown when you created the app.
    • Admin Email: the email of your account admin, owner, or manager. Zoom uses this to transfer a deleted user’s hub assets on the Zoom Events site to the target user, which is a required Zoom feature when you delete or disassociate a user.
    • Zoom for government: check this option if your Zoom account is hosted on the Zoom for Government Cloud.
  4. Click Connect Zoom.
  5. Click Allow Access in Zoom to finish. Only the permissions granted to the OAuth application are requested as scopes.
  6. Optional: if your company requires Zoom apps to be approved, follow Zoom’s instructions for approving Unlisted Apps to complete the connection.
Phase 4: Legacy connections (created before July 2025) If your Domain ID shows zoom.com, you’re on the legacy connector, which supports two setup paths. For the default OAuth connection, find the Zoom card in Lumos, click Connect Zoom, then click Allow Access in Zoom. If your company requires app approval, follow Zoom’s Unlisted Apps process. For a read-only connection, sign into Zoom as the Workspace Owner and build a custom OAuth Admin-managed app (don’t publish it to the Zoom App Marketplace). Set both the Redirect URL for OAuth and the OAuth allow list to https://app.lumosidentity.com/integrations/zoom_readonly_oauth2_callback. Add the scopes user:read:list_users:admin, user:read:user:admin, user:read:settings:admin, and report:read:user:admin. Copy the Client ID and Client Secret from the App Credentials tab into Lumos, then click Connect Zoom.

​
API Endpoints Used

​
Troubleshooting

Zoom shows “You cannot authorize Lumos”. The account you’re connecting with isn’t a Workspace Owner, or your company requires Zoom to be approved as an app. Reconnect with the Workspace Owner account. If Zoom apps must be pre-approved, follow the Unlisted Apps step in the instructions. “Insufficient Permissions” error. Verify your Zoom account role is Owner or Admin, and that all required OAuth scopes are enabled. Check that the app has account-level permissions rather than user-level. If the app is still in draft, activate it in the Zoom Marketplace. Contact Zoom support if account restrictions apply. Users aren’t syncing correctly. Confirm the user read scopes are enabled, that users are active or pending (not deleted), and that users have email addresses. Review the sync logs for specific errors and check for SSO configuration conflicts. A Zoom user has no Last Login or Last Activity value. A blank Last Login means the user has never logged into Zoom. Zoom applies a three-day buffer to this field, so it can lag the true most-recent login. A blank Last Activity means the user hasn’t hosted a meeting over 40 minutes with 2 or more participants in the 6 months before you connected Zoom to Lumos. Zoom returns this data only for the last 6 months, but Lumos caches older values when no newer one is available. Group memberships look wrong. Confirm the group read scope is enabled. Tenants without Zoom Phone Contact Center can’t grant contact-group scopes, so Lumos skips the contact-group sync for those accounts instead of failing. A previously working connection starts failing on a specific scope (for example role:read:list_roles). Zoom scope names and requirements can change on the Marketplace side. When a sync or reconnect errors on a named scope, add that scope to the Lumos app in the Zoom Marketplace and reconnect. The connection isn’t broken, it’s missing a newly required scope.