> ## Documentation Index > Fetch the complete documentation index at: https://docs.lumos.com/llms.txt > Use this file to discover all available pages before exploring further. # Zoom *Zoom has two connection versions. Check the Domain ID under your domain. If it shows* `zoom_ics`*, you are on the current connector created after July 2025 - use the main instructions below. If it shows* `zoom.com`*, you are on the legacy connection created before July 2025, so use the "Legacy connections" phase at the end.* ## After this article You'll be able to connect the Zoom integration to Lumos and resolve the common issues that come up during setup. ## Capabilities | Functionality | Type | Sync | Provision | Description | | :- | :- | :- | :- | :- | | Users | Account | Yes | Yes | User account records. Lumos creates users as the Basic (unlicensed) type from their email, first name, and last name (see below) | | Groups | Permission | Yes | Yes | Access control groups. Lumos can add and remove members | | Contact Groups | Permission | Yes | Yes | Contact groups (requires Zoom Phone Contact Center). Lumos can add and remove members | | Roles | Permission | Yes | Yes | Zoom role definitions (Workspace Owner, Admin, or Member). Lumos can assign and remove them | | Licenses | Permission | Yes | Yes | License features toggled on the user's settings | | Plans | Permission | Yes | Yes | Zoom Workplace (Zoom One) and Zoom United plan assignment on the user | Last Activity: a user's last login timestamp and the last meeting a user hosted that ran 40 or more minutes with 2 or more unique participants. **Provisioning behavior:** * **Create:** Lumos calls `POST /users` with `action=create`, which makes Zoom email the person a confirmation link. The account is created as a Basic (unlicensed) user with a display name built from the first and last name, and it stays Pending until the person confirms. Zoom doesn't return IDs for pending users, so the account appears in Lumos after the person activates it and the next sync runs. * **Assign a role, group, or contact group:** Lumos adds the user through the matching members endpoint. Zoom reports success even when the target user doesn't exist, so Lumos double-checks that the account exists whenever Zoom returns an empty result. * **Licenses:** Lumos toggles the license feature on or off through `PATCH /users/{userId}/settings`. Zoom doesn't return an error for a license that doesn't apply, so verify the change in Zoom if a task looks off. * **Plans:** Lumos sets `zoom_one_type` (Zoom Workplace) or `plan_united_type` (Zoom United) through `PATCH /users/{userId}`. Unassigning sets the plan back to none. None of the deprovisioning or provisioning actions below work with a read-only Zoom connection. | Deprovisioning action | Type | Description | | :- | :- | :- | | Downgrade License | User | Immediately changes the user's type to Basic via `PATCH /users/{userId}` and reclaims a license. If the user is already Basic, there's nothing to downgrade and Lumos reports no change. | | Deactivate (Suspend) | User | Deactivates the user in Zoom, removes all associated licenses, prevents login, and reclaims a license. | | Delete (Deprovision) | User | Disassociates the user from your Zoom account and reclaims a license. The person loses access to your organization, but Zoom keeps their personal settings and they can continue on an individual account. Zoom Events hub assets transfer to the Admin Email you set when connecting. Recordings, meetings, and upcoming events can only be transferred during Offboarding or Inactivity Workflows, so transfer important data before deleting. | ## Required plan and roles You need at least the Zoom **Pro** plan to connect this integration. The Zoom user who connects must be the **Workspace Owner**. Read-only access lets the application run without elevated permissions. Lumos won't provision in that mode, and the connection operates as read-only. ## Read-only access vs provisioning **Is read-only possible?** Yes. Zoom supports a dedicated read-only connection that uses a narrower set of OAuth scopes than a full provisioning connection. **What read-only requires.** A Server-to-Server OAuth app (or, for legacy connections, a custom Admin-managed OAuth app) granted only the `report:read:admin`, `report:read:user:admin`, `user:read:settings:admin`, `user:read:user:admin`, and `user:read:list_users:admin` scopes. Follow the read-only scope selection in Phase 2 below, or the read-only path in Phase 4 for legacy connections. **What full provisioning requires.** The same OAuth app type, but with all **Contact Group**, **User**, **Groups**, **Reports**, and **Role** permissions granted instead of the narrower read-only set. **Watch out for.** None of the deprovisioning actions (Downgrade License, Deactivate, Delete) or the provisioning actions work with a read-only connection, so if you want offboarding automation you need the full-scope connection instead. The legacy read-only connection also uses a different OAuth callback URL (`zoom_readonly_oauth2_callback`) than the default legacy connection, so switching modes on a legacy connector means registering a new OAuth app rather than changing scopes on the existing one. ## Instructions The current connector uses Server-to-Server OAuth. You'll create an OAuth application in Zoom, grant scopes, then paste the credentials into Lumos. **Phase 1: Create the Server-to-Server OAuth app in Zoom** 1. Sign into Zoom with a user that has **Workspace Owner** privileges. 2. Create an OAuth client app. Select **Server-to-Server OAuth** in the **Application Type** dropdown, then enter a name for your reference. 3. On the next page you'll see the **Client ID**, **Client Secret**, and **Account ID**. Copy all three for use in the Lumos integration form. **Phase 2: Grant scopes and activate** 1. Open the **Scopes** section on the left, click **Add Scopes**, and select the permissions you need. * For full provisioning, select all **Contact Group**, **User**, **Groups**, **Reports**, and **Role** permissions. * For read-only access, add `report:read:admin`, `report:read:user:admin`, `user:read:settings:admin`, `user:read:user:admin`, and `user:read:list_users:admin`. 2. Set both the **Redirect URL for OAuth** and the **OAuth allow list** to `https://app.lumosidentity.com/integrations/ics_oauth2_callback`. 3. Activate the OAuth 2.0 application in the last step. **Phase 3: Connect in Lumos** 1. Find the Zoom card in your Lumos integrations (reconnect an existing card or add a new one). 2. Paste the **Client ID** and **Client Secret** from Zoom into the matching fields in Lumos. 3. Fill in the remaining connection fields: * **Account ID**: the Account ID of the Zoom account you're connecting. It's on the OAuth Application page shown when you created the app. * **Admin Email**: the email of your account admin, owner, or manager. Zoom uses this to transfer a deleted user's hub assets on the Zoom Events site to the target user, which is a required Zoom feature when you delete or disassociate a user. * **Zoom for government**: check this option if your Zoom account is hosted on the Zoom for Government Cloud. 4. Click **Connect Zoom**. 5. Click **Allow Access** in Zoom to finish. Only the permissions granted to the OAuth application are requested as scopes. 6. Optional: if your company requires Zoom apps to be approved, follow Zoom's instructions for approving Unlisted Apps to complete the connection. **Phase 4: Legacy connections (created before July 2025)** If your Domain ID shows `zoom.com`, you're on the legacy connector, which supports two setup paths. For the default OAuth connection, find the Zoom card in Lumos, click **Connect Zoom**, then click **Allow Access** in Zoom. If your company requires app approval, follow Zoom's Unlisted Apps process. For a read-only connection, sign into Zoom as the Workspace Owner and build a custom OAuth Admin-managed app (don't publish it to the Zoom App Marketplace). Set both the **Redirect URL for OAuth** and the **OAuth allow list** to `https://app.lumosidentity.com/integrations/zoom_readonly_oauth2_callback`. Add the scopes `user:read:list_users:admin`, `user:read:user:admin`, `user:read:settings:admin`, and `report:read:user:admin`. Copy the **Client ID** and **Client Secret** from the **App Credentials** tab into Lumos, then click **Connect Zoom**. ## API Endpoints Used The API endpoints this integration uses are available to logged-in Lumos customers. [Log in](/login) to view them. ## Troubleshooting **Zoom shows "You cannot authorize Lumos".** The account you're connecting with isn't a Workspace Owner, or your company requires Zoom to be approved as an app. Reconnect with the Workspace Owner account. If Zoom apps must be pre-approved, follow the Unlisted Apps step in the instructions. **"Insufficient Permissions" error.** Verify your Zoom account role is Owner or Admin, and that all required OAuth scopes are enabled. Check that the app has account-level permissions rather than user-level. If the app is still in draft, activate it in the Zoom Marketplace. Contact Zoom support if account restrictions apply. **Users aren't syncing correctly.** Confirm the user read scopes are enabled, that users are active or pending (not deleted), and that users have email addresses. Review the sync logs for specific errors and check for SSO configuration conflicts. **A Zoom user has no Last Login or Last Activity value.** A blank Last Login means the user has never logged into Zoom. Zoom applies a three-day buffer to this field, so it can lag the true most-recent login. A blank Last Activity means the user hasn't hosted a meeting over 40 minutes with 2 or more participants in the 6 months before you connected Zoom to Lumos. Zoom returns this data only for the last 6 months, but Lumos caches older values when no newer one is available. **Group memberships look wrong.** Confirm the group read scope is enabled. Tenants without Zoom Phone Contact Center can't grant contact-group scopes, so Lumos skips the contact-group sync for those accounts instead of failing. **A previously working connection starts failing on a specific scope (for example** `role:read:list_roles`**).** Zoom scope names and requirements can change on the Marketplace side. When a sync or reconnect errors on a named scope, add that scope to the Lumos app in the Zoom Marketplace and reconnect. The connection isn't broken, it's missing a newly required scope.