Accounts in applications
Entra ID to Zoom integration: Zoom users, licences and groups from Microsoft Entra ID
With an integration between Microsoft Entra ID and Zoom Workplace, every colleague assigned to Zoom automatically gets a Zoom user with the right account type, and it is deactivated as soon as the assignment or the account lapses. KoppelHet also sets Zoom groups, manager and cost centre, an updated display name and a recipient for leavers' recordings.
What the integration does
Organisations that create Zoom users from Entra ID often keep Zoom groups up by hand. Settings per group, such as cloud recording, then lag behind, a married colleague keeps her old name in meetings, and a leaver's recordings get lost.
- IT assigns users and groups in Entra ID to Zoom; Entra ID creates the users.
- KoppelHet turns the Entra groups you designate into Zoom groups, with the same membership.
- KoppelHet adds department, cost centre, employee number and manager, and sets the display name again after every name change.
- Before deactivation KoppelHet sets the manager as recipient of the recordings and meetings.
- Entra ID then deactivates the Zoom user.
What to watch for with Microsoft Entra ID and Zoom Workplace
- Zoom uses groups precisely for settings such as recording and webinars. KoppelHet turns the designated Entra groups into Zoom groups through Zoom's SCIM2 API and keeps the members in line.
- Zoom does not update the display name when only the first or last name changes. A new surname in Entra ID therefore does not reach meetings. KoppelHet sends displayName with every name change.
- Zoom expects the manager as an email address, while Entra ID stores the manager as a reference to another user. KoppelHet looks up the manager's email address through Microsoft Graph and puts it in Zoom, also as recipient of recordings and meetings on leaving.
- According to Zoom, the Collaboration account type does not work with Entra ID because of a limitation on Microsoft's side. Organisations that use that type let KoppelHet set the account type.
- Zoom no longer supports Bearer authentication. KoppelHet uses its own server-to-server app with the scope scim2:admin, which is not tied to a person, so a Zoom admin leaving does not stop the integration.
- Provisioning from Entra ID has a maximum of 9,999 Basic users in Zoom. Anyone who assigns everyone in Entra ID to Zoom by default can hit that in a larger organisation. KoppelHet limits the assignment to the groups that really need Zoom and reports when the number gets close.
How we build and run it
- The integration runs on the KoppelHet platform, hosted in a data centre in the EU.
- Every sync and every error is visible in the functional log; on an error your administrator is notified.
- A change that cannot go through is not half-applied but queued for another attempt.
- KoppelHet is ISO 27001 certified. Data travels encrypted and stays on the platform no longer than needed.
- After go-live we manage the integration and adjust it when your process changes.
- The integration fits next to your existing integration layer. Only the fields in the design are transferred; the platform keeps no register of its own.
Implementation and price
This is not an app you switch on. We build the integration for your organisation on our platform, with building blocks we reuse on every project. So it is custom work that does not start from scratch.
A consultant prepares the intake and analyses both systems. We then record the mapping and exceptions field by field, test in the test or acceptance environment and go live at a moment you choose. Costs are a one-off amount for the setup and a monthly amount for platform, monitoring and support.
Frequently asked questions
Which Zoom plan is needed?
For the SCIM2 API KoppelHet uses, a Business or Education account with an approved vanity URL and single sign-on.
Do leavers get a notice from Zoom?
The integration sends nothing itself. What Zoom shows on deactivation depends on your account settings.
Are Zoom Phone numbers included too?
Not in the first version. Assigning numbers or writing them back to Entra ID can be added later as an extension.
Technical details for IT
For those who want to know how it works under the hood: APIs, fields and sources used.
- Entra ID writes through provisioning to https://api.zoom.us/scim with OAuth2 Authorization Code Grant; default attributes userName (required and filterable), active, name.givenName, name.familyName, emails work, enterprise department and userType.
- KoppelHet reads Entra ID through Microsoft Graph (delta on users and groups, manager with $expand) with read-only rights, and writes to the Zoom SCIM2 API (https://api.zoom.us/scim2, scope scim2:admin): PUT /Users/{userId} with displayName, the enterprise extension (department, costCenter, employeeNumber, manager) and transferee; POST and PATCH /Groups for groups and members. The account's default group cannot be deleted; HTTP 429 on too many calls.
Which fields are transferred
The key fields. The full mapping is agreed per customer.
| Field in Microsoft Entra ID | Field in Zoom Workplace | Notes |
|---|---|---|
userPrincipalName | userName | |
mail | emails[type eq "work"] | |
givenName en surname | name.givenName en name.familyName | |
displayName | displayName | By KoppelHet, also after name changes |
Groep of attribuut voor de licentie | userType (Basic of Licensed) | |
department | enterprise.department | |
employeeOrgData.costCenter | enterprise.costCenter | |
employeeId | enterprise.employeeNumber | |
manager (mail) | enterprise.manager en transferee | Zoom wants the manager's email address |
Toegewezen Entra-groepen | Groups (displayName, members) | |
accountEnabled en toewijzing | active |
Related
ADP GlobalView → Microsoft Entra ID
ADP GlobalView to Entra ID integration: accounts per country from international payroll
ADP iHCM → Microsoft Entra ID
ADP iHCM to Entra ID integration: accounts from ADP payroll, with the right licence in every European country
ADP Workforce Now → Microsoft Entra ID
ADP Workforce Now to Entra ID integration: Microsoft accounts from ADP, with the work address back in ADP
AFAS Profit → Microsoft Entra ID
Connect AFAS with Microsoft Entra ID