Zoom Security Best Practices: A CISO and IT Admin Configuration Guide

Zoom is now core meeting infrastructure, which makes it a target. The default settings are tuned for frictionless joining, not for a regulated enterprise, so the security work is mostly a matter of turning on controls that already exist and locking them at the account level so a well-meaning employee cannot turn them back off. This guide walks through the settings that actually reduce risk, the trade-offs behind the ones people get wrong, and a checklist you can hand to whoever administers your tenant.

Start at the front door: waiting rooms and passcodes

Two controls stop the overwhelming majority of unwanted entries. A waiting room holds every joiner until the host admits them, so nobody lands in a live meeting uninvited. A passcode (embedded in the invite link or entered manually) means the meeting ID alone is not enough to get in. Enable both at the account level and lock them so meetings cannot be created without them.

The two overlap, and Zoom lets you relax one if the other is present. For internal, low-sensitivity standups a passcode-only meeting is fine. For anything with external guests, board material, or regulated data, keep the waiting room on and admit people deliberately. Configure the waiting room so authenticated internal users skip it while guests wait, which keeps friction low without lowering the bar for outsiders.

Restrict who can join

Passcodes gate the link; join restrictions gate the person. Zoom can require that participants are signed in to a Zoom account, signed in via your SSO identity provider, or that their email matches a domain allow-list you define. For internal-only meetings, "authenticated users from my domain" is the setting you want, and it is worth making it the default profile for the organization.

• Authenticated users only blocks anonymous and guest joins outright.
• SSO / domain allow-list ties join rights to your identity provider or approved partner domains, so leavers lose access the moment their IdP account is disabled.
• External guests should be a conscious exception, ideally combined with the waiting room so the host confirms each one.

Lock the meeting and manage participants

Once everyone expected has arrived, lock the meeting from the security menu. A locked meeting refuses all further joins regardless of passcode, which closes the window an attacker needs. Hosts and co-hosts can also remove a participant (Zoom can optionally block that person's device from rejoining), put attendees on hold, mute everyone, and disable rename so nobody can impersonate a colleague. Make sure hosts know the one-click Suspend Participant Activities button, which freezes video, audio, screen share, and chat instantly if a meeting is disrupted.

Host and co-host controls

The host role is powerful, so treat it deliberately. Only promote trusted people to co-host, because co-hosts inherit most in-meeting security powers. Decide who can share, who can annotate, who can unmute, and whether participants may chat privately. For large or public webinars, run in webinar mode rather than meeting mode so attendees are viewers by default and cannot turn on their cameras or share without being promoted.

Screen-share and content restrictions

Set screen sharing to host only by default. Uncontrolled sharing is the classic "Zoombombing" vector, where an intruder shares offensive content the moment they get in. When you do allow participant sharing, restrict it to one sharer at a time and disable the ability to take over an active share. Turn off or gate remote control, annotation, and file transfer in chat unless a specific workflow needs them, since each is a path for either disruption or malware.

End-to-end encryption and its trade-offs

All Zoom meetings use encryption in transit by default, and for most meetings that enhanced GCM encryption is appropriate. Zoom also offers true end-to-end encryption (E2EE), where the meeting keys never leave participants' devices and Zoom's servers cannot decrypt the content. E2EE is the right call for genuinely sensitive conversations, but you pay for it: cloud recording, live transcription, phone dial-in, breakout rooms, and some join paths are disabled, and every participant must join from the Zoom client rather than a browser. Enable E2EE as an option hosts can choose per meeting rather than forcing it globally, and reserve it for the meetings that warrant losing those features.

Recording: cloud vs local, retention, and access

Recordings are often the most sensitive artifact a meeting produces, and they outlive the call. Decide deliberately who may record at all, and prefer cloud recording when you need central control, because it lets you enforce access rules, passcodes on the recording, expiration, and audit. Local recording drops a file on someone's laptop where you have no visibility or retention control, so restrict or disable it for most users.

• Require a passcode on shared cloud recordings and restrict viewing to authenticated users in your domain.
• Set an auto-delete / retention window so recordings do not accumulate indefinitely, and align it with your data-retention policy.
• Turn on the recording disclaimer so participants are notified and consent, which many jurisdictions require.
• Review who has download rights; a downloaded copy escapes every retention rule you set on the cloud original.

Data residency

Zoom lets you influence where meeting data is processed and where recordings are stored through data-residency settings and by opting in or out of specific regional data centers for real-time traffic. If you operate under GDPR or a sector rule that constrains where personal data lives, configure the account so meeting media and recordings stay in approved regions, and document the choice. Note that residency for live media routing and for stored recordings are configured separately.

App Marketplace and third-party app governance

The Zoom App Marketplace lets users add integrations that can request broad scopes, including reading meeting content, recordings, and user directories. By default, treat the Marketplace as a supply-chain risk. Turn on admin approval so users cannot install apps unilaterally, allow-list the specific apps you have vetted, and review the OAuth scopes each one requests. Periodically audit installed apps and revoke anything unused, because a dormant integration with recording access is a standing data-exfiltration path.

Zoombombing prevention in one paragraph

Everything above composes into anti-Zoombombing hygiene: never post meeting links publicly, use unique meeting IDs rather than your Personal Meeting ID for anything sensitive, require a passcode and authentication, keep the waiting room on, set sharing to host-only, and lock the meeting once it starts. If disruption happens anyway, Suspend Participant Activities and remove the offender with rejoin blocked. The controls exist; the failure mode is leaving them off.

Phishing: fake invites and malicious updaters

Attackers impersonate Zoom because everyone trusts a meeting invite. Two patterns dominate: fake invite emails whose "Join" button leads to a credential-harvesting page, and fake Zoom installers or "update" prompts that deliver malware. Defend both with people and controls. Teach staff to launch Zoom from the installed app or a bookmarked domain rather than clicking update prompts inside emails or pop-ups, and to verify that meeting links point to a legitimate zoom.us host. On the technical side, push the Zoom client through your device-management tooling so users never need to update manually, and enforce SSO and MFA so a phished password alone cannot log an attacker in.

Admin dashboard, audit, SSO and SCIM

Central control is what turns all of the above from per-user hope into enforced policy. Use the admin dashboard to monitor usage, meeting quality, and active sessions, and rely on the audit and sign-in logs to review setting changes and access to recordings. Connect Zoom to your identity provider with SSO so authentication and MFA are enforced centrally, and provision accounts with SCIM so joiners get the right role automatically and leavers are deprovisioned the instant HR disables them. Lock security-relevant settings at the account or group level so individual users cannot weaken them, and revisit the configuration on a schedule.

Actionable checklist

• Enable and lock waiting rooms and passcodes account-wide.
• Default meetings to authenticated users only, tied to SSO or a domain allow-list.
• Set screen sharing to host only; disable remote control and annotation unless needed.
• Train hosts to lock the meeting and use Suspend Participant Activities.
• Restrict or disable local recording; prefer passcode-protected cloud recording.
• Set recording retention/auto-delete and enable the recording disclaimer.
• Configure data-residency for live media and stored recordings to approved regions.
• Turn on admin approval for the App Marketplace and allow-list vetted apps.
• Enforce SSO + MFA and automate lifecycle with SCIM.
• Push the Zoom client via device management so users never sideload updates.
• Review the admin dashboard and audit logs on a schedule; lock settings so users cannot weaken them.
• Offer E2EE as a per-meeting option for your most sensitive conversations, accepting the feature trade-offs.

Frequently asked questions

A few questions come up every time an organization tightens its Zoom configuration.

Do I need both a waiting room and a passcode? Not always, but using both gives defense in depth: the passcode stops link-guessing and the waiting room stops anyone the host has not personally admitted. For external or sensitive meetings, keep both on. For low-risk internal calls a passcode with authenticated-user restriction is usually sufficient.

Should I force end-to-end encryption on everything? No. E2EE disables cloud recording, live transcription, phone dial-in, breakout rooms, and browser join. Offer it as a per-meeting option and reserve it for genuinely sensitive conversations rather than making it the global default.

Cloud or local recording? Prefer cloud recording when you need retention, access control, and audit, because it keeps the file under central policy. Local recording leaves an uncontrolled copy on an endpoint, so restrict or disable it for most users.

How do I stop Zoombombing? Do not share meeting links publicly, require a passcode and authentication, keep the waiting room on, set sharing to host-only, and lock the meeting once everyone has joined. If it happens anyway, use Suspend Participant Activities and remove the intruder with rejoin blocked.

How do we control third-party Zoom apps? Enable admin approval in the App Marketplace so users cannot install apps on their own, allow-list only vetted integrations, review the OAuth scopes each requests, and periodically audit and revoke unused apps that still hold access to recordings or directory data.