Sub Accounts Field Guide

Sub Account Overview

This section provides an introduction to sub accounts and their unique dynamics.

A sub account is an independent, fully functioning Zoom account that is associated with another Zoom account known as the master account

A sub account is a separate account environment with standard feature accessibility that is associated with another Zoom account known as the master account. Despite being associated with a master account, sub accounts are best thought of as unique, independent accounts that do not share any intrinsic relationship or settings with any other account. All users, settings, configurations, and account details are, with few exceptions, unique to each sub account.

Diagram of Master and Sub Account hierarchy.

Note

Some accounts, such as those using carrier-provided SIP connected audio plans, or three-tier sub accounts, maintain dependencies on their associated master account for functionality. Apart from these exceptions, accounts maintain independence in configurations and settings.

Companies with subsidiary sub accounts are manageable by an admin or authorized user on the master account

Although a sub account’s environment is independent of the master account, authorized users on a master account can manage and configure a sub account through the web portal. This includes: enabling, disabling, or locking account-wide settings; viewing account reports; adding or removing users; configuring single sign-on; and more.

Note

Distributor, reseller, and carrier accounts do not have access to this feature by default, but can be enabled on an exception basis. Contact your account executive for more information.

A sub account does not inherit master account configurations

Because every sub account is a unique environment, settings and configurations on the master account do not automatically apply to sub accounts. Any locked or enforced settings on a master account must be reinforced on the sub account level to apply.

For example, if the master account has all telephony options disabled and locked on the account level, a sub account will not be impacted by this setting, and can enable telephony options for users on the account.

A sub account can have a unique vanity URL, SSO configuration, and associated domain list

Because a sub account is a unique, independent account, each sub account can have its own vanity URL, single sign-on (SSO) configuration, and associated domains list. This allows each account more granular control over its configuration, independent of master account configurations.

For example, the University of Zoom is a master account that maintains most of the university’s students and faculty. The faculty and students authenticate through SSO using their generic vanity URL. However, the university wants to create a healthcare account with restrictive settings to respect patient privacy. The University of Zoom can create a University of Zoom – Healthcare sub account with a unique vanity URL and SSO configuration that only healthcare providers use. Additionally, the admin can associate the university’s healthcare subdomain with the account, so all healthcare employees within the university are automatically prompted to consolidate into the healthcare sub account.

Bulk licensing allows master and pseudo-master accounts to delegate licenses from a master account to one or more sub accounts

Note

A pseudo-master account is a sub account that operates as a master to a third-tier sub account. This workflow is unique to specific reseller and carrier accounts.

Customers with bulk licensing enabled can delegate licenses from a master account (or pseudo-master) to a sub account at no additional cost.

For example, if a company has 1,000 total meeting licenses and 900 are in use, the remaining 100 can be delegated to any number of sub accounts at no additional cost. The following table provides examples of how a master account can distribute remaining licenses across one or more sub accounts:

Licenses Purchased by Master	Used on Master Account	Assigned to Sub Account 1	Assigned to Sub Account 2	Remaining Assignment
1000	900	100	0	0
1000	900	50	50	0
5,000	10	1,000	1,000	2990

Note

Bulk licensing is not available to all customers. Contact your Zoom account executive for more information on bulk licensing.

Master accounts without bulk licensing can pay for sub accounts directly, or configure separate billing within each sub account

When creating a sub account without bulk licensing delegation, customers can choose to consolidate the sub account’s billing into the master account, or make the sub account liable for their own expenses.

Note

Distributor, reseller, and carrier accounts are always “pay by master.”

Sub Account Management

This section provides instructions for adding, managing, and configuring sub accounts from a master account. When applicable, instructions are defined by accounts with and without bulk licensing enabled.

The Sub Accounts page on the web portal contains a Dashboard, Accounts List, and Report center

An account owner or admin with sufficient role privileges within the master account can access the Sub Accounts management page, available under the Account Management menu. This page contains a Dashboard, Accounts List, and Report generator for sub account data, and is the central location for managing all associated sub accounts.

Location of Sub Account admin menu.

Note

The Sub Accounts option is not available for accounts by default. Confirm your role has sufficient privileges or consult your account executive for more information on enabling sub accounts if this option is not available.

Master accounts with bulk licensing see a comprehensive license summary for all licenses in the Sub Accounts Dashboard

Master accounts with bulk licensing enabled see a comprehensive license summary between all sub accounts and the master account. This summary lists the total of all licenses owned by the master account and specifies how many licenses are distributed across all sub accounts.

Example comprehensive license summary with bulk licensing.

Master accounts without bulk licensing see a table with aggregate totals in the Sub Accounts Dashboard

Master accounts without bulk licensing enabled see an aggregate total of all associated sub accounts, users (hosts), seats purchased (licenses), and conference room connector ports.

Example table without bulk licensing.

The Accounts List is the central location for sub account overviews and plan management

Viewing the Accounts List from the Sub Accounts menu displays general sub account information including the account name, owner email, account number, billing type, account type, licenses assigned, subscription dates (if applicable), and account creation time.

From this page, an admin or authorized user can click View Plan to edit sub account plan subscriptions or click the Account Name to sign into the sub account.

Example account list.

The Report page can generate a Telephone, Cloud Recording, and Active Host report for selected sub accounts

An admin or authorized user within the master account can generate a Telephone, Cloud Recording, or Active Host report for any sub accounts associated with the master account. These reports can help determine license utility, telephony overage charges, and cloud recording storage use across accounts.

Refer to our support documentation for more information on reporting.

Example report generation.

Adding a Sub Account

An admin or authorized user on the master account can add a sub account through the Accounts List page, available within the Sub Accounts menu.

How to add a sub account.

Adding a Sub Account With Bulk Licensing

1. As a Zoom admin or authorized user, navigate to the Accounts List page within the Sub Accounts menu and click Add in the top-right corner of the screen

2. Fill in the information for the sub account

   1. Input the Account Name

   2. Input the Account Owner Email (must be valid and never previously registered)

   3. Generate a secure, strong password

   4. Select your sub account payment and collection option

   5. (Optional) Select Show audio storage cost, which shows the rate and total of charges associated with premium telephony when generating reports

   6. Click Create and Continue

3. Assign the licenses you are applying to the sub account\

   

   Example license assignment.
4. Click Assign License in the bottom left corner to review and Confirm your license assignments to create the sub account\

   

   Example confirmation screen.

Adding a Sub Account Without Bulk Licensing

1. As a Zoom admin or authorized user, navigate to the Accounts List page within the Sub Accounts menu and click Add in the top-right corner of the screen

2. Fill in the information for the sub account

   1. Input the Account Name

   2. Input the Account Owner Email (must be valid and never previously registered)

   3. Generate a secure, strong password

   4. Select your sub account payment and collection option

   5. (Optional) Select Show audio storage cost, which shows the rate and total of charges associated with premium telephony when generating reports

   6. Click Create and Continue

3. Select the Plan Type for the sub account, select the license count, and select any add-ons

   

   Example plan type with total.
4. Click Continue to finish

Managing Sub Account Plans and Licenses

An admin or authorized user on the master account can manage sub account plans or licenses through the Accounts List page by clicking View Plan to the right of the account.

Example account list.

Updating a Sub Account Plan and Licenses With Bulk Licensing

1. Navigate to the Accounts List page

2. Click View Plan for the account you are modifying

3. Click Edit Subscriptions in the bottom left corner

Edit Subscription button location.

1. Update the license values and click Assign License to Confirm the new assignments

Updating a Sub Account Plan and Licenses Without Bulk Licensing

To update a sub account’s license assignment without bulk licensing enabled:

1. Navigate to the Accounts List page

2. Click View Plan for the account you are modifying

3. Click Add/Edit on the right side\

   

   Location of Add/Edit in menu.
4. Update the plan values as necessary and click Continue to finalize changes

Disassociating a Sub Account

A master account can disassociate a sub account by clicking the Disassociate button on the View Plan page. This will not delete the sub account, but will instead grant full autonomy and independence from the master account. Any disassociated sub accounts will retain all users, settings, and configurations set at the time of disassociation.

Warning

Carrier partner phone numbers assigned to a sub account for SIP connected audio (SCA) will remain available if they are not removed prior to disassociation. Carrier partners are encouraged to remove SCA phone numbers from a sub account before disassociating.

To delete a sub account, refer to our support documentation.

Signing into a Sub Account as an Administrator

There are two methods for signing into a sub account as an administrator:

1. A Zoom admin or authorized user on the master account can manage a sub account from the Account Details page, accessible via the Accounts List

2. Authenticate directly using the sub account owner or zoom admin credentials

Once authenticated within the sub account through either method, an admin can manage the account as normal.

Manage a Sub Account from the Master Account

To sign into a sub account from the master account, perform the following steps:

1. Navigate to the Accounts List page within the Sub Accounts menu

2. Click the Account Name in the left column\

   

   Example account name.
3. Scroll down and click Manage this Account\

   

   Example Manage this Account button location.
4. You are now signed into the sub account as the sub account owner\

   

   Example page after signing in as sub account.
5. Return to the master account at any time by clicking Back to Master Account in the top left corner

Note

When managing a sub account through this method, the Personal sub-menu interface for scheduling meetings, updating profile information, or changing user settings is unavailable; only the Admin sub-menu interface will display.

Authenticate Directly as a Sub Account Owner or Admin

To sign into a sub account directly using owner or admin credentials:

1. Navigate to the zoom.us sign-in page or the sub account’s vanity URL if using SSO

2. Enter credentials or click “Sign In” if using SSO from the vanity URL

3. Complete authentication

Establishing a Vanity URL for a Sub Account

Sub accounts applying for a vanity URL should choose a name in accordance with Zoom guidelines, or as a modified version of the master account’s vanity URL. This process can be initiated from the Account Profile page under the Account Management menu in the web portal.

For example, if a Zoom reseller sells a sub account to company.com, the vanity URL application should be company.zoom.us. If the company’s domain is company.io, the application should be company-io.zoom.us. Alternatively, if the sub account is a testing account for the master, the application should be company-testing.zoom.us, or similar.

Configuring Single Sign-On with a Sub Account

There are two standard configurations for integrating single sign-on (SSO) with sub accounts:

1. Authenticate through the master account’s vanity URL and be placed in the sub account through SAML response mapping

2. Configure a separate vanity URL and SSO configuration unique to the sub account

Both configurations offer unique advantages depending on user management requirements. The following two sections examine the details of both configuration options.

Users can be mapped from a master account to a sub account through SAML response mapping with a meeting license and add-ons

Users that authenticate through a master account’s vanity URL can be mapped to a sub account through SAML response mapping under the SAML Advanced Information Mapping section. Users that are mapped to the sub account through this method can only receive a meeting license and meeting add-ons through response mapping within the sub account. Any additional configurations such as Zoom Phone, User Group, or User Role, etc., must be manually performed within the sub account to apply.

This configuration is ideal for sub accounts that are highly defined in purpose and do not require advanced configurations or user assignments within the sub account. Accounts that require advanced user configurations or assignments within the sub account should not use this method. For more information, refer to the section on mapping users to a sub account.

Sub accounts can have a separate, unique single sign-on configuration for complete SAML response mapping options

Any business or enterprise-level sub account can have a unique vanity URL and single sign-on configuration. This configuration is recommended for sub accounts that require advanced SAML mapping configurations, including user groups, user roles, cloud recording storage locations, and more.

Adding Users to a Sub Account

Zoom admins can add users to a sub account through the following methods:

1. Invite users directly

2. Use the Associated Domains feature

3. Filter users into the account through SAML response mapping

4. SSO just-in-time provisioning or pre-provisioning within the sub account

5. Submit a ticket to Zoom Support for user migration between associated accounts

Invite Users Directly

To directly invite a user to join a sub account:

1. Sign into the sub account through the master account or directly

2. Click User Management within the Account Management menu

3. Import users in a list via CSV or click +Add Users to manually enter the email address

Refer to our support documentation on adding users to an account for more information.

Associated Domains

Zoom account admins can automatically consolidate users into an account over time through the associated domains feature, depending on the configuration.

Refer to our support documentation on associated domains for more information.

Filter users into the sub account through SAML response mapping from the master account

Accounts that do not want to establish a separate vanity URL or SSO configuration can filter users from the master account to a sub account through SAML response mapping. Users that are added to a sub account through this method will only receive a license and any applicable add-ons if they pass SAML values for all configurations related to licensing, add-ons, and sub-account mapping within the master account.

To configure:

1. Sign in to the master account using an admin or authorized user account

2. Navigate to the SAML response mapping page within your account’s Single Sign-On configuration under Advanced settings

3. Locate the SAML Advanced Information Mapping section

4. Configure the appropriate SAML attribute and value mapping for the designated sub account, and licenses if applicable\

   

   Example SAML advanced information mapping.

Note

In the above image, a user must assert the SAML values of global_users and HIPAA, Developer, or Tester to receive licenses, add-ons, and be filtered into the sub account. No additional SAML response mappings will apply regardless of matching responses.

1. After the user authenticates from the master account vanity URL, if all SAML response values match, the user will be placed within the sub account

Provision just-in-time or pre-provision users with a standard SSO configuration within the sub account

Business-level and higher sub accounts can utilize a standard SSO configuration within the account for just-in-time provisioning or pre-provisioning for user accounts. This configuration will have no impact on other sub accounts or the master account and requires a vanity URL associated with the sub account.

For convenience, the following identity provider integration instructions are available:

Zoom Tip

Click the ✔ in the Provider or Zoom Documentation column to open a new window to instructions.

	Provider Documentation	Zoom Documentation
auth0	✔
Azure	✔	✔
ADFS		✔
Clever	✔
CyberArk	✔
Duo	✔
JumpCloud	✔
miniOrange	✔
Okta	✔	✔
OneLogin	✔	✔
Ping Identity	✔
Shibboleth		✔

Submit a ticket to Zoom Support for user migration between associated accounts

Zoom Support can bulk migrate users from one account to another through a support ticket. This can alleviate the need to manually invite users if migrating a large subset from a master account to a sub account, or from one sub account to another.

Zoom Support will not forcibly migrate users from external or unassociated accounts to a master or sub account. Users must be managed by or associated with the master account via a sub account to be migrated. Individual, external users with pre-existing accounts must be invited to join the account through a standard process to consolidate.

For example, a master account is creating a new healthcare sub account with a unique vanity URL and SSO configuration. A Zoom admin can submit a ticket to Zoom Support with a CSV file containing a list of user emails to migrate from the master account to the sub account. Because these emails are existing members of the master account, Zoom Support can migrate the users.

However, if this list contains users that are not a member of an existing, associated sub account or the master account, those users cannot be migrated and must be invited through standard procedures, such as a manual invite.

Requests to migrate users should be submitted with:

• Tentative date and time for the requested migration (best effort)

• A CSV file of all user emails to be migrated in a single column

• The specific account number the users are being migrated from and to

• Master account owner or admin approval

Additional Account Management

Additional sub account management workflows match their master or “standard” account counterparts. Any additional configurations required within a sub account should be performed the same as they otherwise would be, with additional topics and instructions available in the Zoom Support Center.