Admin Experience

This section provides information about how to deploy and enroll devices in Zoom Device Management (ZDM). ZDM enrollment connects a Zoom Workplace app to the organization’s management portal using an enrollment token. Devices can be enrolled globally or directly into a specific group.

Prerequisites

• Enterprise account

• Account owner or admin privileges

• Zoom desktop app

  • Windows: global minimum version or higher

  • macOS: global minimum version or higher

  • Linux: global minimum version or higher

• Zoom mobile app

  • Android: global minimum version or higher

  • iOS: global minimum version or higher

• Contact Zoom Support to have the ZDM client for desktop and mobile feature enabled.

Note

After contacting Zoom Support, allow up to 3 business days for the feature to be enabled.

Enrollment Methods

Global Enroll

This method allows you to enroll devices first, then assign them to groups later.

1. Sign in to the Zoom web portal.

2. In the left navigation, click Device Management, Enrollment, and Zoom Client.

3. Generate an enrollment token.

4. Deploy the token using one of the supported methods below.

Direct Enroll to Group

This method allows you to enroll devices directly into a target group.

1. Sign in to the Zoom web portal.

2. In the left navigation, click Device Management, Device List, and Groups.

3. Generate a group-specific enrollment token.

4. Deploy the token using one of the supported methods below.

Deployment Options by Platform

Zoom Device Manager supports the following operating systems: Windows, macOS, Linux, iOS, and Android. Below are some examples that you can use with your preferred endpoint management/MDM tools.

Windows

Use the following:

MSI Installer

msiexec /i ZoomInstallerFull.msi ZConfig="SetEnrollToken4CloudMDM=<your-token>"

Group Policy (Registry Key)

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Zoom\Zoom Meetings\General]
"SetEnrollToken4CloudMDM"="<your-token>"

macOS

PLIST Configuration

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "...">
<plist version="1.0">
<dict>
  <key>SetEnrollToken4CloudMDM</key>
  <string><your-token></string>
</dict>
</plist>

Place the us.zoom.config.plist file alongside the Zoom installer during deployment.

Linux

Use the environment variable or configuration file method to include the enrollment token during installation.

Mobile (iOS/Android)

Deploy via MDM or MAM solutions such as Intune, Jamf, or VMware Workspace ONE, embedding the enrollment token in the app configuration.

Test and Validate Your Deployment

Before any large-scale rollout, it is a good idea to validate the configuration and policy behavior. This allows Administrators to create a safe testing environment that won't impact production, test a single device, and leverage the registry and plist files provided.

To set up a test or pilot deployment, do the following:

1

On a test machine, add the registry key or PLIST entry manually with the enrollment token for your ZDM test group.

2

Launch the Zoom Workplace app on the test machine.

3

Sign in to the Zoom web portal.

4

In the left navigation, click Device Management, Device List and confirm that the device is listed.

Note

You can search for device name or filter by the Zoom Clients device type.

5

Confirm policy synchronization and applied settings in the Sync Status column.

Note

Click the gear on the right side of the table in order to find the column.

The following is an example of the Sync Status menu.

Sample Sync Status menu

You can also use the Zoom Client Healthcheck tool to verify ZDM group enrollment and policy enforcement.

See the Troubleshooting section.

Settings Prioritization

When multiple configuration sources exist, Zoom applies settings in the following order of precedence:

1. ZDM locked settings

2. GPO (zConfig)

3. MSI (zConfig)

4. Restrict in-meeting features (admin-level)

5. User client settings

6. ZDM unlocked settings

7. GPO (zRecommend)

8. MSI (zRecommend)

9. Unlocked web portal settings

Recommendation

Use a single control source per setting to avoid conflicts and enable predictable behavior. See the Mass-deploying with preconfigured settings for Windows article for more information.

Additional Options

To find additional ZDM settings, click Conference Room Connector, Account Settings, Zoom Clients. This contains things like global defaults, advanced settings, and integrations:

• Manage Update Channels: Use this to set default update channels that are available to users, including Custom Private Channels. These can be overridden at the ZDM Group level.

• Enable Zoom Client Change Group via Enrollment Token: By default, the Zoom Workplace app will look for an Enrollment Token at launch and join that group, if found. After enrollment, the app stops looking for an enrollment token, since it is already enrolled. Enabling this setting will force the app to look for an Enrollment Token at each startup, even if already enrolled. If a new Enrollment Token is found, it will force the app to change ZDM groups. This can be useful when administrators want to bulk change which group devices are enrolled in by pushing out new GPO/PLIST policies.

• Auto clean up decommissioned devices older than specified days: When this option is enabled, ZDM will automatically remove Zoom Workplace apps that haven't been active for the specified number of days (30, 60, or 90 days). By default, enrolled devices will stay in ZDM until an administrator removes them.

Best Practices

• Start small: Test enrollment and policy sync with a limited group before scaling.

  • Use the .reg file to complete a quick test.

  • Enroll a single device without impacting others. Enabling ZDM for Clients has no impact on un-enrolled devices.

• Document tokens: Track which tokens correspond to which groups.

• Monitor sync: Check the Sync Status column in the ZDM portal for each device.

• Combine with MDM: Use ZDM for Zoom-specific controls and MDM for OS-level management.