How two-step verification (2FA) for Zoom works and how to implement it

Two-step verification (2FA) for Zoom asks you, when you sign in, for a code generated by an app on your phone or received by text message, in addition to your password. Zoom introduced it for all accounts in September 2020, and the administrator can make it mandatory for every user in the company. Below you’ll find out how it works and how to turn it on.

Zoom’s services became very popular during the pandemic, when remote work became a necessity. Being in the spotlight, the platform also had some of its problems exposed, especially security ones. Zoom reacted fairly quickly and introduced two-factor authentication (2FA). That way, someone who learns a user’s password can no longer easily sign in to their account to join meetings they shouldn’t be in.

As remote work spread, all the major makers of work-from-home platforms had to improve their security. Many employees still work from different locations today, on their own devices and on public networks, which makes account security even more important.

How does two-step verification (2FA) for Zoom work?

Two-step verification asks users, in addition to their login details, for a code generated by an app or received by text message or phone call. This method adds an extra layer of security and greatly reduces the chances of an account being compromised.

With Zoom, once 2FA is turned on, it works both on the web and in the Zoom apps for phones and computers.

The good news is that it works with any authenticator app that supports the TOTP (Time-Based One-Time Password) protocol. The most popular are Google Authenticator, Microsoft Authenticator and FreeOTP.

Zoom’s 2FA applies when you sign in with the email address and password of your Zoom account. If your company uses single sign-on (SSO), for example with Microsoft 365 or Google Workspace accounts, the second step is configured at the identity provider (for example, in Microsoft Entra ID), not in Zoom.

How do you turn on 2FA for Zoom across the whole company?

The Zoom account administrator turns on 2FA from the web portal, following Zoom’s guide to two-factor authentication:

1. Sign in to the Zoom web portal with an administrator account.
2. Open the Advanced menu, then Security.
3. Turn on the “Sign in with Two-Factor Authentication” option.
4. Choose who it applies to: all users, only certain roles or only certain groups.
5. Click the Save button to save the settings.

The names and locations of the options may differ slightly depending on your Zoom plan and the interface language.

How does each user set up two-step verification?

Once the administrator has turned on 2FA, each user sets it up at their first sign-in or from their profile:

1. Sign in to the Zoom web portal and open Profile.
2. Under Two-factor Authentication, click Turn On and confirm your password.
3. Choose the method: an authenticator app (scan the QR code with Google Authenticator or Microsoft Authenticator and enter the code shown) or text message.
4. Keep the recovery codes in a safe place, for example in a password manager: they let you get into your account if you lose your phone.

We recommend choosing the authenticator app over text messages, which can be intercepted or hijacked through SIM swapping. The same principle applies to all company accounts: email, VPN, cloud apps. Google took the same step for its own accounts, as we wrote in the article on Google turning on two-step verification for all users. And the first step is still a good password: see the basic rules for creating secure passwords.

RezolvIT is an IT outsourcing company that places great value on security and on protecting users’ personal data. Using modern monitoring platforms and a proactive approach, the company helps and supports its clients so they can focus on their business. You’ll find details about our IT security services on their page.