Zoom resources for IT staff

Eligible users can self-provision a PennZoom account, using a web browser to sign in with their PennKey credentials at the following website:

https://upenn.zoom.us

For regular Single Sign-on (SSO) sessions using PennKey

A PennZoom account email address typically is in the form pennkey@upenn.edu where pennkey refers to the PennKey username. Users sign in to PennZoom using the following process:

From a web browser:

https://upenn.zoom.us

and choose Join, Host, or Sign in. Use PennKey credentials to complete the process.

From the Zoom desktop or mobile client:

Click Sign In with SSO and then select upenn as the company domain.

While it’s fine to use the web browser to sign in to Zoom to attend meetings, hosts of Zoom meetings are advised to use the desktop client app, which offers additional features and functions.

For non-PennKey logins

To sign in to Zoom using non-PennKey credentials (i.e., a specific Zoom username and password), use this sign-in page from a web browser:

https://zoom.us/signin

New meeting links are in this format:

Image

Existing meeting links will continue to work, provided they are not altered, and existing meeting passcodes won’t change.

To access cloud recordings, check Zoom account in the Recordings area. New recordings are in the following format:

Image

Zoom has been implemented differently by individual Schools and Centers at Penn. This inconsistency has created numerous problems, including obstacles to collaboration and interoperability. To address this, ISC and partners in Schools and Centers have worked toward an optimized implementation, including providing paid licenses to all faculty and students through an enterprise Zoom license. Other enhancements improves user experience by addressing current barriers to collaboration and simplifying the process to claim and sign in to Zoom accounts. Specific technical enhancements include improved account provisioning, standardized SSO authentication, Grouper integration to support delegated administration, and  LTI integrations. Work is also underway on a roadmap for ongoing service enhancements and a shared governance model.

Users with the following active affiliations are eligible for PennZoom. Eligibility is not enforced automatically. It is the responsibility of sub-account administrators to determine which users are eligible.

In keeping with Penn’s distributed IT model, the process and schedule for license distribution will vary among Schools and Centers and will be dependent on the structure of your organization’s Zoom implementation. ISC will share information about how to request and provision licenses as it becomes available.

Zoom Webinar, Large Meeting and SIP add-on licenses are not included with the enterprise agreement.  However, these licenses can be purchased by schools/centers at a 20% discount under the agreement.  ISC is currently working on a process for requesting and distributing add-on licenses within the central Zoom service.  Until then, Zoom Administrators in schools/centers should not assign any add-on licenses without first submitting a request to ISC Client Care at help@isc.upenn.edu.  Your request must include a 26-digit budget code.  This will enable ISC to track and bill for Zoom add-ons and help ensure that the add-on licenses are used by the organizations that have purchased them.

Migration of existing users will vary in complexity based on an organization's current Zoom implementation. ISC is working with Zoom technical personnel to develop migration plans for organizations' existing Zoom accounts and to document what steps–if any–their existing users will need to take.

Your faculty member can auto-provision a Zoom account at https://upenn.zoom.us. Please contact ISC Client Care if your faculty member has any issues auto-provisioning their account.

The Zoom Planning Group meets bi-weekly and consists of IT staff across the schools and centers. You should connect with your School/Center's representative from the Zoom Planning Group to stay up to date.

The appearance of Penn-branded backgrounds requires that the Zoom desktop and mobile clients be up to date. If your users are not seeing the Penn-branded backgrounds, have them update their client to the latest version.

Zoom is requesting at least two weeks of notice for migrations. Once Zoom begins an actual migration, the process is measured in minutes. The actual duration of the migration will depend on the number of accounts being migrated.

While it is technically possible to migrate accounts in batches, ISC strongly recommends wholesale migrations due to Zoom’s planning time, the technical work efforts associated with batch migrations, and administrative overheard.

The new Zoom implementation will be a blended authentication environment. PennKey accounts will authenticate using Single Sign-on (SSO).  Non-PennKey accounts will use local credentials to authenticate.

Yes. Single Sign-on (SSO) will be the standard authentication method. User’s account email addresses will need to be pennkey@upenn.edu. This conversion will be done automatically for existing accounts as part of the migration process. Note that users will also need to have mail routing for pennkey@upenn.edu in place. 

It will not be possible for ISC to create one at this time given the resource and time constraints of the project. However, because the standard Zoom installer may cause confusion for some users as it prominently presents the Zoom sign-in fields versus the fields for SSO, ISC may consider creating a custom installer in the future.

The initial Global Account Settings are the default except that the Hong Kong Data Center Region has been excluded from use per the OIS, OACP and OGC. However, the Singapore Data Center Region has been added as an authorized Data Center Region.

Yes.

Yes. Account provisioning occurs during the SSO sign-in process. After a new user authenticates, their account will be provisioned to the appropriate School or Center group.

This remains at three business days.

Non-PennKey accounts will need to use the following URL to authenticate: https://zoom.us/signin. The link included in meeting invitations needs to be changed to this URL in order for non-PennKey accounts to be able to login with local authentication.

Every mapping of a Zoom instance (which includes subaccounts) to a Canvas instance requires a new Zoom/Canvas integration. While these integrations are independent, each is displayed in the selection list the Canvas user sees in the given Canvas instance.

Yes. There will be a PennGroup for each School/Center that will enable the organization to exclude users from being automatically provisioned into the main University account. However, account provisioning in sub-accounts will initially be a manual process. The current plan is to redirect users excluded from the main account to a page which describes why they are being denied access and which sub-account they should use to access Zoom.

Yes. Each sub-account can have its own unique SSO integration and configuration.

From a technical perspective, SSO will require pennkey@upenn.edu for the account’s UID which will effectively limit students to a single account. An additional Zoom account would need to be a non-PennKey account which would use local authentication, not SSO. Organizations will make their own determinations whether to allow a student to have a second, non-PennKey Zoom account, based on valid academic purposes/reasons.

Additional Zoom add-ons such as webinars will be available at an additional cost. Purchased add-ons will need to be assigned to individual user accounts. Add-on licenses are charged back to a Penn 26-digit budget code and require a one year commitment.

With few exceptions, a user's overall experience will be very similar to their current experience. However, the main University account will feature various enhancements that will provide a better user experience in terms of interoperability and ability to collaborate with others at Penn.

Meeting links will continue to work, including the embedded passcode. However, if a meeting was hosted on a site with a different vanity URL, users will be presented with a message that they’re trying to access an external meeting–the link will work, but there will be an advisory message.

Existing links for recordings will continue to work. If the recording is shared after the migration, the link will be different.

Account level and user settings will be changed to mirror default settings of the main University account. This applies to sub-account migrations as well.

For users migrating from external accounts (i.e., accounts not current under the main University account):

• Former vanity URLs will not work; users will be bounced to https://zoom.us
• Users who sign in through the browser will need to sign in to https://upenn.zoom.us
• Users who sign in through the client will need to update their client
• Users who stay signed in on their devices will be signed out

Yes, both alternative hosts and delegated access need to be re-invited.

Users with accounts that need to be migrated will likely experience an outage of one hour or less. Zoom is unable to specify exactly how long the migration process will take, however. After the account has been migrated:

• Users with basic Zoom accounts using pennkey@upenn.edu will be automatically mapped to Zoom group and provisioned with paid license in the main upenn.zoom.us account on login.
• Users in existing sub-accounts will continue to sign in to the sub-accounts as they have been.
• Users in existing sub-accounts that have been migrated into the main upenn.zoom.us account will use SSO and their pennkey@upenn.edu address to sign in there.

Note: Schools that do not want their faculty, staff, or students to sign in to the main University account will be able to add them to an exception group in PennGroups to keep them out of the main upenn.zoom.us account.