Use least privilege to improve Zoom app installation and adoption

You built an app, published it on the Zoom Marketplace, and expected users to install it, but adoption is lower than expected.

In many cases, the issue isn’t functionality alone. Permission requests can be a significant source of friction, especially when they are broad or require admin-level access.

Apps that request elevated or wide-ranging permissions often face additional review requirements or admin approval workflows. This adds friction during installation and can slow adoption, particularly in enterprise environments.

This guide shows how to apply the principle of least privilege in Zoom apps to reduce installation friction and improve adoption. Learn how scopes work, how to structure permission requests, and how to request only the access your app needs at the right time.

Identify why users are not installing your app

When users install an app from the Zoom Marketplace, permissions are evaluated early—either directly or through an admin approval process.

Common blockers include:

• Requesting admin-level scopes for features that can use user-level scopes
• Permissions that appear broader than expected
• Delays or rejection from security or IT teams
• User drop-off when prompted for elevated access

In enterprise environments, apps are often evaluated under a default deny model, where broad access must be justified. Reducing the number and scope of permissions increases the likelihood of installation.

Apply least privilege in your Zoom app

The principle of least privilege means requesting only the minimum permissions required for your app to function.

In Zoom apps:

• Request scopes required for your current feature set
• Avoid admin-level scopes unless strictly necessary
• Use specific scopes instead of broad ones
• Request additional permissions only when needed

This approach reduces installation friction and builds trust with users and administrators.

Understand how least privilege improves adoption

Least privilege is not only a security best practice, it directly impacts adoption.

Key benefits:

• Faster installations with fewer admin approvals
• Increased user trust
• Reduced friction during app review
• Higher install completion rates

Reducing permissions typically leads to measurable improvements in conversion.

Understand Zoom scopes

Zoom uses scopes to define the data and actions your app can access. Selecting the correct scopes is critical.

Use user-level scopes

• Granted by individual users during installation
• Do not require admin approval in most cases
• Suitable for apps operating on behalf of a single user

Use user-level scopes whenever organization-wide access is not required.

Use account-level (admin) scopes only when necessary

• Require approval from an account owner or admin
• Provide access to organization-wide data or settings
• Introduce additional installation friction

Request account-level scopes only when your app cannot function without them.

Choose granular OAuth scopes over classic scopes

Zoom provides both classic scopes and granular OAuth scopes.

Classic scopes

• Broad access
• May include multiple resources
• Easier to implement but less precise

Granular OAuth scopes

• Fine-grained and specific
• Allow precise permission requests
• Recommended for new apps

Use granular OAuth scopes to align with least privilege. Granular scopes also enable optional scopes, which allow you to further refine when and how permissions are requested.

Use optional scopes for progressive authorization

Optional scopes let you design a permission model that evolves with user actions. Instead of requesting all possible permissions upfront, define a minimal set of required scopes for core functionality, then mark advanced permissions as optional and request them when users enable related features.

Example

• Initial install: request read-only access (required scopes)
• Advanced feature: request write or admin access when enabled (optional scopes)

User experience

• Required permissions are always requested during installation
• Optional permissions are presented separately and can be accepted, partially accepted, or declined

Implementation options

• Use the default authorization flow to request required and optional scopes together
• Use an advanced authorization request to dynamically control which scopes are required and optional for a given user flow

This approach reduces over-permissioning while maintaining flexibility for advanced features.

Choose the right installation model and permissions

Zoom Marketplace apps support different installation models based on requested scopes.

Use user-managed installation for most use cases, since it allows individual users to install the app with lower friction and faster adoption.

Use admin-managed installation only when organization-wide access is required, as it introduces approval workflows and additional friction.

Admin-level access is typically needed for scenarios such as managing users across an account, accessing organization-wide reporting data, or enforcing account-level policies. Limit admin scopes to only what these features require, and where possible, make those capabilities optional so they are requested only when explicitly needed.

Separate user and admin experiences

If your app includes both user-level and admin-level functionality, consider separating user and admin experiences.

Option 1: Separate features within one app

• Start with user-level scopes
• Request admin scopes only when needed, potentially as optional scopes tied to admin-specific features

Option 2: Create separate apps

• A user-installable app for individual workflows
• An admin-focused app for organization-level features

This approach helps maximize user-level adoption, reduce admin-related friction, and keep advanced access scoped appropriately.

Handle reauthorization carefully

Reauthorization happens when your app needs to request additional scopes after a user has already installed or authorized it.

Follow these best practices:

• Request new scopes only when they’re truly needed
• Clearly explain why you’re asking for additional permissions
• Trigger reauthorization during a user-initiated action
• Avoid unexpected prompts that interrupt the experience

Optional scopes are commonly used in this flow, where users initially skip certain permissions and later grant them when enabling new functionality.

Reauthorizing with additional scopes in Zoom

When your app requires expanded access, Zoom provides a structured way to update scopes and prompt users to re-consent.

1. Update your app configuration

• Go to the Zoom App Marketplace
• Navigate to Manage > Created Apps
• Select your app and update scopes in the Scopes section

2. Submit for review (if applicable)

• If your app is published, submit the updated scopes for review before they take effect

3. Prompt users to reauthorize

Choose the appropriate method based on your app type:

By aligning scope requests with clear user actions and using the appropriate reauthorization flow, you can expand permissions without disrupting the user experience.

Next Steps

Permissions, not functionality, often contribute to installation friction in Zoom apps. Applying the principle of least privilege helps reduce friction, improve approval rates, and build user trust, which supports stronger adoption. Optional scopes support this approach by allowing you to request additional access only when users choose to enable advanced features. Request only the access your app needs, and request it at the right time.