Overview

There are two standard options for securing your Zoom meetings: setting a Passcode or enabling the Waiting Room. You can set one or the other as your security default, meaning every time you go to schedule a new meeting, Zoom will automatically enable the security option you’ve chosen. This document also includes best practices for link sharing to help prevent Zoom attacks.

Set Passcodes as Your Security Default

Passcodes are a simple way to protect access to your meeting. Only those who have the link with the Passcode embedded or the actual Passcode itself will be able to access your meeting.

Before you select Passcodes as your security default, it is important to note how Passcodes affect those who dial-in to Zoom meetings from their mobile devices.

• If the host sets a numeric (numbers only) Passcode, then the dial-in participant will need to input that Passcode when prompted.

• If the host sets an alphanumeric (numbers and letters) or alphabetic (letters only) Passcode, Zoom will automatically create a unique numeric Passcode to enter if participants dial-in. If you set Passcodes as your security default, you will need to make sure you share the Passcode and the dial-in Passcode from the meeting invite. The dial-in Passcode is located under the To join audio by phone section of the invitation.

1. Go to https://smith.zoom.us and Sign In with your Smith account.

2. Select Settings from the menu on the left.

3. Waiting Room settings will be listed first. Make sure the toggle for Waiting Room is grey and positioned to the left.

4. Scroll down to Require a Passcode when scheduling new meetings and select the toggle switch so it turns blue and is positioned to the right. Make sure Embed Passcode in invite link for one-click join (fourth option down from Require a Passcode when scheduling new meetings) is also blue and positioned to the right.

5. Zoom will automatically save your preferences. Now when you go to schedule a new meeting, the Passcode box will already be checked and a random numeric Passcode assigned. Setting Passcodes as your security default will not affect any of your existing meetings. If you need to turn the Passcode off for a specific meeting, deselect the Passcode box when you are scheduling. This will not affect your default settings for future meetings.

6. There are two ways to share a Passcode-protected meeting link. Unless you have paired Passcode protection with a publicly-acceptable form of security (see Meeting Link Sharing below) you should not post a Passcode-protected link in a public place like eDigest or social media.

Option One: Sharing the Complete Invitation (Easiest Method)

1. After you have saved your meeting, the page will reload and show you the meeting summary screen. Select Copy Invitation to open the full invitation pop-up window.

2. Select Copy Meeting Invitation.

3. Paste the invite in a secure location (Moodle, Calendar Invite, Google Drive, email, etc).

Option Two: Sharing the Meeting Link and Passcode Separately

1. After you have saved your meeting, the page will reload and show you the meeting summary screen. Copy and paste the one-click join link wherever you will be publishing the link (email, Moodle, Calendar invite, Slack, etc).

2. Delete everything in the link including and after the question mark (?). This removes the embedded Passcode and means that anyone who clicks the link to join will be prompted to enter the Passcode before they can join the main meeting room.

For example, this is a Zoom link with an embedded Passcode (highlighted in yellow):

https://smith.zoom.us/j/94075160000?pwd=QnVqRm16Zkw3QURubDY1S0N1Z2RZZz

This is the same meeting link with the embedded Passcode removed:

https://smith.zoom.us/j/94075160000

3. Share the one-click join link and the Meeting ID (for dial-in participants).

4. Copy your meeting’s Passcode from the meeting summary page. Share the Passcode separately with participants. Important: If you set an alphanumeric (numbers and letters) or alphabetic (letters only) Passcode, make sure you share the regular Passcode and the dial-in Passcode from the meeting invite. The dial-in Passcode is located under Copy Invitation > To join audio by phone.

Note: if you change the Passcode after you’ve shared it with others, you will need to send all participants the updated Passcode.

Set the Waiting Room as Your Security Default

The Waiting Room keeps participants in a separate, private holding space until the host or co-host brings them into the main meeting room.

Before you select Waiting Rooms as your security default, it is important to note how Waiting Rooms affect participants who dial-in to Zoom meetings from their mobile devices and hosts/co-hosts monitoring the Waiting Room.

• Participants who dial-in will be directed into your Waiting Room. They will receive an audio prompt that they are in the Waiting Room. There is no prompt to let dial-in participants know when they have been admitted to the main meeting from the Waiting Room.

• Hosts and co-hosts will see dial-in participants as phone numbers to be admitted in the participants panel. Dial-in participants cannot rename themselves, but hosts/co-hosts can rename them once they have been admitted to the meeting.

If you set Waiting Room as your security default, we recommend verbally announcing that you’re starting the meeting after you or any co-hosts have brought people into the main meeting room from the Waiting Room.

1. Go to https://smith.zoom.us and Sign In with your Smith account.

2. Select Settings from the menu on the left.

3. Waiting Room settings will be listed first. Select the toggle for Waiting Rooms so it turns blue and is positioned to the right.

4. Scroll down and make sure the toggle switch for Require a Passcode when scheduling new meetings is grey and positioned to the left.

5. Zoom will automatically save your preferences. The next time you schedule a new meeting, the Waiting Room box will already be checked. Setting Waiting Rooms as your security default will not affect any of your existing meetings.

If you need to turn the Waiting Room off for a specific meeting, deselect the Waiting Room box when scheduling. This will not affect your default setting.

Tip: Did you know you can change the appearance of the Waiting Room? See Customizing the Zoom Waiting Room Default Appearance for more information.

6. After you have scheduled and saved your meeting, the page will reload and show you the meeting summary screen. Select Copy Invitation to open the full invitation pop-up window.

7. Select Copy Meeting Invitation.

8. Paste the invite in a secure location (Moodle, Calendar Invite, Google Drive, email, etc) or, if necessary, somewhere public (see Meeting Link Sharing below).

Meeting Link Sharing Guidelines

Privately Sharing Meeting Links

The most secure way to share your Zoom meeting link is to send it directly to your participants or post it somewhere that only your intended participants can access. Moodle course pages, Slack workspaces and channels, Google Calendar invites, Google Drive folders, and email are all ways to share your meeting information with a controlled group.

In the unlikely event your meeting information spreads beyond your intended group of participants, there are in-meeting controls available to help prevent or manage Zoom attacks (intentional, unwanted, disruptive intrusion into a video conference call). You can read about in-meeting security controls in our Advanced Security Settings guide.

Publicly Sharing Meeting Links

You may want to advertise, publish, or post your meeting link somewhere public. Locations like eDigest, departmental or personal websites, and institutional or personal social media accounts are all ways of reaching large numbers of the community, but they are also public-facing forms of communication, which means anyone with internet access has the potential to find and gain access to your meeting.

With this in mind, it’s important to make sure your meeting has been secured for public posting. Only post publicly if you can answer “yes” to any one of the following criteria:

• The meeting has been set up with “Smith login required” authentication.

• The meeting has been set up to require registration AND you or an assistant are actively screening registrants before the meeting.

• The meeting has been set up with a Waiting Room AND you are confident in your ability or your assistant’s ability to monitor the Waiting Room and admitted participants for disruptive behavior.

If you are posting your meeting link publicly, we strongly recommend learning about the in-meeting security controls for preventing and managing Zoom attackers, as illustrated in our Advanced Security Settings guide.