Restrict meeting participants by source IP range - native client, external participants

API and Webhooks Authentication
1

We run sessions for external participants (no accounts on our Zoom account) who
attend from physical centres with known allowed public IP ranges. Compliance
requires participants to only join from those IP ranges. We must use the
native Zoom client (Web SDK doesn’t meet our needs).

We authenticate via external SSO before Zoom, and we already enforce a
per-user device/session limit (a second join with the same identity is
rejected with an “already joined” type message).

Despite this, participants bypass the restriction like so:

  1. Learner A (at an allowed-IP centre) authenticates using Learner B’s credentials,
    producing a valid join link tied to Learner B’s identity.
  2. Learner A then joins the meeting using Learner A’s own link/identity
    (from the allowed centre IP).
  3. Learner B, at home (outside allowed IP ranges), uses the link tied to
    B’s own credentials and joins successfully.

Because each person uses a different identity’s session, our per-user device limit
is never exceeded, and Learner B joins from a non-allowed network. Our pre-Zoom SSO/IP
gate can’t stop this since Learner B connects directly to Zoom.

We’ve also observed the post-authentication join link keeps working for roughly
5–10 minutes before it re-triggers the SSO flow.

Questions:

On controlling the auth/join link:

  1. Is there any way to re-trigger the SSO/authentication flow on every join
    (so the post-auth link cannot be reused at all)?
  2. Is there any way to control or reduce the expiry time of the authenticated
    join link/token, so the reuse window is shorter than the ~5–10 minutes we see?
  3. Is there any other setting to control the reusability of this post-auth link?

On IP restriction:
4. Is there any native Zoom setting to restrict participants by source IP range
at join time?
5. Does Meeting Connector (firewalled to our IP ranges) enforce IP on the
participant join path and stop the scenario mentioned above?
6. Any known bypasses (dial-in, mobile, already signed-in)?

We’re on Business tier - is Meeting Connector available at this tier or is an
upgrade required?