Unauthorized Access to Zoom Classes from Microsoft IPs

[LaDirection]

We have implemented a system where teachers receive an email with the Zoom class link 15 minutes before their scheduled class. Recently, many teachers have reported an issue where an unknown host joins their Zoom meeting, accepts participants, and then leaves the meeting shortly after without any further actions.

After thorough investigation, including scanning our web logs and checking the IP addresses of the participants, we found that all the unauthorized access attempts were coming from Microsoft IP addresses (potentially Safe Links or Microsoft 365 services). This was corroborated by a similar issue reported on  Reddit, where we identified matching IPs.

Additionally, our SendGrid logs confirmed that the Zoom links were clicked twice within a minute for all the affected users, which aligns with the issue timeline.

Request for Assistance:

We are seeking guidance on how to prevent these unauthorized accesses. Specifically:

1. How can we prevent Microsoft services from automatically accessing our Zoom links?
2. Are there any specific settings or configurations within Zoom or our email system that can help mitigate this issue?

Any assistance or recommendations would be greatly appreciated.

Thank you for your support.

[MGSR]

Hello @LaDirection,

Welcome to the Zoom Community! We greatly appreciate your contribution and we're glad to have you here.

I'm sorry for what happened on your meetings, we would advise to send a report to our Zoom's Trust & Safety team.
In this instance, kindly use Report Account Compromise.

We hope that this get's sorted out soon.

[LaDirection]

Btw ive opened a ticket and the support team just closed it without any reply ...

T&S0269833

[LaDirection]

Hello Mark,

Thank you for your prompt response and assistance.

I have opened a ticket as suggested. However, I would like to clarify that this issue does not appear to be a compromise in the traditional sense. Instead, it seems to be related to bots or automated services, possibly from Microsoft Safe Links or Microsoft 365, clicking on the Zoom links in our emails to verify their safety. This automated process results in unintended hosts joining our meetings.

This issue is affecting many of our accounts and could potentially happen to anyone using similar email security services.

Thank you for your continued support.