## TL;DR
Link the existing Zoom account to the identity source instead of creating a second one. Find the Zoom user created by personal signup or a previous employer sync, claim or update it under the corporate account where policy requires, set its external link from the SCIM mapping, and re-run sync for that user to confirm updates flow.

```text
Zoom account provisioning failed: user already exists error from SCIM sync
```

## Use this when
- Zoom SCIM provisioning reports the user already exists for hires who used Zoom before joining.
- The Zoom admin console shows an account with the hire corporate or former personal email.
- Other hires without prior Zoom history provision cleanly.

## Not for this skill when
- The error is a license type shortage in Zoom. Resolve license counts instead.
- Zoom SSO sign-in fails tenant-wide. Fix Zoom federation settings first.

## Steps
1. In the Zoom admin portal, search User Management for the hire email and any likely former email, and record the account status, license type, and whether it sits inside the corporate account or as an external associated account. Verify: the existing Zoom account location and state are known
2. Decide the account path with policy in mind: invite or claim the external account into the corporate account when the company manages Zoom centrally, or update the in-account record directly when it is already internal but unlinked. Avoid deleting an account that holds meeting history the hire needs. Verify: the chosen path follows the corporate Zoom policy
3. Align identifiers: set the Zoom user email to the exact corporate primary email from the HR source and ensure the SCIM mapping sends the stable source id the connector uses for matching, so the next sync updates rather than creates. Verify: the email and matching id in Zoom match the source values
4. Run the SCIM sync or on-demand provision for the single user from the identity platform and read the result detail, confirming the operation resolves as an update or link with no create attempted. Verify: the sync result for the user is successful
5. Confirm in Zoom that the user now shows the correct license type for the role, group membership, and sign-in method, and have the hire sign in through SSO once to validate the end state. Verify: the hire signs in with the expected license active
6. Sweep the Zoom account for other unlinked users whose emails match the corporate domain, link them in bulk, and add a pre-hire Zoom check for candidates known to come from Zoom-heavy employers. Verify: the sweep leaves no unmatched corporate-domain users

## Why it happens
Zoom accounts are global to an email identity in a way SCIM connectors do not expect: a hire who ever used Zoom personally or at a prior employer can already exist when the corporate SCIM create arrives. Zoom protects that existing identity and returns an exists error rather than letting a connector overwrite it. The corporate remedy is an account claim or link flow, not repeated creates. Once the SCIM matching identifier is stored on the Zoom user, later lifecycle events such as license changes and deactivation flow normally through the connector.

## Variants and edge cases
### User refuses the claim invitation
Explain that claiming moves management, not personal meeting content policies the company set. If they decline, provision a fresh account under the corporate email only after the old association is released.

### Vanity or PMI conflicts after linking
Personal meeting ids can collide with corporate patterns. Reset the PMI under the corporate standard after linking and notify the hire.

### License downgrade after claim
Claiming can reset the license to the account default. Reapply the role license immediately after the claim completes and verify it sticks through a sync.

Compatibility: Applies to Zoom Workplace accounts with SCIM provisioning from Okta or Entra ID. Requires Zoom account admin access.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_9aYh5FfO3RKWyNI3c05OtA