You can provide your users with more options for signing in to Zendesk Support by allowing them to sign in using their existing social and business accounts. Social sign-ins include Facebook and Twitter and business sign-ins include Google and Microsoft. Agents and admins can only use business single sign-on. For information on other types of single sign-on options, see Single sign-on (SSO) options in Zendesk.
How social and business SSO works in Zendesk Support
Social and business single sign-on allows end users to access Zendesk using their Facebook, Twitter, Google, or Microsoft accounts. When you enable the SSO methods, a sign-in button will be added to your Help Center page.
Agents and admins only have access to either Google or Microsoft SSO methods. If Google or Microsoft is also enabled for end users, agents and admins can use the sign-in button on the Help Center page. If the method is not enabled for end users, agents and admins will need to click the I am an Agent link to use SSO.
Your users' social and business account sign-in credentials (username and password) are never shared with Zendesk. Only the primary email address contained in the social and business account is shared.
- Users select one of the social or business sign-on options on your Zendesk account sign-in page.
- Users will be redirected to their social or business sign in page and required to enter their credentials.
Note: If users are signing in with Microsoft, they can also use their Office365 credentials.
- If the credentials are valid, users will be redirected back to your Zendesk Support account.
- Zendesk will prompt the user to add an email to use as a contact.
- If the email address matches a user's email address in Zendesk Support, Zendesk will ask the user to enter their Zendesk password. After validated, the contact information is added to the user's profile.
- If the email address does not match a user in Zendesk Support, a new user will be created, and Zendesk will send a verification email. If the user is a duplicate of a pre-existing Zendesk Support user, you can merge the users (see Merging a user's duplicate account).
If your Zendesk Support instance is closed or restricted, and a user tries to sign in with a business or social account email that does not exist in Zendesk Support, their request to authenticate will be rejected. To enable a user to sign in with a social or business account that uses a different email, you will need to add the account email as a contact in Add contact on their user profile.
For more information on modifying a user's profile, see Updating your user profile and password.
After the one-time authorization is completed, the user is seamlessly signed in to Zendesk Support. On subsequent visits, if the user is already signed in to the account, they will be immediately signed in to Zendesk Support after they click the associated social or business sign-on button. If they aren't already signed in with the social or business account, they will be prompted to.
Enabling social and business SSO
You can enable social and business SSO, without any custom configuration. End users can use Twitter, Facebook, Google, and Microsoft. Agents and admins can only use either Google or Microsoft.
To enable social and business SSO
- In any product, click the Zendesk Products icon (
) in the top bar, then select Admin Center. - Click the Security icon (
) in the left sidebar, then click Staff members or End users. You can set different SSO permissions for both groups.
The End Users tab is not available until you activate the Help Center. See Getting started with Guide.
- Select each of the SSO options you want to enable.
- If you want all users to only use the single sign-on method, disable the Zendesk authentication option.
Warning: Disabling Zendesk authentication permanently deletes any Zendesk passwords on record within 24 hours.
- Click Save.
The sign-in links appear on your Help Center sign-in page.
9 Comments
Is there a way to see the users who specifically have signed up/in using social?
Hey Pedro! There is a way to see which users have social media contacts listed in their profile. Though this doesn't tell you how they logged in last, it would at least give you an idea of which users maybe have signed in via social media auth. You can see these contact methods as an example in step 6 under "How social and business SSO works in Zendesk Support" above.
The one wrinkle to this is that if your user submitted a request via Twitter, for example, you will see a user profile for that individual that has a Twitter handle listed as a contact method. In this particular case, this user never actually signed in, but the way they submitted a request allowed for the creation of a profile using their twitter handle. This is necessary to ensure when you respond to their ticket, the followup is sent appropriately.
Long-story short, there really is no way to see exactly which users have ever signed in via a social media authentication method. If you don't have any social media channels enabled for ticket submission, however, then you can safely assume that any social media contact information for users is the direct result of them using this sign-in method to access your Help Center.
Thanks a lot for the clarification, Dennis. Another question, please: is there a way to see who specifically used social auth in the Chat pre-form? I'd like to see if offering those options are useful or not.
If a user is signing in with Microsoft and their Office365 account password changes or their account is disabled by the organization's IT, will they be automatically logged out and unable to log back into Help Center?
Hi Justin,
If the SSO authentication fails, then the users will be unable to log in to Zendesk using it. I wouldn't describe it as automatic, but if they were logged in at the time that the information changed, then the next time their session refreshed they would be prompted to reauthenticate.
They might still be able to log in if they have a separate password set up within Zendesk, and are using the youraccountname.zendesk.com/access/normal path to try and log in as a backup (though they would need to be aware of that path as an option first).
Is it possible to allow end-users only the option to sign in with Social and business single sign-on (and not Zendesk sign-in)?
Hey Justin,
There's no way to toggle off the native Zendesk login and only use the social media single sign-on at this time. The only way to remove the native Zendesk login as an option is by setting up SSO for your end-users. More information on the different SSO options in our SSO (single sign-on) options in Zendesk article.
Hope this helps!
Hello
I try to use business SSO. The backend do th job...
But I need to get the JWT token sent back in my private app. How can I get this token ?
Hi Fabien!
Thanks for your question today! It looks like you have an open ticket about this one already, so I will let the advocate know! If you have any further questions, it will be a good idea to respond to his email.
Hope that helps.
Please sign in to leave a comment.