Managing 2-factor authentication

Have more questions? Submit a request

17 Comments

  • Jonathan Gadd
    Comment actions Permalink

    Thanks for this article

    0
  • Aleksander Moldrup Nielsen
    Comment actions Permalink

    Hello,

    Is it possible to require 2-factor authentication everytime by disabling the "Remember me/Dont ask the next 30 days" option?

    0
  • Stephen Fusco
    Comment actions Permalink

    Hello Aleksander, 

    By default, you only have to enter a passcode once every 30 days. Your agents can elect to use 2 factor authentication every time when using the same computer though. 

    To enter a passcode every time you sign in, uncheck the Don't ask again on this computer for 30 days option on the dialog box that prompts you for a passcode. This will require 2-factor authentication every time. This setting is up to the individual user to decide and there are no global controls for this. 

    You will always be required to use two factor authentication when using a new device though. 

    0
  • Hemlata Mansukhani
    Comment actions Permalink

    Hi,

    Password-based authentication to the Zendesk API will be disabled when two-factor authentication is required. - Is there a work around on this? I integrated Shippit t my Zendesk account and I stopped receiving emails after enabling 2FA.

    Thank you

     

    0
  • Adam L.
    Comment actions Permalink

    Hi Hemlata,

    You should still be able to use OAuth or an API key for this, more details can be found here:

    https://developer.zendesk.com/rest_api/docs/core/introduction#security-and-authentication

     

     

    0
  • David Rose
    Comment actions Permalink

    With GDPR around the corner, one of the things we have to ensure is the security of data - making sure that data isn't available to someone that doesn't need it.

    Unfortunately Zendesk has opened up a minefield for us. 
    Unless I'm mistaken there's no way for an agent to be logged out automatically after a period of inactivity - so if they forget to logout, any personal data in Zendesk is available to anyone that has access to that PC. 

    I thought that 2FA might address this, by insisting that users were validated on a regular basis, but it seems that the end user can just turn off 2FA on a device for 30 days - so if an agents laptop were stolen, the thief could have immediate access to any personal data stored in ZD.
    Additionally I'm surprised that the mobile app doesn't have any kind of "re-authorisation" - every other app I use that has access to personal data, has the option to re-authorise (via a pin or fingerprint) every time the app gets accessed by the user.

    What are others doing about this and what are ZD's recommendation ?

    1
  • Nicole - Community Manager
    Comment actions Permalink

    Hi David - 

    For the Zendesk response, please email your question to privacy@zendesk.com. Normally we don't like to make people switch channels for an answer, but since GDPR deals with legal compliance, our legal team has limited the scope of what we can answer about GDPR in the community and has asked that all GDPR-related questions be directed their way. 

    0
  • Helle Buhl
    Comment actions Permalink

    Hi David Rose

    Did you get an answer to your question about the Zendesk APP?

    I have the same worries that you have about the APP (and also about the 30-days)

    0
  • Jessie Schutz
    Comment actions Permalink

    Hi Helle!

    I'm going to make the same recommendation as Nicole made to David; send an email over to privacy@zendesk.com and they'll be able to address your specific concerns directly!

    0
  • Helle Buhl
    Comment actions Permalink

    I have got this information from legal:

     

    Daniele Longo (Zendesk Legal)

    Sep 12, 14:06 IST

    Dear Helle,

    I checked with the product team: the app, like many mobile apps, relies on the mobile user to gate access at the device level (i.e. passcode, biometrics, etc.). Our customer base are varied and not all have use cases which digest lots of sensitive info (beyond PII). The mobile app is also for Agent use only and can be restricted.

    However, there is no 2-factor authentication process as of today. Our product team is however investigating whether we should implement such measure in the future.

    Hope that helps.

    Best Regards,

    Daniele Longo

    0
  • Jessie Schutz
    Comment actions Permalink

    Thank you for coming back and sharing what you found out, Helle!

    0
  • Kate Rowe
    Comment actions Permalink

    Hello - I can't find the link to "Download 2fa status" on the relevant page in the Admin Centre.  Has this feature been removed for a reason ?

    0
  • Brett - Community Manager
    Comment actions Permalink

    Hey Kate,

    We actually have a note on this article that states 2FA Status feature is temporarily unavailable so you wouldn't see it on your end quite yet.

    This article will be updated once the feature is available again :) 

    Thanks!

    0
  • sebastian
    Comment actions Permalink

    Hello Zendesk,

    When will this be available again? This is somewhat a security issue. Even with the option enabled that enforces 2FA, it's not ensured because of he way zendesk integrated the session handling.

    Please push this through to the dev team, this is a security issue.

    Best regards,
    Sebastian

    0
  • Devan La Spisa
    Comment actions Permalink

    Hello Sebastian,

    We are still working on a solution regarding our 2FA being temporarily unavailable. Once we have this back online, this article will be updated, but in the interim, we appreciate your understanding. 

    0
  • Steve Schievelbein
    Comment actions Permalink

    Hello all...

    I am wanting to enable 2FA today on my platform today, but after reading this I need to know if 2FA is even available?

    Given that the last update above is 3 months old (and there is no mention here that its fixed yet as mentioned), can we get an update here is this is fixed/available now?

    Thanks,

    Steve

    0
  • Nicole - Community Manager
    Comment actions Permalink

    Hi Steve - 

    2FA is now available. 

    0

Please sign in to leave a comment.

Powered by Zendesk