Managing 2-factor authentication

Return to top
Have more questions? Submit a request

22 Comments

  • Jonathan Gadd

    Thanks for this article

    0
  • Aleksander Moldrup Nielsen

    Hello,

    Is it possible to require 2-factor authentication everytime by disabling the "Remember me/Dont ask the next 30 days" option?

    0
  • Stephen Fusco

    Hello Aleksander, 

    By default, you only have to enter a passcode once every 30 days. Your agents can elect to use 2 factor authentication every time when using the same computer though. 

    To enter a passcode every time you sign in, uncheck the Don't ask again on this computer for 30 days option on the dialog box that prompts you for a passcode. This will require 2-factor authentication every time. This setting is up to the individual user to decide and there are no global controls for this. 

    You will always be required to use two factor authentication when using a new device though. 

    0
  • Hemlata Mansukhani

    Hi,

    Password-based authentication to the Zendesk API will be disabled when two-factor authentication is required. - Is there a work around on this? I integrated Shippit t my Zendesk account and I stopped receiving emails after enabling 2FA.

    Thank you

     

    0
  • Adam L.

    Hi Hemlata,

    You should still be able to use OAuth or an API key for this, more details can be found here:

    https://developer.zendesk.com/rest_api/docs/core/introduction#security-and-authentication

     

     

    0
  • David Rose

    With GDPR around the corner, one of the things we have to ensure is the security of data - making sure that data isn't available to someone that doesn't need it.

    Unfortunately Zendesk has opened up a minefield for us. 
    Unless I'm mistaken there's no way for an agent to be logged out automatically after a period of inactivity - so if they forget to logout, any personal data in Zendesk is available to anyone that has access to that PC. 

    I thought that 2FA might address this, by insisting that users were validated on a regular basis, but it seems that the end user can just turn off 2FA on a device for 30 days - so if an agents laptop were stolen, the thief could have immediate access to any personal data stored in ZD.
    Additionally I'm surprised that the mobile app doesn't have any kind of "re-authorisation" - every other app I use that has access to personal data, has the option to re-authorise (via a pin or fingerprint) every time the app gets accessed by the user.

    What are others doing about this and what are ZD's recommendation ?

    1
  • Nicole S.
    Zendesk Community Team

    Hi David - 

    For the Zendesk response, please email your question to privacy@zendesk.com. Normally we don't like to make people switch channels for an answer, but since GDPR deals with legal compliance, our legal team has limited the scope of what we can answer about GDPR in the community and has asked that all GDPR-related questions be directed their way. 

    0
  • Helle Buhl

    Hi David Rose

    Did you get an answer to your question about the Zendesk APP?

    I have the same worries that you have about the APP (and also about the 30-days)

    0
  • Jessie Schutz
    Zendesk team member

    Hi Helle!

    I'm going to make the same recommendation as Nicole made to David; send an email over to privacy@zendesk.com and they'll be able to address your specific concerns directly!

    0
  • Helle Buhl

    I have got this information from legal:

     

    Daniele Longo (Zendesk Legal)

    Sep 12, 14:06 IST

    Dear Helle,

    I checked with the product team: the app, like many mobile apps, relies on the mobile user to gate access at the device level (i.e. passcode, biometrics, etc.). Our customer base are varied and not all have use cases which digest lots of sensitive info (beyond PII). The mobile app is also for Agent use only and can be restricted.

    However, there is no 2-factor authentication process as of today. Our product team is however investigating whether we should implement such measure in the future.

    Hope that helps.

    Best Regards,

    Daniele Longo

    0
  • Jessie Schutz
    Zendesk team member

    Thank you for coming back and sharing what you found out, Helle!

    0
  • Kate Rowe

    Hello - I can't find the link to "Download 2fa status" on the relevant page in the Admin Centre.  Has this feature been removed for a reason ?

    0
  • Brett Bowser
    Zendesk Community Team

    Hey Kate,

    We actually have a note on this article that states 2FA Status feature is temporarily unavailable so you wouldn't see it on your end quite yet.

    This article will be updated once the feature is available again :) 

    Thanks!

    0
  • Sebastian

    Hello Zendesk,

    When will this be available again? This is somewhat a security issue. Even with the option enabled that enforces 2FA, it's not ensured because of he way zendesk integrated the session handling.

    Please push this through to the dev team, this is a security issue.

    Best regards,
    Sebastian

    0
  • Devan - Community Manager
    Zendesk Community Team

    Hello Sebastian,

    We are still working on a solution regarding our 2FA being temporarily unavailable. Once we have this back online, this article will be updated, but in the interim, we appreciate your understanding. 

    0
  • Steve Schievelbein

    Hello all...

    I am wanting to enable 2FA today on my platform today, but after reading this I need to know if 2FA is even available?

    Given that the last update above is 3 months old (and there is no mention here that its fixed yet as mentioned), can we get an update here is this is fixed/available now?

    Thanks,

    Steve

    0
  • Nicole S.
    Zendesk Community Team

    Hi Steve - 

    2FA is now available. 

    0
  • John

    Dear All,

     

    We enabled 2fa and some of my users added the 2fa to DUO app. for some reason they delete the account on the app and now they cant re-add the account as the QR code is not popping up again. is there a way to reset the process so they can start the account adding again?

     

    Regards

     

    Steve

    0
  • JSR

    Is there a way to turn off the possibility for agents to turn off 2FA every time when logging in? This is really a problem for us for security concerns. 

    0
  • Sebastian

    I asked the same, there is no way, the session is just very long. At least the 2FA enforcement helps with computers that aren't used by agents but the agent computers itself should be encrypted to prevent access. And agent rights restricted through roles.
    But yes, not very optimal right now.

    0
  • Eric

    We are just starting to have our agents use MFA. I don't see any options for an admin to disable MFA for a user having an issue logging in. So recovery codes being the only option I see, must be fool proof?

    Also after a user has setup MFA themselves, if they do the process again and pick a different option like wanting to switch which phone app they use or switch from phone app to SMS messaging, does it automatically disable the previous method? If not that could get messy. 

    Thanks,

    0
  • Devan - Community Manager
    Zendesk Community Team

    Hello Eric, 

    Right now as the base product stands this is not possible. I would recommend posting this is our product feedback forums so our developers can consider this for a future update. 

    Best regards. 

    0

Please sign in to leave a comment.

Powered by Zendesk