Managing security settings in Admin Center

Fastpath: Admin Center > Security

Admin Center lets you manage how you authenticate users. You can use Zendesk's own user authentication (the standard sign-in process) or you can remotely authenticate users using single sign-on (SSO) and then seamlessly sign them in to Zendesk. You can also let users sign in using popular business or social authentication services such as Google, Microsoft, Facebook, or Twitter.

In Admin Center, an end user is any user receiving customer service. If you enable authentication for end users, they'll need to sign in to submit or track their tickets in Help Center. See Configuring end-user access and sign-in in the Support Help Center.

The authentication options for end users apply to Help Center only. To authenticate end users who use the Chat or Web widgets, see Enabling authenticated visitors in the Chat widget or Enabling authenticated visitors in the integrated Web Widget.

A staff member in Admin Center is any user providing customer service, not a person receiving it. A staff member is usually an admin, agent, or account owner. A staff member may also be an employee who has been assigned a custom role.

Topics covered in this article:

• Accessing the security settings from Admin Center
• Enabling Zendesk authentication
• Disabling Zendesk authentication
• Enabling social and business single sign-on (SSO)
• Enabling enterprise single sign-on (SSO)

If you use Zendesk authentication, you can manage additional security settings. See the following topics:

• Restricting access by IP addresses
• Sending password-change notifications
• Requiring 2-factor authentication
• Setting an inactivity time-out period

An alternative to Zendesk authentication is single sign-on (SSO). SSO lets users sign in once to gain access to multiple systems and service providers, including Zendesk Chat. To learn more, see SSO (single sign-on) options in Zendesk in the Support Help Center.

To help Zendesk troubleshoot an issue in your account, you can let a Zendesk agent assume the role of agent in your account for a specified time. See Allowing Zendesk to assume the role of agent.

Accessing the security settings from Admin Center

To access the security settings from Admin Center

1. In any product, click the Zendesk Products icon () in the top bar, then select Admin Center.
2. In Admin Center, click the Security icon () in the left sidebar.
3. Select one of the security options.

Note: Security settings for Support, Chat, Guide and Talk are managed in Admin Center. If you are using Chat legacy versions, security settings are managed from the Chat dashboard. Select Settings > Account, then click the Security tab.

Enabling Zendesk authentication

You can use Zendesk authentication (the standard sign-in process) for staff members and end users. Zendesk authentication is enabled by default.

For end users, the following conditions must be met before they can use Zendesk authentication:

• Help Center must be activated. Help Center is the only publicly accessible side of Support and Chat for end users. See Getting started with Guide in the Support Help Center.
• End users must register. After registering, an end user is prompted to verify their email address and create a password, which the user can then use to sign in. See Requiring your users to register in the Support Help Center.

To enable Zendesk authentication

1. In Admin Center, click the Security icon () in the left sidebar.
2. Click the Staff Members or End Users tab.

   You can set one sign-in option for staff members and a different one for end users.

   The End Users tab is not available until you activate the Help Center. See Getting started with Guide.

3. Make sure Zendesk Authentication is selected.

   The option is selected by default.

4. Set the password security level.

   See Setting the password security level in the Support Help Center.

5. Click Save.

If you enable Zendesk authentication, you can manage the following additional settings:

• Restricting access by IP addresses
• Sending password-change notifications
• Requiring 2-factor authentication
• Setting an inactivity time-out period

Disabling Zendesk authentication

In some cases, you may choose to disable Zendesk authentication and use another authentication method, such as SSO, for staff members and end users.

Warning: Disabling Zendesk authentication permanently deletes any Zendesk passwords on record within 24 hours. We recommend keeping Zendesk authentication enabled as a backup for staff members in case your other authentication method fails.

To disable Zendesk authentication

1. In Admin Center, click the Security icon () in the left sidebar.
2. Click the Staff Members or End Users tab.
3. Deselect Zendesk Authentication.
4. Click Save.

If you're disabling Zendesk authentication for end users, also do the following:

1. In Support, click the Admin icon () in the sidebar, then select Settings > Customers.
2. Determine if you want to enable or disable the Anybody can submit tickets setting.

   Typically, when Zendesk authentication is disabled for end users, you would disable this setting also to keep unauthenticated end users from submitting tickets. But if you want end users to send email to their support addresses without allowing them to login in anywhere, leave this setting enabled.

   If you disable Zendesk authentication for end users, but you still have Anyone can submit tickets enabled, end users will not see a sign up page when they submit a ticket. Instead, they are redirected back to the Help Center home page.

3. Save your changes.

Enabling social and business single sign-on (SSO)

Users can sign in to Zendesk using their credentials for certain social and business accounts. The social accounts are Facebook and Twitter. The business accounts are Google and Microsoft.

End users can use all four – Twitter, Facebook, Google, and Microsoft. Staff members can only use Google or Microsoft.

To learn more, see SSO (single sign-on) options in Zendesk in the Support Help Center.

To enable social and business single sign-on

1. In Admin Center, click the Security icon () in the sidebar.
2. Click the Staff Members or End Users tab.

   The End Users tab is not available until you activate the Help Center. See Getting started with Guide.

3. Select the social or business SSO option you want to enable.
4. If you want users to use only the SSO option, disable the Zendesk Authentication option.
   Warning: Disabling Zendesk authentication permanently deletes any Zendesk passwords on record within 24 hours. API requests using an email address and password combination will also fail for both agents and end users.
5. Click Save.

Enabling enterprise single sign-on (SSO)

Zendesk supports two enterprise single sign-on solutions:

• Secure Assertion Markup Language (SAML) SAML is supported by many identity provider services, such as Okta, OneLogin, Active Directory, and LDAP. For information on configuring SAML single sign-on, see Enabling SAML single sign-on.
• JSON Web Token (JWT) Credentials and user information is sent in JSON format encrypted using a Zendesk shared secret. For information on configuring JWT single sign-on, see Enabling JWT (JSON Web Token) single sign-on.

To learn more, see Enterprise single sign-on in the Support Help Center.

You can enable SAML or JWT single sign-on only for staff members, only for end users, or for both groups.

To enable SAML or JWT single sign-on

1. In Admin Center, click the Security icon () in the sidebar.
2. Click the SSO tab.
3. Click the Configure link of one of the SSO options and enter the configuration information.
   For details, see the following topics:

   • Enabling SAML SSO
   • Enabling JWT SSO
4. After configuring your SSO option, click the Staff members or End users tab and select the External authentication option if not already selected.
5. If you want all users to only use the single sign-on method, deselect the Zendesk authentication option.

   Any Zendesk passwords will be permanently deleted from the account within 24 hours.

6. Select the Single sign-on option in the External authentication section.

   For end users, selecting the SSO option deselects the Zendesk Authentication option if enabled.

   Warning: Disabling Zendesk authentication permanently deletes any Zendesk passwords on record within 24 hours.
7. Click Save.

Restricting access by IP addresses

If Zendesk authentication is enabled, you can restrict users from specific IP addresses from accessing your account. For example, to restrict access to users in your company, specify the IP addresses of your company. You can also allow end users to bypass the restrictions. IP restrictions that you manage in Admin Center apply to sign in for all products.

Enabling IP-based access restrictions can break third-party integrations that access your account. Make sure to whitelist all external IPs that access your account through the Zendesk APIs. Some integrations use variable IP addresses that can't be whitelisted. If you want to use these integrations, you must disable IP restrictions.

You can specify ranges of IP addresses, separating each range with a space. Two methods are available to specify a range. The first is to use asterisk (*) wildcards. An IP address consists of four numbers separated by periods, such as 192.168.0.1. You can substitute a single asterisk character (*) for any number group to let Zendesk know that it should accept any value in that space. For example, 192.*.*.* allows any IP address whose first number is 192.

The second way to specify an IP range is to use IP subnet mask syntax. For example, 192.168.1.0/25 specifies all the IP addresses between 192.168.1.0 and 192.168.1.127.

You cannot specify IP ranges where the CIDR (Classless Inter-Domain Routing) value is 0. For example, if you specify 10.0.0.0/0, the /0 is a valid format, but it's not accepted by Zendesk.

Note: For Zendesk Sell customers, IP restrictions are applied only for customers who access the product with a Zendesk sign in. IP restrictions are not applied to standalone Zendesk Sell accounts or any Zendesk Sell interfaces or APIs.

To set IP restrictions

1. In Admin Center, click the Security icon () in the sidebar.
2. Click the Advanced tab.
3. In the IP Restrictions section, select Enabled, then enter the Allowed IP Ranges you want to restrict.
4. If you don't want the IP restrictions to apply to end users, make sure Customers can bypass restrictions is selected.
5. Click Save.

For more information, see Restricting access to Zendesk Support using IP restrictions.

Sending password-change notifications

If Zendesk authentication is enabled, you can send email notifications to staff members and end users when their passwords change.

To send password-change notifications

1. In Admin Center, click the Security icon () in the sidebar.
2. Click the Advanced tab.
3. In the Passwords section, select Password Notifications.
4. Click Save.

Requiring 2-factor authentication

If Zendesk authentication is enabled, you can require staff members to use 2-factor authentication when they sign in. Once this setting enabled, all staff members will be required to set up 2-factor authentication the next time they sign in. For instructions for your staff, see Using 2-factor authentication.

To require 2-factor authentication

1. In Admin Center, click the Security icon () in the sidebar.
2. Click the Advanced tab.
3. In the Authentication section, select Require two-factor authentication.
4. Click Save.

For more information, see Managing 2-factor authentication.

Setting an inactivity time-out period

If Zendesk authentication is enabled, you can set an inactivity time-out period. If a staff member is inactive for the specified period, the staff member is signed out. Staff members remain signed in as long as they actively use the product. Active use includes typing and clicking links. See Understanding your Zendesk session time. 

To set an inactivity time-out period

1. In Admin Center, click the Security icon () in the sidebar.
2. Click the Advanced tab.
3. In the Authentication section, select a time-out period under Session expiration.
4. Click Save.

Note: Managing the inactivity time-out period is important. To better align with security best practices, you can't allow staff members to stay signed in. The Stay signed in option for staff members is no longer available as of November 9, 2020.