Setting the password security level

Fastpath: Admin Center > Account > Security

Zendesk provides the following levels of password security: low, medium, and high. You can specify your own custom password security level. Each level has stricter requirements for choosing passwords. You can set one password security level for end users, and a different one for team members (admins and agents). Only administrators can change the password security level.

Topics covered in this article:

• About password security levels
• Changing the password security level
• Allowing administrators to set passwords
• Setting session expiration
• Password security best practices

Note: You can use a single sign-on (SSO) solution instead of using Zendesk passwords. See SSO (single sign-on) options in Zendesk.

About password security levels

Zendesk provides the following password security levels:

Low - Each password must have at least 5 characters. This is the default security level.

Medium - Each password must have at least 6 characters and meet the following requirements:

• Includes numbers and mixed case letters
• Includes a special character that is not a letter or number

High - Each password must have at least 6 characters and meet the following requirements:

• Includes numbers and mixed case letters
• Includes a special character that is not a letter or number
• The password expires after 90 days and the new password must be different from the 5 previous passwords

Custom - Select Custom, then click Edit to set custom password requirements. Each password must meet the requirements that you set. This security level is available only for agents and admins. For example:

Most of the options are self-explanatory except for the following:

• Number of previous passwords to reject - New passwords must be different from the number of previous passwords you set.
• Failed attempts until lockout - If an end user or agent fails to enter their password correctly the number of times you specify in a row, they are locked out for a certain period of time. They cannot sign in again until the lockout expires.
• Maximum number of consecutive letters or numbers - The maximum number of sequential numbers and letters allowed in the password. For example, if you set the maximum to 4, then a password like admin12345, which has five sequential numbers, will be rejected. If you set the option to 5, then the password is accepted
• Password can resemble email - Controls whether new passwords can include parts of an email address. For example, when this setting is No, a user with a [e-mail] email address cannot include the word david as part of their password.

Zendesk enforces a 128 character limit for passwords. The limit on password length is a reliability measure to prevent a form of DoS attack called “long password denial of service.” To learn more about Zendesk security practices, visit our Security website.

Changing the password security level

You must be an administrator to change the password security level. If you increase the security level, all passwords, regardless of security level, are set to expire in 5 days. All end users and team members must change their passwords to comply with the new security level.

Increasing the password security level can cause some passwords to expire instantly. If a password is older than 90 days and the security level is increased to high (or a custom level with an expiration restriction), that password is considered expired.

Zendesk sends email notifications to administrators and agents three days before a password expires, and then on the day it expires.

To change the password security level

1. Open the password security settings for team members or end users.
   • In Admin Center, click Account in the sidebar, then select Security > Team member authentication.
   • In Admin Center, click Account in the sidebar, then select Security > End user authentication.

     The End users command is not available until you activate the Help Center. See Getting started with Guide.

2. Select a Password level, then click Save.

   You can set one password security level for end users and a different one for team members.

Allowing administrators to set passwords

Account owners can allow administrators to set passwords for users. However, Zendesk recommends that you leave this option disabled for security reasons. It prevents hackers from using social engineering techniques to deceive well-meaning people into providing confidential information. For example, one technique used by hackers is to repeatedly call or spoof-email a support center posing as a frustrated customer who forgot their password and is unable to recover it, and persisting until an agent has no choice but to change the password manually for the irate customer. Once the password is changed, the hacker has access to confidential information.

Note: Even if the option is disabled, admins can still reset passwords (as distinct from setting passwords). An email is sent to the user's registered email address containing a link that lets the user reset the password. See Resetting user passwords. If single sign-on (SSO) is enabled, admins can't send password-reset links to users.

You can also set user passwords through the API. See Set a User's Password in the developer docs.

To let administrators set passwords for users

1. In Admin Center, click Account in the sidebar, then select Security > Advanced.
2. On the Passwords tab, select Enable admins to set passwords.

   You must be the account owner to see this setting.

3. Click Save.

   When the administrator sets passwords for users, users receive an email letting them know the administrator has set their password.

Setting session expiration

You can set Zendesk to automatically sign out agents and other team members after a period of inactivity. Agents remain signed in as long as they actively use the product. Active use includes typing and clicking links.

To set the session expiration time

1. In Admin Center, click Account in the sidebar, then select Security > Advanced.
2. On the Authentication tab, set the Session expiration time.
3. Click Save.

Password security best practices

Consider posting an article on your Zendesk Support web portal to remind your agents and users about password best practices. Common recommendations include:

• Never use the same password for more than one account
• Never share your password
• Never write down your password
• Never communicate your password by telephone, email, or instant messaging
• Log off before leaving a computer unattended
• Change your password whenever you suspect it's been compromised

For more information on securing your private information, see General security best practices.