Setting the password security level

What's my plan?

Quick Look: Admin Center > Account > Security

A password security level refers to the strength or complexity of a password. Zendesk provides the following levels of password security: Recommended, High, Medium, and Low. You can set one password security level for end users and a different one for team members.

Zendesk strongly suggests setting the Recommended password security level for both team members and end users. This security level is configured with strict password requirements, checks against known breached passwords, and is based on security best practices and industry standards.

You can also create a custom password security level for team members (admins and agents) if your requirements differ for these users.

This article covers the following topics:

• About password security levels
• Changing the password security level
• Setting a custom password security level for team members
• Allowing administrators to set passwords
• Setting session expiration
• Password security best practices

Note: You can use a single sign-on (SSO) solution instead of Zendesk passwords. See SSO (single sign-on) options in Zendesk.

About password security levels

Many organizations require complex passwords as part of their security policies. Certain regulations, such as the General Data Protection Regulation (GDPR), require organizations to take steps to ensure the security of personal data, which includes using complex passwords.

Zendesk strongly suggests setting the Recommended password security level for both team members and end users to safeguard your account.

When the Recommended password security level is in place, passwords do not expire. However, passwords must meet the following requirements:

• Must be at least 12 characters
• Must include uppercase and lowercase letters (a-z and A-Z)
• Must include a number (0-9)
• Must include a special character (!, @, #, %, etc.)
• Must not include the word "Zendesk"
• Must not resemble an email address
• Must pass a check against a list of known breached passwords
• Five attempts are allowed before a temporary 10-minute lockout

The Low, Medium, and High password security levels have lower security requirements. Zendesk recommends changing the security level to Recommended if you are using any of these other levels.

You can review the password requirements for the currently selected security level on the team member or end user authentication page.

The Custom security level is available only for team members and can be used if the Recommended password security level doesn't meet your requirements. See Setting a custom password security level for team members.

Note: Zendesk enforces a 72-character limit for all passwords. The limit on password length is a reliability measure to prevent a form of DoS attack called “long password denial of service.” To learn more about Zendesk security practices, visit our Security website.

Changing the password security level

You must be an administrator to change the password security level. When you increase the security level (for example, Medium to Recommended), all passwords, regardless of security level, are set to expire in 5 days. All end users and team members must change their passwords to comply with the new security level.

Increasing the password security level can cause some passwords to expire instantly. If a password is older than 90 days and the security level is increased to a level with an expiration restriction, that password is considered expired.

Zendesk sends email notifications to administrators and agents three days before a password expires, and then on the day it expires.

If you change the security level from Low, Medium, or High to either Recommended or Custom, you can't revert back. You will receive the following message after you click Save.

You can change between the Low, Medium, and High levels and revert back if needed.

To change the password security level

1. Open the password security settings for team members or end users.
   • In Admin Center, click Account in the sidebar, then select Security > Team member authentication.
   • In Admin Center, click Account in the sidebar, then select Security > End user authentication.

     The End users command is not available until you activate the help center. See Getting started with Guide.

2. Select a Password level, then click Save.
3. If the Low, Medium, or High password security level was previously set and you are changing to Custom or Recommended, you'll receive a message that the previous levels will no longer be available. Click Save to confirm.

Setting a custom password security level for team members

If the Recommended password security level doesn't meet your company's specific requirements for team members, you can create a custom password security level.

Note: Changes to a custom password security policy won't impact expiration rules for existing passwords. For example, if you change your password expiration from 30 days to Never, passwords for current users will still expire after 30 days. When they reset their password, the new expiration rule is applied.

Most of the custom options are self-explanatory except for the following:

• Number of previous passwords to reject - New passwords must be different from the number of previous passwords you set.
• Failed attempts until lockout - If an end user or agent fails to enter their password correctly the number of times you specify in a row, they are locked out for a certain period of time. They cannot sign in again until the lockout expires.
• Max number of consecutive letters or numbers - The maximum number of sequential numbers and letters allowed in the password. For example, if you set the maximum to 4, then a password like admin12345, which has five sequential numbers, will be rejected. If you set the option to 5, then the password is accepted
• Password can resemble email - Controls whether new passwords can include parts of an email address. For example, when this setting is No, a user with a [e-mail] email address cannot include the word david as part of their password.

To set a custom password security level for team members

1. In Admin Center, click Account in the sidebar, then select Security > Team member authentication.
2. Select Custom in the Password level drop-down.
3. Click the Edit link to set password requirements.
4. Select your custom password requirements.

   

5. Click Set.
6. Click Save.
7. If the Low, Medium, or High password security level was previously set for team members, you'll receive a message that these levels will no longer be available. Click Save to confirm.

Allowing administrators to set passwords

Account owners can allow administrators to set passwords for users. However, Zendesk recommends that you leave this option disabled for security reasons. It prevents hackers from using social engineering techniques to deceive well-meaning people into providing confidential information.

For example, one technique used by hackers is to repeatedly call or spoof-email a support center posing as a frustrated customer who forgot their password and is unable to recover it, and persisting until an agent has no choice but to change the password manually for the irate customer. Once the password is changed, the hacker has access to confidential information.

Note: Even if the option is disabled, admins can still reset passwords (as distinct from setting passwords). An email is sent to the user's registered email address containing a link that lets the user reset the password. See Resetting user passwords. If single sign-on (SSO) is enabled, admins can't send password-reset links to users.

You can also set user passwords through the API. See Set a User's Password in the developer docs.

To let administrators set passwords for users

1. In Admin Center, click Account in the sidebar, then select Security > Advanced.
2. On the Passwords tab, select Enable admins to set passwords.

   You must be the account owner to see this setting.

3. Click Save.

   When the administrator sets passwords for users, users receive an email letting them know the administrator has set their password.

Setting session expiration

You can set Zendesk to automatically sign out agents and other team members after a period of inactivity. Agents remain signed in as long as they actively use the product. Active use includes typing and clicking links.

To set the session expiration time

1. In Admin Center, click Account in the sidebar, then select Security > Advanced.
2. Click the Authentication tab.
3. Set the Session expiration time for team members and end users.
4. Click Save.

Password security best practices

Consider posting an article on your Zendesk Support web portal to remind your agents and users about password best practices. Common recommendations include:

• Never use the same password for more than one account.
• Never share your password.
• Never write down your password.
• Never communicate your password by telephone, email, or instant messaging.
• Log off before leaving a computer unattended.
• Change your password whenever you suspect it's been compromised.

For more information on securing your private information, see General security best practices.