How can I prevent agents in one group from seeing another group's tickets?

Question

I want to be able to restrict agents so that they can only see tickets within their own groups. Is this possible?

Answer

There are two ways to implement such a workflow in your company.

Build one Zendesk account

Build two Zendesk accounts

Considerations

The primary benefit of building out your workflows on one Zendesk account is that you can keep all your agents in the same account. This can make administrative tasks easier and has the added benefit of not requiring another subscription. However, this option is not completely secure and there are ways that the separation can be circumvented. Depending on your use case the flexibility afforded by these workarounds may be desirable. These workarounds are noted in the article: Can I use the same Support account for customer support and HR workflows?

This solution keeps the admins under the same interface, managing all departments within the same account. However, each admin has access to data from all groups. In such a workflow, there is a lot of remediation and work to be done to keep the departments totally separated.

Finally, agents are treated as agents, which means that if the agent is the requester of a ticket of a different group, the system sends internal notes notifications for that ticket. Additionally, an agent is not able to request tickets through the Help Center because the ticket form is only available to end users.

To set up agent access restrictions

Create different groups and make sure agents can only see the tickets assigned to their groups.

When you add agents to groups, define their privileges on their profile page. One of those privileges is called Access. This defines the agent's access to tickets. Select Tickets in agent's groups.

Note: On Enterprise plans, you do not set agent ticket access in the user's profiles. Agent permissions are determined by the custom role you select for the agent. For more information, see the article: Custom agent roles.

Considerations

This is the most secure way to separate your agents and is the preferred method when data privacy is the biggest concern. It does require purchasing two subscriptions and may be a heavier lift to set up initially but is the most flexible solution in the long term because workflows can be easily changed. You simply set up your two Zendesk accounts independently.

If you need to share a ticket between two instances, set up a sharing agreement between both accounts. A sharing agreement grants another account permission to work on your tickets. Only shared tickets can be accessed by the other account. For more information, see the article: Sharing tickets with other Zendesk Support accounts.

For related issues, see the articles listed below:

• Multibrand: Restricting agents to specific brands (Enterprise)
• Workflow recipe: How can restricted agents assign tickets to agents outside of their groups?
• Agent group permissions and searching tickets
• Considering one or multiple Zendesk instances