Enabling social and business single sign-on (SSO)

Fastpath: Admin Center > Account > Security

You can provide your users with more options for signing in to Zendesk Support by allowing them to use their existing social and business accounts.

• Agents and admins can use either Google or Microsoft (Azure Active Directory and Office 365) SSO methods to sign into their business accounts.
• End users can use Twitter, Facebook, Google, and Microsoft SSO methods using their social/personal accounts.

Note: End users can only use Microsoft SSO if their Microsoft identity is from a personal Microsoft account (services like Xbox, Teams for Life, or Outlook). End users who attempt to sign in with an Azure identity won't be able to authenticate. You can enable SAML-based SSO for your end users if you wish to allow that option.

This article covers the following topics:

• How social and business SSO works
• Enabling social and business SSO
• First authentication process

Related articles:

• Single sign-on (SSO) options in Zendesk
• Does Zendesk Support integrate with Azure Active Directory SSO?
• Giving users different ways to sign into Zendesk

How social and business SSO works

Social and business single sign-on allows team members to access Zendesk using their Google or Microsoft business accounts, and end users to access Zendesk using their personal Facebook, Twitter, Google, or Microsoft accounts. When you enable these SSO methods, a sign-in button is added to your help center page.

In the example below, the end user can log in using any of their personal Twitter, Facebook, Google, or Microsoft accounts.

Your users' social and business account sign-in credentials (username and password) are never shared with Zendesk. Only the primary email address contained in the social and business account is shared.

Enabling social and business SSO

You can enable social SSO (for end users) and business SSO (for team members) without any custom configuration. To learn more about how the authentication process works after you enable, see First authentication process.

To enable business SSO for team members

1. In Admin Center, click Account in the sidebar, then select Security > Team member authentication.
2. Select External authentication to display options for third-party sign-in services.
3. Select the business accounts you'd like to allow the team member to sign in with: Google or Microsoft.
4. If you selected Microsoft, you must provide the tenant IDs for the Azure Active Directory tenants that are permitted to access your Zendesk account (also required for Office 365). In the Allowed tenant IDs field, type the tenant IDs, separated with spaces.
5. Click Save.

To enable social SSO for end users

1. In Admin Center, click Account in the sidebar, then select Security > End user authentication.

   The End users command is not available until you activate your help center. See Getting started with Guide.

2. Select each of the SSO options you want to enable.

   If you selected Microsoft, your end users will be able to sign in with Microsoft identities, which are managed through a personal Microsoft account (for instance, services like Xbox, Teams for Life, or Outlook).

3. Click Save.

The sign-in links appear on your help center sign-in page.

Note: If your SSO service goes down or you are locked out, you can still access your account using the Zendesk SSO bypass functionality.

First authentication process

When you enable social and business SSO options, a user's first authentication process will follow the sequence below:

1. Users select one of the social or business sign-on options on your Zendesk account sign-in page.
2. Users will be redirected to their social or business sign-in page and must enter their credentials.
3. If the credentials are valid, users will be redirected back to your Zendesk Support account.
4. If the email address matches a user's email address in Zendesk, Zendesk will ask the user to enter their Zendesk password. After validated, the contact information is added to the user's profile.
5. If the email address does not match a user in Zendesk, a new user will be created, and Zendesk will send a verification email. If the user is a duplicate of a pre-existing Zendesk user, you can merge the users (see Merging a user's duplicate account).

   If your Zendesk account is closed or restricted, and a user tries to sign in with a business or social account email that does not exist in Zendesk, their request to authenticate will be rejected. To enable a user to sign in with a social or business account that uses a different email, you will need to add the account email as a contact in Add contact on their user profile.

   

   For more information on modifying a user's profile, see Managing end users.

   After the one-time authorization is completed, the user is seamlessly signed in to Zendesk. On subsequent visits, if the user is already signed in to the account, they will be immediately signed in to Zendesk after they click the associated social or business sign-on button. If they aren't already signed in with the social or business account, they will be prompted to.