Can I use the same Support account for customer support and HR, or any other sensitive / private team?

Question

Can I have customer-facing teams and internal teams with potentially sensitive tickets, such as Human Resources (HR) or Legal, work within the same Zendesk account?

Answer

It is possible to use the same Support account for both customer-facing agents and internal agents, but there are several privacy risks that should be considered, especially if the customer-facing agents will be submitting tickets to the internal team's agents as requesters (e.g., a customer support agent is submitting a ticket to their benefits coordinator). 

Zendesk is designed to allow all agents to view all tickets unless you specify otherwise. If you need to prevent agents from being able to access tickets assigned to certain groups, you can do so by modifying role permissions. 

If you are on the Enterprise or Enterprise Plus plan, you can designate a group as private to ensure that agents outside of the group can't access tickets assigned to it (although agents may be granted permission to view private tickets). A private ticket can't be viewed or searched for by agents who don't have access to it. See Essential facts for private ticket groups for more details.

If you are on the Professional, Growth, or Team plan, you can add agents to groups and restrict agents to only view tickets within their groups. This method of ticket restriction has the following limitations:

• If an agent needs to access tickets across multiple groups, they must be a member of all the necessary groups. When agents reassign a ticket outside of their groups, they can no longer access the ticket.
• Adding an agent as a CC on a ticket will grant them access to the ticket within the Support interface. This is expected behavior even if the CC’d agent does not belong to the ticket group.
• If an agent submits a ticket to an HR group as the requester, the agent is able to see all ticket fields and internal comments. This may be problematic if the assigned HR agent needs to add sensitive information about the requester.

For related issues, see the article below:

• How can I prevent agents in one group from seeing another group's tickets?

Click the following buttons to display a list of Pros and Cons for each option.   

Option 1: Keep HR and non-HR groups within the same Support account   Option 2: Split HR into a separate Support account  

Pros

Cons

Use one Support interface to manage all groups and departments. Easier SSO configuration. Some existing business rules, apps/app data, and administrative settings can be reused. Centralized reporting for all ticket activity. Consolidate internal knowledge within one Help Center. You can enable agents to manage and submit requests from Help Center, simulating certain parts of the end user experience.

All agents have access to internal comments and agent-only ticket fields. If an agent submits a ticket to HR they will be able to see all ticket fields and internal comments on their own ticket. If a restricted agent is added a CC or Follower to a ticket, the agent will gain access to that ticket regardless of their group. All administrators will have access to all data within the HR account. Maintenance of groups and custom role restriction can become unwieldy. Zendesk cannot “nest” custom roles. To enable non-HR agents to see all tickets except HR tickets, they may need multiple groups. First Reply Time SLAs will not apply to tickets created by non-HR agents.

Pros

Cons

Non-HR agents will not have access to agent-only ticket fields and internal comments in the HR account. Sensitive data will remain private when the HR agent uses an internal note. HR and non-HR workflows will remain completely separate. More flexibility for custom role permissions in both accounts, rather than requiring the “All within their groups” ticket access permission.

This option requires two Zendesk accounts. SSO (Single Sign-On) maintenance may be more complex because your SSO platform would need to be connected to multiple instances. For example, in account A your user might be an agent, but in account B the same user might be an end user. Some integrations may not function in multiple accounts. For example, a JIRA integration cannot integrate with two separate Zendesk accounts. End users must use separate help centers to manage their requests and view content. Some training may be required to help users differentiate between the two help centers if they use both accounts.

"At vero eos et accusamus et iusto odio dignissimos ducimus qui blanditiis praesentium voluptatum deleniti atque corrupti quos dolores et quas molestias excepturi sint occaecati cupiditate non provident, similique sunt in culpa qui officia deserunt mollitia animi, id est laborum et dolorum fuga. Et harum quidem rerum facilis est et expedita distinctio. Nam libero tempore, cum soluta nobis est eligendi optio cumque nihil impedit quo minus id quod maxime placeat facere possimus, omnis voluptas assumenda est, omnis dolor repellendus. Temporibus autem quibusdam et aut officiis debitis aut rerum necessitatibus saepe eveniet ut et voluptates repudiandae sint et molestiae non recusandae. Itaque earum rerum hic tenetur a sapiente delectus, ut aut reiciendis voluptatibus maiores alias consequatur aut perferendis doloribus asperiores repellat."