Can I use the same Support account for customer support and HR, or any other sensitive private team?

Question

Can I have customer-facing teams and internal teams with potentially sensitive tickets, such as Human Resources (HR) or Legal, work within the same Zendesk account?

Answer

It's possible to use the same Support account for both customer-facing agents and internal agents, but there are several privacy risks that should be considered, especially if the customer-facing agents will be submitting tickets to the internal team's agents as requesters.

Zendesk is designed to allow all agents to view all tickets unless you specify otherwise. To prevent agents from being able to access tickets assigned to certain groups, modify their role permissions.

Depending on your account's plan, you can designate a group as private to ensure that agents outside of the group can't access tickets assigned to it. Agents who don't have access to a private ticket can't view it or search for it. Moreover, the agent requester, as an end user, won't see private comments or agent-only fields in the ticket.

If your account plan doesn't offer private groups, add agents to groups and restrict agents to only view tickets within their groups. This method of ticket restriction has the following limitations:

• If an agent needs to access tickets across multiple groups, they must be a member of all the necessary groups. When agents reassign a ticket outside of their groups, they can no longer access the ticket.
• Adding an agent as a CC on a ticket will grant them access to the ticket within the Support interface. This is expected behavior even if the CC’d agent does not belong to the ticket group.
• If an agent submits a ticket to an HR group as the requester, the agent is able to see all ticket fields and internal comments. This may be problematic if the assigned HR agent needs to add sensitive information about the requester.

For related issues, see the article below:

• How can I prevent agents in one group from seeing another group's tickets?

Click the following buttons to display a list of Pros and Cons for each option.

Option 1: Keep HR and non-HR groups within the same Support account Option 2: Split HR into a separate Support account

Pros

Cons

Use one Support interface to manage all groups and departments. Easier SSO configuration. Some existing business rules, apps, and administrative settings can be reused. Centralized reporting for all ticket activity. Consolidate internal knowledge within one help center. You can enable agents to manage and submit requests from help center, simulating certain parts of the end user experience.

If you are on the Professional, Growth, or Team plan, all agents have access to internal comments and agent-only ticket fields. If an agent submits a ticket to HR they will be able to see all ticket fields and internal comments on their own ticket. If a restricted agent is added a CC or follower to a ticket, the agent will gain access to that ticket regardless of their group. All admins have access to all data within the HR account. Maintenance of groups and custom role restrictions can become unwieldy. Zendesk cannot “nest” custom roles. To enable non-HR agents to see all tickets except HR tickets, they may need multiple groups. SLA for the first reply time doesn't apply to tickets created by non-HR agents.

Pros

Cons

Non-HR agents don't have access to agent-only ticket fields and internal comments in the HR account. Sensitive data remains private when the HR agent uses an internal note. HR and non-HR workflows remain completely separate. More flexibility for custom role permissions in both accounts, rather than requiring the “All within their groups” ticket access permission.

This option requires two Zendesk accounts. SSO (Single Sign-On) maintenance may be more complex because your SSO platform would need to be connected to multiple instances. For example, in account A your user might be an agent, but in account B the same user might be an end user. Some integrations may not function in multiple accounts. For example, a JIRA integration cannot integrate with two separate Zendesk accounts. End users must use separate help centers to manage their requests and view content. Some training may be required to help users differentiate between the two help centers if they use both accounts.

"At vero eos et accusamus et iusto odio dignissimos ducimus qui blanditiis praesentium voluptatum deleniti atque corrupti quos dolores et quas molestias excepturi sint occaecati cupiditate non provident, similique sunt in culpa qui officia deserunt mollitia animi, id est laborum et dolorum fuga. Et harum quidem rerum facilis est et expedita distinctio. Nam libero tempore, cum soluta nobis est eligendi optio cumque nihil impedit quo minus id quod maxime placeat facere possimus, omnis voluptas assumenda est, omnis dolor repellendus. Temporibus autem quibusdam et aut officiis debitis aut rerum necessitatibus saepe eveniet ut et voluptates repudiandae sint et molestiae non recusandae. Itaque earum rerum hic tenetur a sapiente delectus, ut aut reiciendis voluptatibus maiores alias consequatur aut perferendis doloribus asperiores repellat."