Announcing security improvement for CCs in follow-up tickets created via email

Announced on	Rollout starts	Rollout ends
February 10, 2022	April 12, 2022	April 12, 2022

Zendesk is changing the way CCs are added to follow-up tickets, to better align with security best-practices. Beginning April 12, 2022, only users added to an email that results in a new follow-up ticket will be listed as CCs. Any CCs in the closed ticket that aren't also added to the email will not be included in the new ticket.

This announcement includes these sections:

• Am I impacted?
• Before: CCs on follow-up tickets created via email
• After: CCs on follow-up tickets created via email
• What do I need to do?

Am I impacted?

This change impacts all accounts with the latest CCs functionality enabled.

Before: CCs on follow-up tickets created via email 

Currently, when follow-up tickets are created via email, the CCs on the follow-up ticket are copied over from the original ticket, independent of the CCs that were included on the email. This can present a security issue as it may give certain users access to information that the requester of the follow-up ticket didn’t intend for them to see. 

After: CCs on follow-up tickets created via email

Once this change occurs, new follow-up tickets created via email will be handled differently than existing follow-up tickets created via email, and follow-up tickets created via the Support UI and API. For example:

• Follow-up tickets created via after this change occurs
  
  Once this change occurs, new follow-up tickets created after Apr 12, 2022 will be populated with the CCs that were on the email that initiated the follow-up ticket. This will more accurately reflect the intention of the user sending the email.
  
  
• Follow-up tickets created via email before this change occurs
  
  Please note that the old functionality will remain in place for any follow-up tickets which are created before April 12, 2022. Therefore, all CCs from the original ticket will be copied to the follow-up ticket when it is created via email, including those that aren’t added to the email that generates the follow-up ticket.  The CCs from the original ticket will therefore have access to the information included in the follow-up ticket.
  
  It is currently not possible to delete the original CCs when a follow-up ticket is created via email. However, it is possible to edit the CCs when a follow-up ticket is created via the Support UI. Once a follow-up ticket is created, the agent has the ability to remove/add CCs on subsequent messages.
  
  
• Follow-up tickets created via the Support UI or API
  
  CCs functionality for follow-up tickets created in the Support UI and via API will remain the same.

What do I need to do?

If you have workflows that are dependent on follow-up tickets that are created by email having all of the CCs of the original ticket, you will need to ensure that the users sending in those emails use "Reply all" functionality or make sure they include all the CCs from the original ticket thread.

If you don't have these kinds of workflows, then no action is needed. This change will be a security improvement for new follow-up tickets created via email in the future. However, it’s a good idea to make sure that you understand how both new and existing follow-up tickets are going to be handled.