Providing multiple sign-in options for team members and end users

As described in Configuring end-user access and sign-in, Zendesk offers multiple ways to authenticate team members and end users.

Because users may have different security requirements, Zendesk gives you the flexibility to allow multiple authentication methods for each type of user. For example, if you configured SAML SSO for team member sign-in, you can provide another authentication mechanism (such as email and password) if you have a subset of users who can’t sign in through SSO.

This article covers the following topics:

• Understanding the sign-in options
• Providing multiple sign-in options for team members
• Providing multiple sign-in options for end users

Related articles:

• Single sign-on (SSO) options in Zendesk
• Managing single sign-on (SSO) configurations
• Configuring end user access and sign-in

Understanding the sign-in options

When multiple authentication methods are active, you can configure the sign-in experience for each user type by selecting Let them choose or Redirect to SSO.

Redirect to SSO only allows users to authenticate using the primary SSO configuration. Users don’t see additional sign-in options, even if those authentication options are active.

Let them choose allows the user to sign in using any active authentication method.

Providing multiple sign-in options for team members

You can configure the sign-in experience so team members can choose how to sign in. For example, if you have both SAML SSO and Zendesk authentication active for team members, they would see a sign-in screen similar to the one below if you select Let them choose.

To provide multiple sign-in options for team members

1. To provide SSO as a sign-in option to team members, you must first add the SSO configuration to the Single sign-on page in Admin Center. See Enabling JWT SSO and Enabling SAML SSO.
2. In Admin Center, click Account in the sidebar, then select Security > Team member authentication.

   

3. To provide email address and password as a sign-in option to team members, select Zendesk authentication, then set the password security level.
4. To provide SSO as a sign-in option to team members:
   1. Select External authentication.
   2. Select Single sign-on (SSO).
   3. Select the SSO configurations (that you set up in step 1).
   4. If you selected more than one SSO configuration, select the Primary SSO.
5. For How team members sign in, select Let them choose.

   Selecting Redirect to SSO displays the primary SSO as the only available sign-in method.

6. Click Save.

Providing multiple sign-in options for end users

You can configure the sign-in experience so end users can choose how to sign in. For example, if you activated SAML SSO, Zendesk authentication, and social sign-ins for end users, they would see a sign-in screen similar to the one below if you select Let them choose.

To provide multiple sign-in options for end users

1. To provide JWT or SAML SSO as a sign-in option for end users, you must first add the SSO configuration to the Single sign-on page in Admin Center. See Enabling JWT SSO and Enabling SAML SSO.
2. In Admin Center, click Account in the sidebar, then select Security > End user authentication.

   

3. To provide email address and password as a sign-in option to end users, select Zendesk authentication and set the password security level.
4. Select the social logins you'd like to make available to end users.
5. To provide SAML or JWT SSO as a sign-in option to end users:
   1. Select External authentication.
   2. Select the SSO configurations (that you set up in step 1).
   3. If you selected more than one SSO configuration, select the Primary SSO.
6. For How end users sign in, select Let them choose.

   Selecting Redirect to SSO displays the primary SSO as the only available sign-in method.

7. Click Save.