Light Agents Can Create Users and CCs by Email?


  • Jessie Schutz
    Zendesk team member

    Hey Marci!

    I need to refresh my memory on the way this stuff works...I seem to remember that there was some discussion about this a while back, but I don't recall what we ultimately decided the expected behavior was in this situation. I'll do some poking around and see what I can find out!

  • Joel Hellman

    What confuses me here is that light agents are not supposed to be able to create CCs or add users, and it seems this one was able to do both. Is it because those were included in the original email she sent?

    Marci, there is a setting at Settings > Tickets > CCs > Only agents can add CCs, that controls if agents can add CCs. Light agents count as Agents in this context, so they can add CCs. 

    Another possible source of confusion here is that even if you disable both agent CCs and all CCs on the account (=Enable CCs on tickets), any previously unknown email addresses either on to or CC at the time anyone replies towards Zendesk will still technically create End-user profiles in your account. 

    However, based on your CC settings and the role (agent or not) of the email that replies, those new End-users will not get added as a CC on the ticket. And even if these End-user profile are added to Zendesk, there will be no ticket history on them (neither as requester or CC:d party). 

  • Marci Abraham

    Thanks for the insight. So I checked here:

    Settings > Tickets > CCs > 

    and I've got both checked:

        > Enable CCs on tickets

         > Only agents can add CCs

    .... so that means my light agent can add CCs.

    But I'm still confused as to how adding this person as a CC also created her as a user. Is that what's supposed to happen?

    I think the reason this really caught my attention (and probably amounts to a separate question......) is that I have a FULL agent, who constantly tells me she "can't add users" so when she wants to CC someone, she has to assign the ticket to me, I create the user, then I assign it back to her.

    Her role in Zendesk is a custom one, which I named "Group Lead" because she has a bit more permissions than others in her group. But I don't see anywhere in the Role settings that says she "can't" add users. Maybe that setting is somewhere else?

    The other difference between the full agent (who can't add users) and the light agent (who just did!) is that the full agent is always working within the web interface when she tries to CC/add someone. The light agent never is, so whatever she does comes by email and is the initial instantiation of the ticket, not a follow up modification or update to it. I read somewhere that there are things a light agent can do upon creation, that they can't do later.....maybe that's part of this?


  • Heather Rommel
    Community Moderator

    I would bet $$ that the requester (light agent) sent the email in and yes CC'd those 2 people on the *email* which will add them as CCs to the ticket and create the new end user.


  • Joel Hellman

    Hi again marci, let's see if we can get to the bottom of this. It is indeed a bit confusing how this work. 

    First, proper permissions

    Your Zendesk agent probably lacks proper permissions to add agents in Zendesk Support.

    She might see this:

    While others with the permissions to add End-users would see something like this (the User part):

    Which permission controls this? Its a role based permission, and Enterprise, where you can edit the roles, its this one: 

    So you might perhaps change that setting, that would give your agent permission to add users. 


    Next, what happens if you try to add a user in Zendesk Support without proper permissions?

    One can try to go around the add>User dialog by typing in a user field and hitting ENTER or SPACE, and then sending ticket. However if you lack permission, you would get this warning (and the user would not save):

    But what about the End-users that are added through email?

    Yes. It turns out, your agent without the permissions to add an End-user in Zendesk Support, can actually send an email to your Zendesk support address, adding some CCs, and assuming you have CCs turned on, this would actually add those users in your Zendesk

    Whats the point of setting the What access does this agent have to End-user profiles, then?

    Well, if you have this setting on Read only, then your Zendesk Agent cannot edit anything on the End-user profiles in Zendesk. As shown here:

    But if you have it on, say Add, edit and delete all, then your Zendesk Agent will be able to edit the End-user profiles as well. 

    To sum it up, if you trust your agent, you could change her role so she has permissions to create End-users. But it will also bring the permissions to modify End-users, not just create them. 


Please sign in to leave a comment.

Powered by Zendesk