Designating an address for security notifications

One field, one address: Security contact email. Make it a distribution list, because Zendesk accepts only one and this is where an incident notice arrives.

One field, one address: Security contact email. Make it a distribution list, because Zendesk accepts only one address and this is where a notice about a security incident affecting your service data arrives.

Set it

1. In Admin Center, click Account in the sidebar, then select Security > More settings.
2. On the Zendesk Support tab, enter the address in Security contact email.
3. Click Save.
4. Agree who reads that mailbox and how quickly they are expected to act.

One address only

The field takes a single address, so the way to reach several people is a distribution list or a shared mailbox that routes onward. That is also the way to survive the person who set it up leaving.

Never an individual, for the same reason. People go on holiday, change roles and leave, and a notice arriving in a deactivated mailbox is the same as no notice at all.

The account owner still gets a copy

Filling this in does not move the notifications away from the account owner; they continue to receive them. What it adds is a second, deliberate recipient.

Leave it empty and the account owner is the only one who hears, which is the reason the field exists: the owner is often a commercial or administrative contact rather than whoever handles security.

What arrives here

Security-related notifications, including notice of an incident affecting your service data. It is not a general alert feed, so treat anything that does arrive as significant rather than as traffic to be filed.

There is nothing to test with either. You cannot trigger one of these for practice, which is exactly why the address has to be right the first time.

Decide in advance who acts

Who investigates, who can revoke access, and at what point you involve pluscloud support. An alert reaching somebody with no mandate to act achieves nothing, and this is not the moment to work that out.

Reorganisations move mailboxes, so check this setting whenever your team changes. It is small, invisible and exactly the sort of thing nobody thinks to look at afterwards.

See also

• Checking devices and applications that accessed your account
• Subscribing to status notifications
• General security practices for your Zendesk