Plan requirement
| Subscription | Suite Team or higher, Support Team or higher |
| Access | Admin |
How strict your password rules are. The choice is narrower than it used to be: since 17 August 2026 Zendesk has been removing the Low, Medium and High levels for team member authentication and migrating those accounts to Recommended. If you remember choosing High, that is why the screen looks different.
Set it
- In Admin Center, click Account, then Security.
- Open Team member authentication or End user authentication.
- Choose the level, and set the two audiences separately.
- Tell staff before it takes effect.
What each audience can be set to
| Team members | Recommended or Custom. Custom exists for additional compliance requirements and is available only here. |
| End users | Recommended, Low, Medium or High. |
What Recommended enforces
A minimum of 12 characters and a maximum of 72, upper and lower case, numbers and special characters, no use of "Zendesk" or email-like formats, a check against known breached password databases, and a lockout after five attempts.
The breach check is the part worth noticing. It rejects passwords that are already circulating, which no length or complexity rule can do on its own.
Recommended does not force expiry, and that is deliberate
Regular forced changes push people towards small predictable variations and writing them down. Current guidance from most security bodies is to change passwords when there is reason to, not on a timer, and Zendesk's own default follows that.
If a compliance requirement mandates expiry, Custom is where you would build it. Otherwise it is worth questioning rather than assuming.
Set staff and customers separately
Agents have access to your customer data and should face the strict policy. Customers have access to their own tickets, and every extra requirement loses some of them at the sign-in page, which is why end users still have the lighter levels available.
Two-factor is worth more than any policy here
A moderate password with two-factor beats a strict password without it, by a wide margin. If you only do one thing on this subject, do that instead.
Tell people before it changes
A stricter policy prompts a wave of resets, and unannounced it arrives as a fault. One message beforehand covers it.
Single sign-on makes this moot
Where staff sign in through your identity provider, the policy lives there. Then this setting only matters for anyone who can still use a Zendesk password.
Comments
0 comments
Article is closed for comments.