Plan requirement
| Subscription | Suite Team or higher, Support Team or higher |
| Access | Admin |
A large reduction in risk, available in this account. Make it mandatory, and plan the recovery path first. Passcodes come from an authenticator app, email or SMS, and once you require it, agents and admins are asked for a passcode once every 30 days rather than at every sign-in.
Turn it on
- In Admin Center, click Account and select Security > Advanced, then open the Authentication tab.
- Select Require two-factor authentication (2FA) and save.
- Tell everybody, with a date.
- Have them enrol and save their recovery codes.
- Enforce it, and use Generate 2FA status report to see who has enrolled.
It only covers people who sign in with a Zendesk email and password. Anyone arriving through Google, JWT or SAML is unaffected by this setting, so on an account that runs on single sign-on, requiring 2FA here changes almost nothing. There, the second factor belongs at your identity provider.
Why this one above everything else
A stolen or guessed password stops being enough. Most real incidents involving support tools start with credentials, and this is the control that breaks that chain.
Everything else on the security page is worth doing after this.
Mandatory, not optional
Optional means the people most worth protecting, the ones with the widest access, are as likely as anyone to skip it. Require it for team members.
Plan recovery before enforcing
Somebody will lose their phone. Decide in advance who can help, how they verify who is asking, and where recovery codes are kept.
Without that, the first lockout produces an improvised workaround that undermines the whole thing.
Recovery codes at enrolment
Have people save them when they set it up, not when they need them. Somewhere that is not the phone with the authenticator on it.
Give notice
A week, with instructions. Enforcing it on a Monday morning without warning produces a queue of people who cannot work and one admin trying to help all of them.
With single sign-on
Two-factor usually lives at your identity provider instead. Confirm it is enforced there, and that Zendesk passwords cannot be used as a way around it.
Comments
0 comments
Article is closed for comments.