Social and business single sign-on

Letting people sign in with an account they already have. The provider list differs by audience, and that is the thing to settle first.

Letting people sign in with an account they already have. The provider list differs by audience, and that is the thing to settle first.

Who can use what

So "let everyone sign in with their existing account" is two separate decisions, and a plan built on one provider for both audiences may not survive contact with the settings.

Turn it on for customers

1. In Admin Center, click Account and select Security > End user authentication. The help centre has to be activated for this page to do anything.
2. Select External authentication to reveal the third-party options.
3. Select the accounts you want to accept: Facebook, Google, Microsoft. These are personal accounts.
4. Test the sign-in as a customer.

Turn it on for your team

1. In Admin Center, click Account and select Security > Team member authentication.
2. Select External authentication, then Google, Microsoft or both.
3. For Microsoft, list the tenants you accept under Allowed tenant IDs. Leave that open and any Microsoft account can try.
4. Under How team members sign in, choose Let them choose, which shows every active method, or Redirect to SSO, which sends everybody to the primary SSO.
5. Test as a team member.

Zendesk authentication stays on the same page. Switching external sign-in on does not switch passwords off; that is a separate choice, and one worth making deliberately.

What Zendesk receives

The sign-in happens at the provider. Zendesk never sees the username and password, and gets only the primary email address on the account. That also means the provider decides who is who: if somebody keeps access to a Google or Microsoft account they should no longer have, they keep access here.

Why it helps

Every password you ask a customer to create is people who leave instead. Signing in with an account they already have removes that step entirely.

For a help centre where customers must sign in to see their tickets, this is often the difference between a portal being used and ignored.

Offer the ones your customers use

With three providers available for end users the list cannot get long, but a row of buttons is still a decision somebody has to make before they can get help. Two is usually plenty.

Watch what it does to records

Somebody signing in with a different address from the one they email from creates a second record, and their tickets then split across two identities. Worth checking for duplicates after enabling this.

For business accounts

Where customers all work at companies using the same provider, business sign-in is smoother than social and keeps the work address as the identity. That is also the route your own staff use, since Microsoft and Google are what is on offer to them.

Keep a fallback

If a provider is unavailable, or a customer no longer has that account, they need another way in. Removing all alternatives is a decision to lock some people out permanently, and it applies to your own team as well: Redirect to SSO plus an outage means nobody signs in.

See also

• Sign-in options for end users
• Enabling SAML single sign-on
• Merging duplicate users