Plan requirement
| Subscription | Any plan |
| Access | Admin |
Signing in through your own identity provider. The highest-value access change most organisations can make. Zendesk supports SAML, OpenID Connect and JWT, and you can run several active configurations at once, each assigned to a different collection of users.
A collection of users is not a brand. Single sign-on is set for the account as a whole, and one brand cannot be given a different provider from another; only a custom JWT script can vary that. If you run several brands and expect each to sign in through its own provider, settle that before you start.
Set it up
- Configure Zendesk as an application in your identity provider.
- Enter the provider's details in the authentication settings.
- Map the attributes, including email address.
- Test with one account, in a separate browser session.
- Enable it for team members.
Why it is worth the work
Access ends when employment does, in one place. No separate password, no account left active because somebody forgot Zendesk was on the list.
Offboarding is where most real incidents begin, and this closes it structurally rather than by remembering.
Keep a way in while testing
Test in a private window while your normal session stays signed in. A misconfigured provider with no fallback locks every admin out, including the one fixing it.
This is the mistake worth planning around.
Email mapping decides identity
Zendesk matches on email address. If the provider sends a different address from the one on the account, you get a new user rather than a sign-in.
Check that mapping before enabling it for everybody.
Decide about Zendesk passwords
Leaving them enabled means an account can still be reached the old way, which undoes the offboarding benefit. Disable them for team members once single sign-on is working.
Know what disabling does. Switch Zendesk authentication off and every Zendesk user password is permanently deleted within 24 hours. If you want the old route closed without destroying the fallback, set team members to be redirected to single sign-on instead and leave Zendesk authentication on.
Plan for provider outages
If the provider is unavailable, nobody signs in. Agree what happens then, before it happens on a busy morning.
Do it with us
Contact pluscloud support and we will go through it with you. This is one of the configurations where a mistake affects everybody at once.
Comments
0 comments
Article is closed for comments.