Plan requirement
| Subscription | Any plan |
| Access | Admin |
Three separate questions hide behind the word permissions: who may use an app, who may install one, and what the app itself is allowed to do with your data. They are set in different places and answering one does not answer the others.
Who may use it
- In Admin Center, click Apps and integrations in the sidebar, then select Apps > Zendesk Support apps.
- Open the app's settings.
- Select Enable role restrictions, Enable group restrictions or both, and name the roles or groups that should have it.
- Save, then check with an agent who should not see it.
With both boxes deselected, every role and group can use the app. That is the default, and it is why unrestricted apps accumulate on the ticket screen.
Who may install one
Installing is an admin job. On Enterprise plans it can also be delegated: the custom role permission Manage Zendesk Support apps, under the Channels section of the custom role page, lets an agent install, edit, upload and delete apps.
Grant that carefully. It is the permission to add third parties to your account, which is a larger thing than it looks next to the other checkboxes on that page.
What the app itself may do
Apps appear in more places than the ticket sidebar. In Zendesk Support the framework allows the sidebar of a ticket, a new ticket, a user, an organisation or a custom object record; the toolbar of the ticket editor; the side navigation on the left of the Agent Workspace; and the top navigation. Two locations have no interface at all: a background app runs continuously without a screen, and a modal opens only when something calls it. A background app has no icon, so what you see on the ticket screen is not the full list of what is installed. What an app can see follows from where it runs and from what it was granted.
For anything talking to an outside service, the distinction that matters is read against write. A read scope reaches the API's GET endpoints. A write scope reaches POST, PUT and DELETE, which means creating, updating and deleting your records. Many apps do update fields, add tags or create tickets, and a misbehaving one then changes data rather than merely displaying it.
So read what an app asks for at installation. One that wants everything in order to show a phone number is asking for more than its job needs, and that is a question worth putting before you click.
Recheck after a reorganisation
Restrictions are tied to groups and roles, so changing either quietly widens or narrows who sees what. Nobody ever reports having gained an app, which is exactly why this is worth a look once a year alongside the app list itself.
Comments
0 comments
Article is closed for comments.