Plan requirement
| Subscription | Any plan |
| Access | Admin |
Yes, through SAML. Two details decide whether it works: which claim carries the email address, and who the app is assigned to.
Does Zendesk work with Microsoft Entra? Can we use Entra ID single sign-on? Does it work with Azure AD?
Yes. Zendesk is added as an application in Entra and sign-in goes through it over SAML. Nothing about the Zendesk side is specific to Microsoft; it is a SAML configuration like any other, and it is available on every plan rather than being an Enterprise feature.
Entra ID is what Azure AD is now called, so guidance written under the old name still applies.
The two things that go wrong
The claim that carries the email address. Zendesk identifies people by their email address, so the Name claim has to point at the field holding the login email. That is usually user.mail, and it is not always: a directory that sends a username or an internal identifier instead will either refuse the sign-in or quietly create duplicate users. Check what is sent for one real account before rolling it out.
Assignment. The application has to be assigned to people or groups in Entra. Configured perfectly and assigned to nobody produces an error for everybody, and it is the first thing to check when it works for you and not for the team. Assign by group so that joining and leaving carry the access with them.
Two habits are worth adopting alongside it. Put the certificate expiry in a shared calendar, because when it lapses nobody can sign in and there is no warning. And test in a private window while your ordinary session stays open, so a misconfiguration cannot lock out the admin who has to fix it.
Comments
0 comments
Article is closed for comments.