Best practices for controlling access in WFM

<body>
<p id="docs-hc-snippet" style="display: none;">Use roles, permissions, and scopes in Zendesk Workforce Management (WFM) to control access to data, settings, and reports. This article provides best practices for controlling access so you can give users the right level of visibility without exposing more than necessary.</p>
<div class="article-banners">
<div id="docs-wmp-link">
<a href="https://support.zendesk.com/hc/en-us/articles/5411234991258-plan" rel="noopener" target="_blank">What's my plan?</a>
</div>

<div class="article-banner" id="addon_wfm">
<table>
<tbody>
<tr>
<td>
<strong>Add-on</strong>
</td>
<td>Workforce Management (WFM) or Workforce Engagement Management (WEM)</td>
</tr>
</tbody>
</table>
</div>

</div>
<div id="docs-ai-summary">
<p id="docs-ai-summary-toggle">Summary: <span id="up-triangle">◀</span><span id="down-triangle">▼</span></p>
<p id="docs-ai-summary-content">Use roles, permissions, and scopes to control access to data, settings, and reports in Workforce Management. Manage user visibility by configuring teams, locations, and workstreams carefully. Update permissions and scopes as needed, watch for auto-scope expansion, and handle unassigned agents cautiously. Reassign users before deleting custom roles to avoid permission loss. Keep visibility rules in mind to ensure appropriate access levels.</p>
</div>

<div class="body">

<p class="p">Use roles, permissions, and scopes in Zendesk Workforce Management (WFM) to control access to
data, settings, and reports. This article provides best practices for controlling access so
you can give users the right level of visibility without exposing more than necessary.</p>
<ul class="ul" id="topic-1__ul_zhz_mpn_kjc">
<li class="li">
<strong class="ph b">Configure roles, permissions, and teams carefully.</strong> Teams, locations, and
workstreams are dimensions you can use in role and scopes to control which agents’ data a
user can see.</li>
<li class="li">
<strong class="ph b">Control access with the allow and block lists.</strong> Use the allow and block lists to
control who has access to WFM. By default, all Zendesk agents are added to WFM. Keep the
list in a spreadsheet if you want to review or update it before you paste changes into WFM.
See <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/6443374452250" target="_blank">Managing user access in your WFM account</a>.</li>
<li class="li">
<strong class="ph b">Use roles and scopes to limit access.</strong> Use WFM roles and scopes to control who can
access data, settings, and reports. Configure them so users can access the right data
without exposing more than necessary. A user can have a permission enabled, but if their
scope doesn’t include the relevant team, they won’t see that team’s data. See <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/6443314455834" target="_blank">Creating custom WFM roles and assigning users</a>.</li>
<li class="li">
<strong class="ph b">Update permissions, scopes, and users as needed.</strong> You can update permissions, adjust
scopes, and reassign users when needed. See <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/6443374440090" target="_blank">Understanding WFM roles and permissions</a>.</li>
<li class="li">
<strong class="ph b">Watch for auto-scope expansion.</strong> Any team, location, or workstream that a user with
a custom role creates is automatically added to that role’s scope, which means all users
with the same role gain access to it. Teams and workstreams that admins create aren’t
subject to this auto-expansion. Review scopes whenever a custom role user creates new
organizational items.</li>
<li class="li">
<strong class="ph b">Assign unassigned agents carefully.</strong> Agents who aren’t assigned to a team are
visible to all roles with an All preset scope. Be cautious when you assign an unassigned
agent to a team, because this can expand visibility instead of restricting it. Roles with
matching team-based scopes then also gain visibility into that agent.</li>
<li class="li">
<strong class="ph b">Keep visibility rules in mind.</strong> The Team schedule appears in the agent schedule app
only if agents have permission to view it and their scope includes more than one agent. If
their role includes only self, or a team that contains only that agent, they don’t see the
Team schedule tab, even if the permission is granted.</li>
<li class="li">
<strong class="ph b">Reassign users before deleting custom roles.</strong> Deleting a custom role can silently
downgrade its users. Every agent assigned to a deleted role is automatically reassigned to
the standard WFM Agent role, which may have limited permissions. Always reassign users to a
new role before you delete the old one.</li>
</ul>
</div>
<script id="docs-schema-markup" type="application/ld+json">{
"@context": "https://schema.org",
"@type": "TechArticle",
"@id": "https://support.zendesk.com/hc/en-us/articles/10797875867162",
"url": "https://support.zendesk.com/hc/en-us/articles/10797875867162",
"headline": "Best practices for controlling access in WFM",
"description": "You can control access to workforce management data and settings by configuring roles, permissions, and scopes to ensure users have appropriate visibility without exposing unnecessary information.",
"articleSection": "Product help",
"datePublished": "2026-05-20T12:41:55+00:00",
"dateModified": "2026-06-02T16:29:13.278924+00:00",
"inLanguage": "en-US",
"mainEntityOfPage": {
"@type": "WebPage",
"@id": "https://support.zendesk.com/hc/en-us/articles/10797875867162"
},
"author": {
"@type": "Organization",
"name": "Zendesk",
"@id": "https://www.zendesk.com"
},
"publisher": {
"@type": "Organization",
"name": "Zendesk",
"@id": "https://www.zendesk.com"
},
"isPartOf": {
"@type": "WebSite",
"name": "Zendesk Help",
"@id": "https://support.zendesk.com/hc/"
},
"about": {
"@type": "SoftwareApplication",
"name": "Zendesk",
"@id": "https://www.zendesk.com",
"softwareAddOn": {
"@type": "SoftwareApplication",
"name": "Workforce Management",
"@id": "https://support.zendesk.com/hc/en-us/sections/7156071715738"
}
}
}</script><script id="ai-summary-script">
//<![CDATA[
const ai_summary_style = document.createElement('style');
ai_summary_style.innerHTML = `#styled-article-body{padding:0 0 0}#article-body #docs-ai-summary{background-color:#f3f3f3;border:1px solid #d3d3d3;padding:10px 10px 6px;margin-bottom:16px}#article-body #docs-ai-summary #docs-ai-summary-toggle{font-size:.9em;font-weight:700;margin-bottom:4px;cursor:pointer;display:flex;justify-content:space-between;align-items:center}#article-body #docs-ai-summary #docs-ai-summary-toggle #up-triangle{margin-left:auto;padding-right:10px;display:none}#article-body #docs-ai-summary #docs-ai-summary-toggle #down-triangle{margin-left:auto;padding-right:10px}#article-body #docs-ai-summary #docs-ai-summary-content{font-size:.9em;padding-left:25px;padding-right:25px;margin-bottom:12px}`;
document.head.appendChild(ai_summary_style);

const toggleAISummary = () => {
const summary = document.getElementById("docs-ai-summary-content");
const upTriangle = document.getElementById("up-triangle");
const downTriangle = document.getElementById("down-triangle");
if (summary.style.display === "none") {
summary.style.display = "block";
upTriangle.style.display = "none";
downTriangle.style.display = "inline";
} else {
summary.style.display = "none";
upTriangle.style.display = "inline";
downTriangle.style.display = "none";
}
};

document.getElementById("docs-ai-summary-toggle").addEventListener("click", toggleAISummary);
//]]>
</script>
</body>