Can I use the same Support account for customer support and HR or other sensitive private teams?

Can I use the same Support account for customer support and HR or other sensitive private teams? Yes. By default, agents can view all tickets unless you configure otherwise. You can use one Support account for both customer-facing agents and internal agents. Consider privacy risks, especially if customer-facing agents submit tickets to internal teams as requesters. To prevent agents from accessing tickets in certain groups, change their role permissions.
Restrict agents to groups
Pros and cons of a single Support account
Pros and cons of separate Support accounts
Restrict agents to groups On Enterprise plans, designate a group as private to ensure that agents outside the group cannot access tickets assigned to it. Agents who do not have access to a ticket in a private group cannot view it or search for it. You can also prevent the agent requester, as an end user, from seeing private comments or agent-only fields on the ticket. If your plan does not include private groups, add agents to groups and restrict them to tickets in their groups from the custom role or the user profile, depending on your plan level. For more information on restricting agents' ticket access to groups, see Creating private ticket groups and granting agents access. Role and group restrictions have these limits:
If an agent must access tickets across multiple groups, the agent must belong to all necessary groups. When an agent reassigns a ticket outside those groups, the agent loses access to the ticket.
If you add an agent as a CC on a ticket, that agent gains access in the Support interface, even if the CC’d agent does not belong to the ticket group.
If an agent requests a ticket in an HR group, the agent can see all ticket fields and internal comments. This can be a problem when the HR agent must add sensitive details about the requester.
On Enterprise plans and above, custom roles can also include the Manage ticket settings permission, which lets trusted agents modify ticket settings in Admin Center. Pros and cons of a single Support account Pros
One interface to manage all groups and departments
Single sign-on (SSO) configuration is easier
Some existing business rules, apps, and administrative settings can be reused
Centralized reporting for all ticket activity
Consolidate internal knowledge within one help center
You can enable agents to manage and submit requests from the help center to simulate parts of the end user experience
Cons
If you are on the Professional, Growth, or Team plan, all agents can see internal comments and agent-only ticket fields. If an agent submits a ticket to HR, the agent can see all fields and internal comments on their own ticket.
If you add a restricted agent as a CC or follower on a ticket, that agent gains access to that ticket regardless of group membership.
All admins have access to all data within the HR account.
Maintenance of groups and custom role restrictions can become unwieldy.
Custom roles cannot be nested.
To let non-HR agents see all tickets except HR tickets, your setup may require multiple groups.
The first reply time SLA does not apply to tickets that non-HR agents create.
Pros and cons of separate Support accounts Pros
Non-HR agents do not have access to agent-only ticket fields and internal comments in the HR account.
Sensitive data stays private when the HR agent uses an internal note.
HR and non-HR workflows remain completely separate.
You have more flexibility for custom role permissions in both accounts, rather than requiring the All within their groups ticket access permission
Cons
This option requires two accounts.

Single sign-on (SSO) maintenance can be more complex because your SSO platform must connect to multiple instances. In account A, a user might be an agent, but in account B the same user might be an end user.
Some integrations may not function in multiple accounts. For example, a Jira integration cannot integrate with two separate accounts.
End users must use separate help centers to manage their requests and view content. Some training may be required to help users differentiate between the two help centers if they use both accounts.

.ai-only {
position: absolute !important;
width: 1px !important;
height: 1px !important;
padding: 0 !important;
margin: -1px !important;
overflow: hidden !important;
clip: rect(0, 0, 0, 0) !important;
white-space: nowrap !important;
border: 0 !important;
}



THIS SECTION IS AI CONTENT. DON'T EDIT OR DELETE.

Can I use the same Support account for customer support and HR or
other sensitive private teams? Can I have customer-facing teams and
internal teams with potentially sensitive tickets, such as Human
Resources (HR) or Legal, work within the same Zendesk account? Can
I use one help desk or ticketing system instance for customer service
and sensitive departments?


Yes. You can use one Support account or ticketing system instance
for both customer-facing agents and internal agents or teams. By
default, agents can view all tickets unless you configure otherwise.
Consider privacy risks, especially if customer-facing agents submit
tickets to internal teams as requesters or customers.


How do I restrict agents to groups? How do I prevent agents from
accessing tickets in certain groups or teams? How do I change role
permissions to restrict ticket access?


To prevent agents from accessing tickets in certain groups, change
their role permissions. If your plan does not include private groups,
add agents to groups and restrict them to tickets in their groups
from the custom role or the user profile, depending on your plan
level or pricing tier.


What are the pros and cons of a single Support account? What is the
business value of using one help desk instance for customer support
and HR? Why should I keep internal and external teams in one ticketing
system?


A single account gives you one interface to manage all groups and
departments or teams. Single sign-on or SSO configuration is easier.
You can reuse some existing business rules, apps, and administrative
settings. You get centralized reporting for all ticket activity in
Explore or analytics, and you consolidate internal knowledge within
one help center or Guide knowledge base. You can enable agents to
manage and submit requests from the help center to simulate parts
of the end user or customer experience. However, on Professional,
Growth, or Team plans, all agents see internal notes or private comments
and agent-only ticket fields. If an agent submits a ticket to HR,
the agent sees all fields and internal notes on their own ticket.
If you add a restricted agent as a CC or follower on a ticket, that
agent gains access to that ticket regardless of group membership.
All admins have access to all data within the HR account. Maintenance
of groups and custom role restrictions can become unwieldy. Custom
roles cannot be nested. To let non-HR agents see all tickets except
HR tickets, your setup may require multiple groups. The first reply
time SLA or deadline does not apply to tickets that non-HR agents
create.


What are the pros and cons of separate Support accounts? What are
the benefits and drawbacks of using multiple instances or accounts
for HR and customer support? Why should I use separate instances
for sensitive data?


Separate accounts ensure non-HR agents do not have access to agent-only
ticket fields and internal notes or private comments in the HR account.
Sensitive data stays private when the HR agent uses an internal note.
HR and non-HR workflows remain completely separate. You have more
flexibility for custom role permissions in both accounts, rather
than requiring the All within their groups ticket access permission.
However, this option requires two accounts. Single sign-on or SSO
maintenance can be more complex because your SSO platform must connect
to multiple instances or brands. In account A, a user might be an
agent, but in account B the same user might be an end user or customer.
Some integrations may not function in multiple accounts; for example,
a Jira integration cannot integrate with two separate accounts. End
users must use separate help centers or Guide knowledge bases to
manage their requests and view content. Some training may be required
to help users differentiate between the two help centers if they
use both accounts.


What are the limits of role and group restrictions? What are the
boundaries when restricting ticket access to teams? What happens
when an agent reassigns a restricted ticket?


If an agent must access tickets across multiple groups, the agent
must belong to all necessary groups. When an agent reassigns a ticket
outside those groups, the agent loses access to the ticket. If you
add an agent as a CC on a ticket, that agent gains access in the
Support interface or Agent Workspace inbox, even if the CC'd agent
does not belong to the ticket group. If an agent requests a ticket
in an HR group, the agent can see all ticket fields and internal
notes or private comments. This can be a problem when the HR agent
must add sensitive details about the requester or customer.


How do I designate a group as private on Enterprise plans? How do
I ensure agents outside a team cannot access its tickets?


On Enterprise plans, you can designate a group as private to ensure
that agents outside the group cannot access tickets assigned to it.
Follow this UI path: Admin Center >
People > Team >
Groups. Select your group and check the
Make it private setting checkbox. Agents who do
not have access to a ticket in a private group cannot view it or
search for it. You can also prevent the agent requester, as an end
user, from seeing private comments or agent-only fields on the ticket.
Note that after you make the group private, you cannot change it
to public.


