General security best practices

<div class="article-banners" translate="no">
<div id="docs-wmp-link"><a href="https://support.zendesk.com/hc/en-us/articles/5411234991258-plan" target="_blank" rel="noopener">What's my plan?</a></div>
<div id="suite_all" class="article-banner">
<table>
<tbody>
<tr>
<td><strong>All Suites</strong></td>
<td>Team, Growth, Professional, Enterprise, or Enterprise Plus</td>
</tr>
</tbody>
</table>
</div>
<div id="support_all" class="article-banner">
<table>
<tbody>
<tr>
<td><strong>Support</strong></td>
<td>Team, Professional, or Enterprise</td>
</tr>
</tbody>
</table>
</div>
</div>
<div id="docs-ai-summary">
<p id="docs-ai-summary-toggle">Verified AI summary <span id="up-triangle">◀</span><span id="down-triangle">▼</span></p>
<p id="docs-ai-summary-content">Enhance security by reviewing your account's security posture, increasing password security, and using two-factor authentication. Limit admin access, use single sign-on for remote authentication, and monitor audit logs. Avoid sharing sensitive information and follow secure coding practices if using the REST API. Provide an email for security notifications to stay informed about potential incidents.</p>
</div>
<div class="body">
<p class="p">Zendesk provides a range of security options that you can use to ensure that private information is protected and secure. This article covers general security best practices to help you get started. We strongly recommend you train your agents and administrators to follow the best practices to ensure a secure environment.</p>
<p class="p">See the <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/5418528821146" target="_blank" rel="noopener">Zendesk Suite Product Controls and Recommendations Guide</a> for a detailed list of security best practices we recommend implementing in your instance.</p>
<div class="p">This article covers the following topics:
<ul id="topic-1__ul_f5z_kms_4lb" class="ul">
<li class="li"><a class="xref" href="#topic_mvy_kty_vgc">Review the security posture of your Zendesk account</a></li>
<li class="li"><a class="xref" href="#topic_spf_cnf_ie">Increase password security for your agents</a></li>
<li class="li"><a class="xref" href="#topic_ogq_fnf_ie">Never give out user names, email addresses, or passwords</a></li>
<li class="li"><a class="xref" href="#topic_dkx_nnf_ie">Limit the number of agents with administrator access</a></li>
<li class="li"><a class="xref" href="#topic_ndv_qnf_ie">Remotely authenticate users with single sign-on</a></li>
<li class="li"><a class="xref" href="#topic_3zl_yht_hj">Monitor account audit logs</a></li>
<li class="li"><a class="xref" href="#topic_3ms_bkr_zk">Limit access or follow secure coding practices if using the REST API</a></li>
<li class="li"><a class="xref" href="#topic_xth_pfm_swb">Provide an email address for security notifications</a></li>
</ul>
</div>
<p class="p">If you have questions about the security of your Zendesk instance, contact Zendesk directly. In case of a suspected security breach, submit a ticket with the subject “Security” along with the details. Alternatively, you can send an email to <a class="xref" href="mailto:security@zendesk.com" target="_blank" rel="noopener">security@zendesk.com</a>.</p>
</div>
<div id="topic_mvy_kty_vgc" class="topic nested1" aria-labelledby="ariaid-title2">
<h2 id="ariaid-title2" class="title topictitle2">Review the security posture of your Zendesk account</h2>
<div class="body">
<p class="p">The Security overview page in Admin Center serves as a centralized dashboard for managing your account's security-related settings and provides insight into which features are enabled in your account. The dashboard helps to identify risks associated with your existing configurations and provides recommendations for mitigating these risks. Review the dashboard to determine which security settings need updates. See <a href="https://support.zendesk.com/hc/en-us/articles/9774890665370" target="_blank" rel="noopener noreferrer">Analyzing and improving the security posture of your Zendesk account.</a></p>
</div>
</div>
<div id="topic_spf_cnf_ie" class="topic nested1" aria-labelledby="ariaid-title3">
<h2 id="ariaid-title3" class="title topictitle2">Increase password security for your agents</h2>
<div class="body">
<p class="p">Zendesk provides four <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408822149018" target="_blank" rel="noopener">password security levels</a>: Recommended, High, Medium, and Low. You can also specify a custom security level. An administrator can set one password security level for end users and another for agents and admins.</p>
<p class="p">Zendesk strongly suggests setting the Recommended password security level for both team members and end users to safeguard your account. This security level is configured with strict password requirements, checks against known breached passwords, and is based on security best practices and industry standards.</p>
<p class="p">Increase the password requirements for agents to help prevent unauthorized users from guessing your agents' passwords. You should also require administrators and agents to select unique passwords for their Zendesk accounts and avoid reusing passwords for external systems.</p>
<p class="p">Encourage agents to monitor their own accounts. Zendesk will send agents an email notification when their password is changed. Also, agents can conveniently monitor their accounts by <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408834578074" target="_blank" rel="noopener">enabling email alerts</a> for logins from new devices. If you see a new login from a suspicious device, remove the device to end the user's session, then choose a new password.</p>
<p class="p">Require <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408826974874" target="_blank" rel="noopener">two-factor authentication</a> for agents and admins for another layer of security. We recommend sending a message to your support team with a link to the <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408829277466" target="_blank" rel="noopener">Using two-factor authentication</a> article.</p>
<p class="p">Consider using a password manager such as <a class="xref" href="https://1password.com/" target="_blank" rel="noopener">1Password</a> or <a class="xref" href="https://www.lastpass.com/" target="_blank" rel="noopener">LastPass</a>. Password managers help you generate a single strong password that can be used for all of your other sites.</p>
</div>
</div>
<div id="topic_ogq_fnf_ie" class="topic nested1" aria-labelledby="ariaid-title4">
<h2 id="ariaid-title4" class="title topictitle2">Never give out user names, email addresses, or passwords</h2>
<div class="body">
<p class="p">Zendesk agents and administrators should never give out user names, email addresses, or passwords.</p>
<p class="p">If you're using standard Zendesk sign-in authentication, the only secure way to reset a password is for the user to click the <strong class="ph b">Forgot my password</strong> link on the Zendesk sign-in screen. This prompts the user to enter a valid email address (one already verified as a legitimate user in your account). After submitting it, they will receive an email containing a link to reset their password.</p>
<p class="p">If you're using a third-party single sign-on authentication system such as Active Directory, Open Directory, LDAP or SAML, passwords can be reset similarly through those services.</p>
<p class="p">Hackers sometimes use social engineering techniques to pressure people into giving them a password for an account. Some hackers use tools that spoof email addresses to impersonate users from legitimate email domains. As a result, what appears to be a legitimate email request from a user may not be from that actual address.</p>
<p class="p">If someone who claims to be a user or administrator contacts you, note the IP address (shown in the <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408829602970" target="_blank" rel="noopener">events view</a> in tickets) and independently verify their identity (for example, by calling the phone number in their user profile). If in doubt, never provide sensitive information or make account changes on someone else's behalf. Legitimate users can change their own account settings.</p>
<p class="p">Educate your agents about these types of security risks. Also, create a security policy that everyone knows and can refer to when these incidents occur.</p>
</div>
</div>
<div id="topic_dkx_nnf_ie" class="topic nested1" aria-labelledby="ariaid-title5">
<h2 id="ariaid-title5" class="title topictitle2">Limit the number of agents with administrator access</h2>
<div class="body">
<p class="p">Administrators can access parts of your Zendesk account that regular agents do not. You can reduce your security risk by limiting the number of agents who have administrator access. The agent role provides access that typical agents need to manage and solve tickets.</p>
<p class="p">You can select predefined agent roles that grant additional permissions to agents. On Enterprise plans, you can also create your own <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408882153882" target="_blank" rel="noopener">custom agent roles</a> and decide what parts of Zendesk the agent role can access and manage. These permissions are limited. Only account owners and administrators have access, for example, to security settings.</p>
<p class="p">If you're concerned about your agents accessing information about your end users, you can create a role that does not allow them to edit end-user profiles or view the list of all your end users.</p>
</div>
</div>
<div id="topic_mdw_j3l_nvb" class="topic nested1" aria-labelledby="ariaid-title6">
<h2 id="ariaid-title6" class="title topictitle2">Limit access to private information in tickets</h2>
<div class="body">
<p class="p">On Enterprise plans, administrators can designate a group as private. This generally restricts access to agents within the group, although admins and team leaders have access by default, and agents can be granted <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4988173561370#topic_l21_rbj_dvb" target="_blank" rel="noopener">permission to view private tickets</a>. Agents working private tickets are prevented from <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408822451482" target="_blank" rel="noopener">@mentioning</a> or opening <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408844206746" target="_blank" rel="noopener">side conversations</a> with team members outside the private group. Using private ticket groups can significantly reduce visibility into the content of tickets.</p>
<p class="p">If you're concerned about agents accessing sensitive information in tickets, you can create private groups and assign appropriate agents to the group to handle those tickets.</p>
</div>
</div>
<div id="topic_ndv_qnf_ie" class="topic nested1" aria-labelledby="ariaid-title7">
<h2 id="ariaid-title7" class="title topictitle2">Remotely authenticate users with single sign-on</h2>
<div class="body">
<p class="p">In addition to the user authentication provided by Zendesk, you can also use single sign-on, which authenticates your users outside of Zendesk. There are two <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408883587226" target="_blank" rel="noopener">SSO options</a>: social media single sign-on and enterprise single sign-on.</p>
<p class="p">Social media single sign-on allows your customers to sign in with either their Zendesk account or one of their social media accounts, such as Google or Microsoft. While these options are convenient, we recommend inactivating unnecessary social logins.</p>
<p class="p">Enterprise single sign-on bypasses Zendesk and authenticates your users externally. When users navigate to your Zendesk sign-in page or click a link to access your Zendesk account, they can authenticate by signing into a corporate server or a third-party identity provider, such as OneLogin or Okta.</p>
<p class="p">When providing either enterprise or social media single sign-on, we recommend taking advantage of the two-factor authentication (also known as multi-factor authentication) these services provide. This adds another layer of protection by requiring additional proof of identity. If you're using <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408845838874" target="_blank" rel="noopener">JWT</a> or <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408887505690" target="_blank" rel="noopener">SAML</a>, you'll need to set this up for your Zendesk account. For social media single sign-on, your users will need to set this up themselves. All of these services provide the necessary documentation to set it up.</p>
<p class="p">Agents and end users can have different ways to authenticate themselves. You can secure Zendesk Support by creating a stricter authentication policy for agents while providing easy access to your customers and end users.</p>
</div>
</div>
<div id="topic_3zl_yht_hj" class="topic nested1" aria-labelledby="ariaid-title8">
<h2 id="ariaid-title8" class="title topictitle2">Monitor account audit logs</h2>
<div class="body">
<div class="note">
<span class="notetitle">Note:</span> The audit log is available on Enterprise plans and above.</div>
<p class="p">The <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408828001434" target="_blank" rel="noopener">audit log</a> tracks important changes to your account. Using the audit log, you can monitor various security events such as user suspensions, password policy changes, exports of customer data, changes to custom role definitions, and many more.</p>
</div>
</div>
<div id="topic_3ms_bkr_zk" class="topic nested1" aria-labelledby="ariaid-title9">
<h2 id="ariaid-title9" class="title topictitle2">Limit access or follow secure coding practices if using the REST API</h2>
<div class="body">
<p class="p">You can use the <a class="xref" href="https://developer.zendesk.com/api-reference/" target="_blank" rel="noopener">Zendesk REST API</a> and the <a class="xref" href="https://developer.zendesk.com/documentation/apps/" target="_blank" rel="noopener">Zendesk Apps framework</a> to extend the functionality of your Zendesk Support instance.</p>
<p class="p">If you want to extend your Zendesk instance, we strongly recommend following secure coding best practices. A good reference for this is the Open Web Application Security Project (OWASP), which you can find <a class="xref" href="https://www.owasp.org/index.php/Main_Page" target="_blank" rel="noopener">here</a>.</p>
</div>
</div>
<div id="topic_xth_pfm_swb" class="topic nested1" aria-labelledby="ariaid-title10">
<h2 id="ariaid-title10" class="title topictitle2">Provide an email address for security notifications</h2>
<div class="body">
<p class="p">If a security incident impacts your Service Data, it is Zendesk's top priority and legal obligation to notify our customers within the required time period. Add the email address of your organization's security contact or group who should receive security incident notifications. See <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/5436977203610" target="_blank" rel="noopener">Designating an email address to receive required security notifications</a>.</p>
</div>
</div>
<p>
<script id="fast-path-script">
//<![CDATA[
const fast_path_style = document.createElement('style');
fast_path_style.innerHTML = `#article-body .fastpath{font-size:.9em;background-color:#f3f3f3;border:1px solid #d3d3d3;padding:10px 10px 8px;margin-bottom:16px}#article-body .fastpath::before{content:none!important}`;
document.head.appendChild(fast_path_style);
//]]>
</script>
<script id="article-banners-script">
//<![CDATA[
const banner_style = document.createElement('style');
banner_style.innerHTML = `#styled-article-body{padding:0 0 0}#article-body #docs-wmp-link{text-align:right;font-size:.8em}#article-body .article-banners{margin-bottom:1rem}#article-body .article-banner{border:1px solid #ded7ca;background-color:#f6f0e6;margin:0 0 3px;line-height:1}#article-body .article-banner table{border-collapse:collapse;border:none;margin:0;width:auto}#article-body .article-banner td{padding:8px 6px 8px;border:none;font-size:.85em}#article-body .article-banner td:nth-child(2){border-left:1px solid #d0c9bd}#article-body .article-banner strong{font-weight:400;text-shadow:0 0 1px rgba(0,0,0,.5);letter-spacing:.5px}@media (min-width:1600px){#article-body .article-banner td{font-size:.8em}#article-body .docs-wmp-link{font-size:.7em}}`;
document.head.appendChild(banner_style);
//]]>
</script>
<script id="ai-summary-script">
//<![CDATA[
const ai_summary_style = document.createElement('style');
ai_summary_style.innerHTML = `#styled-article-body{padding:0 0 0}#article-body #docs-ai-summary{background-color:#f3f3f3;border:1px solid #d3d3d3;padding:10px 10px 6px;margin-bottom:16px}#article-body #docs-ai-summary #docs-ai-summary-toggle{font-size:.9em;font-weight:700;margin-bottom:4px;cursor:pointer;display:flex;justify-content:space-between;align-items:center}#article-body #docs-ai-summary #docs-ai-summary-toggle #up-triangle{margin-left:auto;padding-right:10px;display:none}#article-body #docs-ai-summary #docs-ai-summary-toggle #down-triangle{margin-left:auto;padding-right:10px}#article-body #docs-ai-summary #docs-ai-summary-content{font-size:.9em;padding-left:25px;padding-right:25px;margin-bottom:12px}`;
document.head.appendChild(ai_summary_style);

const toggleAISummary = () => {
const summary = document.getElementById("docs-ai-summary-content");
const upTriangle = document.getElementById("up-triangle");
const downTriangle = document.getElementById("down-triangle");
if (summary.style.display === "none") {
summary.style.display = "block";
upTriangle.style.display = "none";
downTriangle.style.display = "inline";
} else {
summary.style.display = "none";
upTriangle.style.display = "inline";
downTriangle.style.display = "none";
}
};

document.getElementById("docs-ai-summary-toggle").addEventListener("click", toggleAISummary);
//]]>
</script>
</p>