General security best practices

<body>
<p id="docs-hc-snippet" style="display: none;">Zendesk provides a range of security options that you can use to ensure that private information is protected and secure. This article covers general security best practices to help you get started. We strongly recommend you train your agents and administrators to follow the best practices to ensure a secure environment.</p>
<div class="article-banners">
<div id="docs-wmp-link">
<a href="https://support.zendesk.com/hc/en-us/articles/5411234991258-plan" rel="noopener" target="_blank">What's my plan?</a>
</div>

<div class="article-banner" id="suite_all">
<table>
<tbody>
<tr>
<td>
<strong>All Suites</strong>
</td>
<td>Team, Growth, Professional, Enterprise, or Enterprise Plus</td>
</tr>
</tbody>
</table>
</div>

<div class="article-banner" id="support_all">
<table>
<tbody>
<tr>
<td>
<strong>Support</strong>
</td>
<td>Team, Professional, or Enterprise</td>
</tr>
</tbody>
</table>
</div>

</div>
<div id="docs-ai-summary">
<p id="docs-ai-summary-toggle">Summary: <span id="up-triangle">◀</span><span id="down-triangle">▼</span></p>
<p id="docs-ai-summary-content">This article shares security best practices to help you protect private information, including stronger passwords, two-factor authentication, single sign-on, limited admin access, private ticket groups, audit log review, secure API use, and a security contact email. You should also train your team to avoid sharing usernames, email addresses, or passwords and verify identity before making account changes.</p>
</div>

<div class="body">

<p class="p">Zendesk provides a range of security options that you can use to ensure that
private information is protected and secure. This article covers general
security best practices to help you get started. We strongly recommend you
train your agents and administrators to follow the best practices to ensure
a secure environment.</p>
<p class="p">See the <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/5418528821146" target="_blank">Zendesk Suite Product Controls and
Recommendations Guide</a> for a detailed list of security best
practices we recommend implementing in your instance.</p>
<div class="p">This article covers the following topics:<ul class="ul" id="topic-1__ul_f5z_kms_4lb">
<li class="li"><a class="xref" href="#topic_mvy_kty_vgc">Review the security posture of your Zendesk account</a></li>
<li class="li"><a class="xref" href="#topic_spf_cnf_ie">Increase password security for your agents</a></li>
<li class="li"><a class="xref" href="#topic_ogq_fnf_ie">Never give out user names, email addresses, or passwords</a></li>
<li class="li"><a class="xref" href="#topic_dkx_nnf_ie">Limit the number of agents with administrator access</a></li>
<li class="li"><a class="xref" href="#topic_ndv_qnf_ie">Remotely authenticate users with single sign-on</a></li>
<li class="li"><a class="xref" href="#topic_3zl_yht_hj">Monitor account audit logs</a></li>
<li class="li"><a class="xref" href="#topic_3ms_bkr_zk">Limit access or follow secure coding practices if using the REST API</a></li>
<li class="li"><a class="xref" href="#topic_xth_pfm_swb">Provide an email address for security notifications</a></li>
</ul>
</div>
<p class="p">If you have questions about the security of your Zendesk instance, contact
Zendesk directly. In case of a suspected security breach, submit a ticket
with the subject “Security” along with the details. Alternatively, you can
send an email to <a class="xref" href="mailto:security@zendesk.com" target="_blank">security@zendesk.com</a>.</p>
</div>
<div aria-labelledby="ariaid-title2" class="topic nested1" id="topic_mvy_kty_vgc">
<h2 class="title topictitle2" id="ariaid-title2">Review the security posture of your Zendesk account</h2>
<div class="body">
<p class="p">The Security overview page in Admin Center serves as a centralized
dashboard for managing your account's security-related settings and
provides insight into which features are enabled in your account.
The dashboard helps to identify risks associated with your existing
configurations and provides recommendations for mitigating these
risks. Review the dashboard to determine which security settings
need updates. See <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/9774890665370" target="_blank">Analyzing and improving the security posture of your Zendesk account</a>.</p>
</div>
</div>
<div aria-labelledby="ariaid-title3" class="topic nested1" id="topic_spf_cnf_ie">
<h2 class="title topictitle2" id="ariaid-title3">Increase password security for your agents</h2>
<div class="body">
<p class="p">Zendesk's default password security level for agents includes strict
password requirements, checks against known breached passwords, and
is based on security best practices and industry standards. If your
company has additional compliance requirements, you can create a
<a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408822149018" target="_blank">custom password security
level</a>. </p>
<p class="p">Encourage agents to monitor their own accounts. Zendesk will send agents an email notification
when their password is changed. Also, agents can conveniently
monitor their accounts by <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408834578074" target="_blank">enabling email alerts</a>
for logins from new devices. If you see a new login from a
suspicious device, remove the device to end the user's session, then
choose a new password.</p>
<p class="p">Require <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408826974874" target="_blank">two-factor authentication</a> for agents
and admins for another layer of security. We recommend sending a
message to your support team with a link to the <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408829277466" target="_blank">Using two-factor
authentication</a> article.</p>
<p class="p">Consider using a password manager such as <a class="xref" href="https://1password.com/" target="_blank">1Password</a> or <a class="xref" href="https://www.lastpass.com/" target="_blank">LastPass</a>. Password
managers help you generate a single strong password that can be used
for all of your other sites.</p>
</div>
</div>
<div aria-labelledby="ariaid-title4" class="topic nested1" id="topic_ogq_fnf_ie">
<h2 class="title topictitle2" id="ariaid-title4">Never give out user names, email addresses, or passwords</h2>
<div class="body">
<p class="p">Zendesk agents and administrators should never give out user names, email addresses, or
passwords.</p>
<p class="p">If you're using standard Zendesk sign-in authentication, the only secure way to reset a password
is for the user to click the <strong class="ph b">Forgot my password</strong> link on the
Zendesk sign-in screen. This prompts the user to enter a valid email
address (one already verified as a legitimate user in your account).
After submitting it, they will receive an email containing a link to
reset their password.</p>
<p class="p">If you're using a third-party single sign-on authentication system such as Active Directory, Open
Directory, LDAP or SAML, passwords can be reset similarly through
those services.</p>
<p class="p">Hackers sometimes use social engineering techniques to pressure people into giving them a
password for an account. Some hackers use tools that spoof email
addresses to impersonate users from legitimate email domains. As a
result, what appears to be a legitimate email request from a user
may not be from that actual address.</p>
<p class="p">If someone who claims to be a user or administrator contacts you, note the IP address (shown in
the <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408829602970" target="_blank">events view</a> in
tickets) and independently verify their identity (for example, by
calling the phone number in their user profile). If in doubt, never
provide sensitive information or make account changes on someone
else's behalf. Legitimate users can change their own account
settings. </p>
<p class="p">Educate your agents about these types of security risks. Also, create a security policy that
everyone knows and can refer to when these incidents occur.</p>
</div>
</div>
<div aria-labelledby="ariaid-title5" class="topic nested1" id="topic_dkx_nnf_ie">
<h2 class="title topictitle2" id="ariaid-title5">Limit the number of agents with administrator access</h2>
<div class="body">
<p class="p">Administrators can access parts of your Zendesk account that regular
agents do not. You can reduce your security risk by limiting the
number of agents who have administrator access. The agent role
provides access that typical agents need to manage and solve
tickets.</p>
<p class="p">You can select predefined agent roles that grant additional permissions
to agents. On Enterprise plans, you can also create your own <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408882153882" target="_blank">custom agent roles</a> and
decide what parts of Zendesk the agent role can access and manage.
These permissions are limited. Only account owners and
administrators have access, for example, to security settings.</p>
<p class="p">If you're concerned about your agents accessing information about your
end users, you can create a role that does not allow them to edit
end-user profiles or view the list of all your end users. </p>
</div>
</div>
<div aria-labelledby="ariaid-title6" class="topic nested1" id="topic_mdw_j3l_nvb">
<h2 class="title topictitle2" id="ariaid-title6">Limit access to private information in tickets</h2>
<div class="body">
<p class="p">On Enterprise plans, administrators can designate a group as private.
This generally restricts access to agents within the group, although
admins and team leaders have access by default, and agents can be
granted <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4988173561370#topic_l21_rbj_dvb" target="_blank">permission to view private
tickets</a>. Agents working private tickets are prevented
from <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408822451482" target="_blank">@mentioning</a> or opening
<a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408844206746" target="_blank">side conversations</a>
with team members outside the private group. Using private ticket
groups can significantly reduce visibility into the content of
tickets.</p>
<p class="p">If you're concerned about agents accessing sensitive information in
tickets, you can create private groups and assign appropriate agents
to the group to handle those tickets.</p>
</div>
</div>
<div aria-labelledby="ariaid-title7" class="topic nested1" id="topic_ndv_qnf_ie">
<h2 class="title topictitle2" id="ariaid-title7">Remotely authenticate users with single sign-on</h2>
<div class="body">
<p class="p">In addition to the user authentication provided by Zendesk, you can also use single sign-on,
which authenticates your users outside of Zendesk. There are two
<a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408883587226" target="_blank">SSO options</a>: social
media single sign-on and enterprise single sign-on.</p>
<p class="p">Social media single sign-on allows your customers to sign in with either their Zendesk account or
one of their social media accounts, such as Google or Microsoft.
While these options are convenient, we recommend inactivating
unnecessary social logins.</p>
<p class="p">Enterprise single sign-on bypasses Zendesk and authenticates your users
externally. When users navigate to your Zendesk sign-in page or
click a link to access your Zendesk account, they can authenticate
by signing into a corporate server or a third-party identity
provider, such as OneLogin or Okta.</p>
<p class="p">When providing either enterprise or social media single sign-on, we
recommend taking advantage of the two-factor authentication (also
known as multi-factor authentication) these services provide. This
adds another layer of protection by requiring additional proof of
identity. If you're using <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408845838874" target="_blank">JWT</a> or <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408887505690" target="_blank">SAML</a>, you'll need to
set this up for your Zendesk account. For social media single
sign-on, your users will need to set this up themselves. All of
these services provide the necessary documentation to set it up.</p>
<p class="p">Agents and end users can have different ways to authenticate themselves.
You can secure Zendesk Support by creating a stricter authentication
policy for agents while providing easy access to your customers and
end users.</p>
</div>
</div>
<div aria-labelledby="ariaid-title8" class="topic nested1" id="topic_3zl_yht_hj">
<h2 class="title topictitle2" id="ariaid-title8">Monitor account audit logs</h2>
<div class="body">
<div class="note">
<span class="notetitle">Note:</span> The audit log is available on Enterprise plans and above.</div>
<p class="p">The <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408828001434" target="_blank">audit log</a> tracks
important changes to your account. Using the audit log, you can
monitor various security events such as user suspensions, password
policy changes, exports of customer data, changes to custom role
definitions, and many more.</p>
</div>
</div>
<div aria-labelledby="ariaid-title9" class="topic nested1" id="topic_3ms_bkr_zk">
<h2 class="title topictitle2" id="ariaid-title9">Limit access or follow secure coding practices if using the REST API</h2>
<div class="body">
<p class="p">You can use the <a class="xref" href="https://developer.zendesk.com/api-reference/" target="_blank">Zendesk REST API</a> and the <a class="xref" href="https://developer.zendesk.com/documentation/apps/" target="_blank">Zendesk Apps framework</a>
to extend the functionality of your Zendesk Support instance.</p>
<p class="p">If you want to extend your Zendesk instance, we strongly recommend following secure coding best
practices. A good reference for this is the Open Web Application
Security Project (OWASP), which you can find <a class="xref" href="https://www.owasp.org/index.php/Main_Page" target="_blank">here</a>.</p>
</div>
</div>
<div aria-labelledby="ariaid-title10" class="topic nested1" id="topic_xth_pfm_swb">
<h2 class="title topictitle2" id="ariaid-title10">Provide an email address for security notifications</h2>
<div class="body">
<p class="p">If a security incident impacts your Service Data, it is Zendesk's top
priority and legal obligation to notify our customers within the
required time period. Add the email address of your organization's
security contact or group who should receive security incident
notifications. See <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/5436977203610" target="_blank">Designating an email address
to receive required security notifications</a>.</p>
</div>
</div>
<script id="docs-schema-markup" type="application/ld+json">{
"@context": "https://schema.org",
"@type": "TechArticle",
"@id": "https://support.zendesk.com/hc/en-us/articles/4408888782618",
"url": "https://support.zendesk.com/hc/en-us/articles/4408888782618",
"headline": "General security best practices",
"description": "You learn general security best practices for protecting private information, including password policies, authentication controls, role limits, audit log review, and security notifications.",
"articleSection": "Securing your Zendesk account",
"datePublished": "2021-10-16T17:09:15+00:00",
"dateModified": "2026-08-17T18:27:48.984510+00:00",
"inLanguage": "en",
"mainEntityOfPage": {
"@type": "WebPage",
"@id": "https://support.zendesk.com/hc/en-us/articles/4408888782618"
},
"author": {
"@type": "Organization",
"name": "Zendesk",
"@id": "https://www.zendesk.com"
},
"publisher": {
"@type": "Organization",
"name": "Zendesk",
"@id": "https://www.zendesk.com"
},
"isPartOf": {
"@type": "WebSite",
"name": "Zendesk Help",
"@id": "https://support.zendesk.com/hc/"
},
"about": {
"@type": "SoftwareApplication",
"name": "Zendesk",
"@id": "https://www.zendesk.com",
"softwareAddOn": {
"@type": "SoftwareApplication",
"name": "Security",
"@id": "https://support.zendesk.com/hc/en-us/sections/9641715451034"
}
}
}</script><script id="ai-summary-script">
//<![CDATA[
const ai_summary_style = document.createElement('style');
ai_summary_style.innerHTML = `#styled-article-body{padding:0 0 0}#article-body #docs-ai-summary{background-color:#f3f3f3;border:1px solid #d3d3d3;padding:10px 10px 6px;margin-bottom:16px}#article-body #docs-ai-summary #docs-ai-summary-toggle{font-size:.9em;font-weight:700;margin-bottom:4px;cursor:pointer;display:flex;justify-content:space-between;align-items:center}#article-body #docs-ai-summary #docs-ai-summary-toggle #up-triangle{margin-left:auto;padding-right:10px;display:none}#article-body #docs-ai-summary #docs-ai-summary-toggle #down-triangle{margin-left:auto;padding-right:10px}#article-body #docs-ai-summary #docs-ai-summary-content{font-size:.9em;padding-left:25px;padding-right:25px;margin-bottom:12px}`;
document.head.appendChild(ai_summary_style);

const toggleAISummary = () => {
const summary = document.getElementById("docs-ai-summary-content");
const upTriangle = document.getElementById("up-triangle");
const downTriangle = document.getElementById("down-triangle");
if (summary.style.display === "none") {
summary.style.display = "block";
upTriangle.style.display = "none";
downTriangle.style.display = "inline";
} else {
summary.style.display = "none";
upTriangle.style.display = "inline";
downTriangle.style.display = "none";
}
};

document.getElementById("docs-ai-summary-toggle").addEventListener("click", toggleAISummary);
//]]>
</script>
</body>