Enabling social and business single sign-on (SSO)

<body>
<div class="article-banners">
<div id="docs-wmp-link">
<a href="https://support.zendesk.com/hc/en-us/articles/5411234991258-plan" rel="noopener" target="_blank">What's my plan?</a>
</div>

<div class="article-banner" id="suite_all">
<table>
<tbody>
<tr>
<td>
<strong>All Suites</strong>
</td>
<td>Team, Growth, Professional, Enterprise, or Enterprise Plus</td>
</tr>
</tbody>
</table>
</div>

<div class="article-banner" id="support_all">
<table>
<tbody>
<tr>
<td>
<strong>Support</strong>
</td>
<td>Team, Professional, or Enterprise</td>
</tr>
</tbody>
</table>
</div>

</div>

<div class="body">

<div class="note fastpath">
<span class="fastpathtitle">Location: </span> Admin Center &gt; Account &gt; Security</div>
<p class="p">You can provide your users with more options for signing in to Zendesk Support by
allowing them to use their existing social and business accounts.</p>
<ul class="ul" id="topic-1__ul_q4j_5xk_kxb">
<li class="li">Agents and admins can use Google and Microsoft (Microsoft Entra ID and Office 365)
SSO methods to sign into their <em class="ph i">business</em> accounts.</li>
<li class="li">End users can use Facebook, Google, and Microsoft SSO methods using their
<em class="ph i">social/personal</em> accounts. </li>
</ul>
<div class="note note" id="topic-1__note_nlg_xkl_kxb">
<span class="notetitle">Note:</span> End users can only use Microsoft SSO if their Microsoft identity
is from a personal Microsoft account (services like Xbox, Teams for Life, or Outlook).
End users who attempt to sign in with a Microsoft Entra ID identity won't be able to
authenticate. You can enable <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408887505690" target="_blank">SAML-based SSO</a> for your end users if you wish to allow that
option. </div>
<div class="p">This article covers the following topics:<ul class="ul" id="topic-1__ul_iq4_dt3_4z">
<li class="li"><a class="xref" href="#topic_5sh_rkg_fj">How social and business SSO works</a></li>
<li class="li"><a class="xref" href="#topic_nxw_j4m_h3">Enabling social and business SSO</a></li>
<li class="li"><a class="xref" href="#topic_lmh_4vq_kxb">First authentication
process</a></li>
</ul>
</div>
<div class="p">Related articles:<ul class="ul" id="topic-1__ul_bpr_ssv_4wb">
<li class="li"><a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408883587226-Single-sign-on-SSO-options-in-Zendesk#topic_ftf_knm_yj" target="_blank">Single sign-on (SSO) options in
Zendesk</a></li>
<li class="li"><a class="xref" href="https://support.zendesk.com/hc/en-us/articles/5380943678106" target="_blank">Giving users different ways to sign into Zendesk</a></li>
</ul>
</div>
</div>
<div aria-labelledby="ariaid-title2" class="topic nested1" id="topic_5sh_rkg_fj">
<h2 class="title topictitle2" id="ariaid-title2">How social and business SSO works</h2>
<div class="body">
<p class="p">Social and business single sign-on allows team members to access Zendesk using their
Google and Microsoft business accounts, and end users to access Zendesk using their
personal Facebook, Google, or Microsoft accounts. </p>
<p class="p">When you turn on these SSO methods and select <strong class="ph b">Let them choose</strong> on the team
member or end user authentication page, sign-in buttons for each active SSO method
are added to your help center page. In the example below, the end user can log in
using any of their personal Facebook, Google, or Microsoft accounts.</p>
<p class="p"><img class="image img-screenshot" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/ac_security_end_user_login_no_X.png" width="600"></p>
<p class="p">If you select <strong class="ph b">Redirect to SSO</strong>, users will be automatically redirected to the
<a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408882188570#topic_c55_3sf_vsb" target="_blank">primary SSO</a>.</p>
<p class="p">Your users' social and business account sign-in credentials (username and password)
are never shared with Zendesk. Only the primary email address contained in the
social and business account is shared.</p>
</div>
</div>
<div aria-labelledby="ariaid-title3" class="topic nested1" id="topic_nxw_j4m_h3">
<h2 class="title topictitle2" id="ariaid-title3">Enabling social and business SSO</h2>
<div class="body">
<p class="p">You can enable social SSO (for end users) and business SSO (for team members) without
any custom configuration. To learn more about how the authentication process works
after you enable, see <a class="xref" href="#topic_lmh_4vq_kxb">First
authentication process</a>.</p>
<p class="p">If you use a third-party sign-in service, ensure you are verifying and managing user
identities in the external platform to prevent unauthorized access to your Zendesk
account.</p>
<p class="p"><strong class="ph b">To enable business SSO for users</strong></p>
<div class="p">
<ol class="ol" id="topic_nxw_j4m_h3__ol_em1_fhy_2hc">
<li class="li">Open the authentication page for either team members or end users:<ul class="ul" id="topic_nxw_j4m_h3__ul_lsx_why_2hc">
<li class="li"><span class="ph">In <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4581766374554#topic_hfg_dyz_1hb" target="_blank">Admin Center</a>, click <img class="image" id="topic_nxw_j4m_h3__d7e250" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/ac_account_icon.png">
<strong class="ph b">Account</strong> in the sidebar, then select <strong class="ph b">Security &gt; Team member
authentication</strong>.</span></li>
<li class="li">
<span class="ph">In <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4581766374554#topic_hfg_dyz_1hb" target="_blank">Admin Center</a>, click <img class="image" id="topic_nxw_j4m_h3__d7e266" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/ac_account_icon.png">
<strong class="ph b">Account</strong> in the sidebar, then select <strong class="ph b">Security &gt; End user
authentication</strong>.</span><p class="p">End user options are not available until you <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408846795674" target="_blank">set up and activate your help
center</a>.</p>
</li>
</ul>
</li>
<li class="li" dir="ltr">Select <strong class="ph b">External authentication</strong> to display options for
third-party sign-in services.</li>
<li class="li">Select each of the business/personal or social accounts you'd like to allow
users to sign in with.<p class="p">For end users, if you select Microsoft, they can
sign in with Microsoft identities managed through a personal Microsoft
account (for instance, services like Xbox, Teams for Life, or
Outlook).</p>
</li>
<li class="li">(For team members only) If you selected Microsoft, you must provide the
<a class="xref" href="https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-how-to-find-tenant" target="_blank">tenant IDs</a> for the Microsoft Entra
ID tenants that are permitted to access your Zendesk account (also required
for Office 365) by entering them in the <strong class="ph b">Allowed tenant IDs</strong> field,
separated with spaces.</li>
<li class="li">Select an option for <strong class="ph b">How team members sign in</strong>:<ul class="ul" id="topic_nxw_j4m_h3__ul_fm1_fhy_2hc">
<li class="li">
<strong class="ph b">Let them choose</strong> allows users to sign in using any active
authentication method. If you select this option, the sign-in links
for each option appear on your help center sign-in page.</li>
<li class="li">
<strong class="ph b">Redirect to SSO</strong> only allows users to authenticate using the
<a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408882188570#topic_c55_3sf_vsb" target="_blank">primary SSO configuration</a>.
If you select this option, and you have selected multiple
third-party sign-in services, select the primary SSO configuration
in the <strong class="ph b">Primary SSO</strong> field that appears.</li>
</ul>
</li>
<li class="li">Click <strong class="ph b">Save</strong>.</li>
</ol>
</div>
<div class="note note" id="topic_nxw_j4m_h3__note_mch_mkk_kxb">
<span class="notetitle">Note:</span> If your SSO service goes down or you are locked out, you can
still access your account using the <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408882128666" target="_blank"> Zendesk SSO bypass functionality</a>.</div>
</div>
</div>
<div aria-labelledby="ariaid-title4" class="topic nested1" id="topic_lmh_4vq_kxb">
<h2 class="title topictitle2" id="ariaid-title4">First authentication process</h2>
<div class="body">
<div class="p">When you enable social and business SSO options and select <strong class="ph b">Let them choose</strong>, a
user's first authentication process follows this sequence:<ol class="ol" id="topic_lmh_4vq_kxb__ol_pzg_5vq_kxb">
<li class="li">Users select one of the social or business sign-on options on your Zendesk
account sign-in page. </li>
<li class="li">Users will be redirected to their social or business sign-in page and must
enter their credentials. </li>
<li class="li">If the credentials are valid, users will be redirected back to your Zendesk
Support account. </li>
</ol>
</div>
<p class="p">If the email address matches a user's email address in Zendesk, they are signed in. </p>
<p class="p">If the email address does not match a user in Zendesk, a new user will be created,
and Zendesk will send a verification email. If the user is a duplicate of a
pre-existing Zendesk user, you can <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408887695898" target="_blank">merge the users</a>.</p>
<p class="p">If your Zendesk account is closed or restricted and a user tries to sign in with a
business or social account email that does not exist in Zendesk, their request to
authenticate is rejected. To allow a user to sign in with a social or business
account that uses a different email, you must <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408822763546#topic_zb2_22c_ppb" target="_blank">add the account email</a> to their user
profile.</p>
<p class="p">After authenticating, the user is seamlessly signed in to Zendesk. On subsequent
visits, if the user is already signed in to their social or business account, they
are immediately signed in to Zendesk when they click the associated social or
business sign-on button. Otherwise, they are prompted to sign in to their social or
business account.</p>
</div>
</div>
<script id="fast-path-script">
//<![CDATA[
const fast_path_style = document.createElement('style');
fast_path_style.innerHTML = `#article-body .fastpath{font-size:.9em;background-color:#f3f3f3;border:1px solid #d3d3d3;padding:10px 10px 8px;margin-bottom:16px}#article-body .fastpath::before{content:none!important}`;
document.head.appendChild(fast_path_style);
//]]>
</script>
</body>