Setting the password security level

<div class="article-banners">
<div id="docs-wmp-link">
<a href="https://support.zendesk.com/hc/en-us/articles/5411234991258-plan" rel="noopener" target="_blank">What's my plan?</a>
</div>
<div class="article-banner" id="suite_all">
<table style="margin-left: 0px; margin-right: auto;">
<tbody>
<tr>
<td>
<strong>All Suites</strong>
</td>
<td>Team, Growth, Professional, Enterprise, or Enterprise Plus</td>
</tr>
</tbody>
</table>
</div>
<div class="article-banner" id="support_all">
<table style="margin-left: 0px; margin-right: auto;">
<tbody>
<tr>
<td>
<strong>Support</strong>
</td>
<td>Team, Professional, or Enterprise</td>
</tr>
</tbody>
</table>
</div>
</div>
<div id="docs-ai-summary">
<p id="docs-ai-summary-toggle">
Verified AI summary <span id="up-triangle">◀</span><span id="down-triangle">▼</span>
</p>
<p id="docs-ai-summary-content">
Enhance account security by setting password security levels to Recommended for both team members and end users, ensuring strong password requirements. You can customize security settings for team members if needed. Consider enabling session expiration and following password best practices to protect sensitive information. Avoid allowing administrators to set passwords to reduce security risks.
</p>
</div>
<div class="body">
<div class="note fastpath">
<span class="fastpathtitle">Location: </span> Admin Center &gt; Account
&gt; Security
</div>
<p class="p">
A password security level refers to the strength or complexity of a password.
Zendesk provides the following levels of password security: Recommended,
High, Medium, and Low.
</p>
<p class="p">
You can set one password security level for end users and a different
one for
team members. You can also create a custom password security level for
team
members (admins and agents) if your requirements differ for these users.
</p>
<p class="p">
Zendesk strongly suggests setting the Recommended password security level
for
both team members and end users. This security level is configured with
strict password requirements, checks against known breached passwords,
and
is based on security best practices and industry standards.
</p>
<div class="note note">
<span class="notetitle">Note:</span> You can use a
<a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408883587226" target="_blank"> single sign-on (SSO) solution</a>
instead of Zendesk passwords. Zendesk recommends using SSO, if possible,
to
prevent users from setting weak passwords that can put their accounts
at
risk.
</div>
<p class="p">This article covers the following topics:</p>
<ul class="ul" id="topic-1__ul_wtk_cxw_22b">
<li class="li">
<a class="xref" href="#topic_j41_j4r_2j">About password security levels</a>
</li>
<li class="li">
<a class="xref" href="#topic_tcn_ppr_2j">Changing the password security level</a>
</li>
<li class="li">
<a class="xref" href="#topic_ncf_twp_jzb">Setting a custom password security level for team members</a>
</li>
</ul>
</div>
<div aria-labelledby="ariaid-title2" class="topic nested1" id="topic_j41_j4r_2j">
<h2 class="title topictitle2" id="ariaid-title2">About password security levels</h2>
<div class="body">
<p class="p">
Many organizations require complex passwords as part of their security
policies. Certain regulations, such as the General Data Protection
Regulation (GDPR), require organizations to take steps to ensure
the
security of personal data, which includes using complex passwords.
</p>
<p class="p">
Zendesk strongly suggests setting the Recommended password security
level
for both team members and end users to safeguard your account.
</p>
<div class="p">
When the Recommended password security level is in place, passwords
do
not expire. However, passwords must meet the following
requirements:
<ul class="ul" id="topic_j41_j4r_2j__ul_qys_s5p_jzb">
<li class="li">Must be at least 12 characters</li>
<li class="li">
Must include uppercase and lowercase letters (a-z and
A-Z)
</li>
<li class="li">Must include a number (0-9)</li>
<li class="li">Must include a special character (!, @, #, %, etc.)</li>
<li class="li">Must not include the word "Zendesk"</li>
<li class="li">Must not resemble an email address</li>
<li class="li">
Must pass a check against a list of known breached
passwords
</li>
<li class="li">
Five attempts are allowed before a temporary 10-minute
lockout
</li>
</ul>
</div>
<p class="p">
The Low, Medium, and High password security levels have lower security
requirements. Zendesk recommends
<a class="xref" href="#topic_tcn_ppr_2j">changing the security level</a>
to
Recommended if you are using any of these other levels.
</p>
<p class="p">
You can review the password requirements for the currently selected
security level on the team member or end user authentication
page.
</p>
<p class="p">
<img class="image img-screenshot" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/security_password_level_require.png" width="400">
</p>
<p class="p">
The Custom security level is available only for team members and
can be
used if the Recommended password security level doesn't meet your
requirements. If you create your own password policy, ensure the
requirements are at least as strong as the Recommended level. See
<a class="xref" href="#topic_ncf_twp_jzb">Setting a custom password security level for team members</a>.
</p>
<div class="note note" id="topic_j41_j4r_2j__note_h5n_23x_jzb">
<span class="notetitle">Note:</span> Zendesk enforces a 72-character
limit for all
passwords. The limit on password length is a reliability measure
to
prevent a form of DoS attack called “long password denial of
service.” To learn more about Zendesk security practices, visit our
<a class="xref" href="https://www.zendesk.com/product/zendesk-security/" target="_blank">Security
website</a>.
</div>
</div>
</div>
<div aria-labelledby="ariaid-title3" class="topic nested1" id="topic_tcn_ppr_2j">
<h2 class="title topictitle2" id="ariaid-title3">Changing the password security level</h2>
<div class="body">
<p class="p">
You must be an administrator to change the password security level.
When
you increase the security level (for example, Medium to
Recommended), all passwords, regardless of security level, are set
to expire in 5 days. All end users and team members must change
their passwords to comply with the new security level.
</p>
<p class="p">
Increasing the password security level can cause some passwords to
expire
instantly. If a password is older than 90 days and the security
level is increased to a level with an expiration restriction, that
password is considered expired. Zendesk sends email notifications
to
administrators and agents three days before a password expires, and
then on the day it expires.
</p>
<p class="p">
If you change the security level from Low, Medium, or High to either
Recommended or Custom, you can't revert back. You can change between
the Low, Medium, and High levels and revert back if needed.
</p>
<p class="p">
<strong class="ph b">To change the password security level</strong>
</p>
<ol class="ol" id="topic_tcn_ppr_2j__ol_xmp_3qw_jzb">
<li class="li" dir="ltr">
Open the password security settings for team members
or end users.
<ul class="ul" id="topic_tcn_ppr_2j__ul_vyz_pxr_5qb">
<li class="li">
<span class="ph">In <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4581766374554#topic_hfg_dyz_1hb" target="_blank">Admin Center</a>, click <img class="image" id="topic_tcn_ppr_2j__d7e250" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/ac_account_icon.png">
<strong class="ph b">Account</strong> in the sidebar, then select <strong class="ph b">Security &gt; Team member
authentication</strong>.</span>
</li>
<li class="li">
<span class="ph">In <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4581766374554#topic_hfg_dyz_1hb" target="_blank">Admin Center</a>, click <img class="image" id="topic_tcn_ppr_2j__d7e266" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/ac_account_icon.png">
<strong class="ph b">Account</strong> in the sidebar, then select <strong class="ph b">Security &gt; End user
authentication</strong>.</span>
<p class="p">
The end-users option is not available until
you
<a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408846795674" target="_blank">set up and activate your help
center</a>.
</p>
</li>
</ul>
</li>
<li class="li">
Select a <strong class="ph b">Password level</strong>, then click
<strong class="ph b">Save</strong>.
</li>
<li class="li">
If the Low, Medium, or High password security level was
previously set and you are changing to Custom or
Recommended, click <strong class="ph b">Save</strong> to confirm
that you
understand the previous levels will no longer be
available.
<p class="p">
<img class="image img-screenshot" id="topic_tcn_ppr_2j__image_ryp_wt4_bhc" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/security_password_level_switch.png" width="400">
</p>
</li>
</ol>
</div>
</div>
<div aria-labelledby="ariaid-title4" class="topic nested1" id="topic_ncf_twp_jzb">
<h2 class="title topictitle2" id="ariaid-title4">Setting a custom password security level for team members</h2>
<div class="body">
<p class="p">
If the Recommended password security level doesn't meet your company's
specific requirements for team members, you can create a custom
password security level.
</p>
<div class="p">
<div class="note note" id="topic_ncf_twp_jzb__note_klh_t3l_m2c">
<span class="notetitle">Note:</span> Changes to a custom password
security
policy won't impact expiration rules for existing passwords.
For example, if you change your password expiration from
<strong class="ph b">30 days</strong> to
<strong class="ph b">Never</strong>, passwords for
current users will still expire after 30 days. When they
reset their password, the new expiration rule is applied.
</div>
</div>
<p class="p">
Most of the custom options are self-explanatory except for the
following:
</p>
<ul class="ul" id="topic_ncf_twp_jzb__ul_ink_fx5_g2b">
<li class="li">
<strong class="ph b">Number of previous passwords to reject</strong>
- New passwords
must be different from the number of previous passwords you
set.
</li>
<li class="li">
<strong class="ph b">Failed attempts until lockout</strong> -
If an end user or agent
fails to enter their password correctly the number of times
you specify in a row, they are locked out for a certain
period of time. They cannot sign in again until the lockout
expires.
</li>
<li class="li">
<strong class="ph b">Password can resemble email</strong> - Controls
whether new
passwords can include parts of an email address. For
example, when this setting is <strong class="ph b">No</strong>,
a user with a
david@mycompany.com email address cannot include the word
<strong class="ph b">david</strong> as part of their password.
</li>
</ul>
<div class="p">
<strong class="ph b">To set a custom password security level for team members</strong>
<ol class="ol" id="topic_ncf_twp_jzb__ol_as3_fww_jzb">
<li class="li">
<span class="ph">In <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4581766374554#topic_hfg_dyz_1hb" target="_blank">Admin Center</a>, click <img class="image" id="topic_ncf_twp_jzb__d7e250" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/ac_account_icon.png">
<strong class="ph b">Account</strong> in the sidebar, then select <strong class="ph b">Security &gt; Team member
authentication</strong>.</span>
</li>
<li class="li">
Select <strong class="ph b">Custom</strong> in the
<strong class="ph b">Password level</strong>
drop-down.
</li>
<li class="li">
Click the <strong class="ph b">Edit</strong> link to set
password
requirements.
</li>
<li class="li">
Select your custom password requirements.
<p class="p">
<img class="image img-screenshot" id="topic_ncf_twp_jzb__image_xvg_4rf_khb" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/admin_center_custom_passwords4.png" width="400">
</p>
</li>
<li class="li">
Click <strong class="ph b">Set</strong>.
</li>
<li class="li">
Click <strong class="ph b">Save</strong>.
</li>
<li class="li">
If the Low, Medium, or High password security level was
previously set for team members, you'll receive a
message that these levels will no longer be
available. Click <strong class="ph b">Save</strong> to confirm.
</li>
</ol>
</div>
</div>
</div>
<script id="fast-path-script">
//<![CDATA[
const fast_path_style = document.createElement('style');
fast_path_style.innerHTML = `#article-body .fastpath{font-size:.9em;background-color:#f3f3f3;border:1px solid #d3d3d3;padding:10px 10px 8px;margin-bottom:16px}#article-body .fastpath::before{content:none!important}`;
document.head.appendChild(fast_path_style);
//]]>
</script>
<script id="ai-summary-script">
//<![CDATA[
const ai_summary_style = document.createElement('style');
ai_summary_style.innerHTML = `#styled-article-body{padding:0 0 0}#article-body #docs-ai-summary{background-color:#f3f3f3;border:1px solid #d3d3d3;padding:10px 10px 6px;margin-bottom:16px}#article-body #docs-ai-summary #docs-ai-summary-toggle{font-size:.9em;font-weight:700;margin-bottom:4px;cursor:pointer;display:flex;justify-content:space-between;align-items:center}#article-body #docs-ai-summary #docs-ai-summary-toggle #up-triangle{margin-left:auto;padding-right:10px;display:none}#article-body #docs-ai-summary #docs-ai-summary-toggle #down-triangle{margin-left:auto;padding-right:10px}#article-body #docs-ai-summary #docs-ai-summary-content{font-size:.9em;padding-left:25px;padding-right:25px;margin-bottom:12px}`;
document.head.appendChild(ai_summary_style);

const toggleAISummary = () => {
const summary = document.getElementById("docs-ai-summary-content");
const upTriangle = document.getElementById("up-triangle");
const downTriangle = document.getElementById("down-triangle");
if (summary.style.display === "none") {
summary.style.display = "block";
upTriangle.style.display = "none";
downTriangle.style.display = "inline";
} else {
summary.style.display = "none";
upTriangle.style.display = "inline";
downTriangle.style.display = "none";
}
};

document.getElementById("docs-ai-summary-toggle").addEventListener("click", toggleAISummary);
//]]>
</script>