Understanding options for end-user access and sign-in

<body>
<p id="docs-hc-snippet" style="display: none;">One of the steps in setting up your Zendesk account is deciding how you want to configure end-user access. Based on the type of support you provide, you may allow anyone to submit support requests or limit it to a select group of users. You can configure Zendesk Support for either scenario.</p>
<div class="article-banners">
<div id="docs-wmp-link">
<a href="https://support.zendesk.com/hc/en-us/articles/5411234991258-plan" rel="noopener" target="_blank">What's my plan?</a>
</div>

<div class="article-banner" id="suite_all">
<table>
<tbody>
<tr>
<td>
<strong>All Suites</strong>
</td>
<td>Team, Growth, Professional, Enterprise, or Enterprise Plus</td>
</tr>
</tbody>
</table>
</div>

<div class="article-banner" id="support_all">
<table>
<tbody>
<tr>
<td>
<strong>Support</strong>
</td>
<td>Team, Professional, or Enterprise</td>
</tr>
</tbody>
</table>
</div>

</div>
<div id="docs-ai-summary">
<p id="docs-ai-summary-toggle">Summary: <span id="up-triangle">◀</span><span id="down-triangle">▼</span></p>
<p id="docs-ai-summary-content">You can configure end-user access to be open, closed, or restricted based on your support needs. Decide if users must register before submitting requests, which helps reduce spam and enables ticket tracking. Choose sign-in options like standard authentication, social media accounts, or single sign-on (SSO) with JWT or SAML for secure user verification and streamlined access management.</p>
</div>

<div class="body">

<p class="p">One of the steps in setting up your Zendesk account is deciding how you want to
configure end-user access. Based on the type of support you provide, you may
allow anyone to submit support requests or limit it to a select group of
users. You can configure Zendesk Support for either scenario.</p>
<p class="p">You'll need to configure end-user access, registration, and sign-in options. </p>
<p class="p"><img class="image img-screenshot" height="280" id="topic-1__image_2bj_pn2_v3" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/access_diagram.png" width="350"></p>
<p class="p">This article covers the following topics:</p>
<ul class="ul" id="topic-1__ul_gfs_3v1_lfb">
<li class="li"><a class="xref" href="#topic_dkn_nfk_v3">Options for end-user access</a></li>
<li class="li"><a class="xref" href="#topic_rdm_jkx_53">Options for end-user registration</a></li>
<li class="li"><a class="xref" href="#topic_ry4_2hk_v3">Options for end-user sign-in</a></li>
</ul>
</div>
<div aria-labelledby="ariaid-title2" class="topic nested1" id="topic_dkn_nfk_v3">
<h2 class="title topictitle2" id="ariaid-title2">Options for end-user access</h2>
<div class="body">
<p class="p">You have internal and external users. Your agents and other support staff
are your internal users, also called <em class="ph i">team members</em>. Your end
users, also called customers, are the people you support and whose
tickets you manage in Zendesk Support. These are your external
users. While your support staff must sign in to your Zendesk
account, your end users may not have to, depending on how you set up
access to Zendesk Support.</p>
<p class="p">You can use the <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408886840986" target="_blank">allowlist and
blocklist</a> to restrict the external users who can
access your Zendesk Support instance. For example, you might want to
allow only end users from a specific email domain and reject all
others. </p>
<p class="p">You can set up your Zendesk Support access to be completely open to all
users, restrict it to a specific group or groups of users, or close
your Zendesk Support instance and allow only the users you add to
your Zendesk account. </p>
<div class="p">
<ul class="ul">
<li class="li">
<strong class="ph b">Open</strong> means that everyone can see your help center
and submit support requests. For example, you'd
choose this configuration if you sell products and
provide support to the general public. This option
allows anyone to submit support requests. A new user
account is then created in Zendesk for users who
haven't submitted support requests before. </li>
<li class="li">
<strong class="ph b">Closed</strong> means your help center is visible to
everyone, but only the users you add to your Zendesk
account can sign in and submit support requests.
Each user's account must be created before they can
submit support requests, and signing in is required.
This is typically how an in-house IT help desk would
configure their Zendesk Support instance. </li>
<li class="li">
<strong class="ph b">Restricted</strong> means that your help center is visible
to everyone, but only users with email addresses in
domains you approve can submit support requests
successfully. All other users' requests are
rejected. This configuration allows you to restrict
access to Zendesk Support but also allows your users
to request support without first being added to your
Zendesk account, as is the case with a closed
Zendesk Support instance.</li>
</ul>
</div>
<p class="p">Setting up your Zendesk Support instance for all three options is
described in the following topics:</p>
<ul class="ul" id="topic_dkn_nfk_v3__ul_h23_zls_g5">
<li class="li"><a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408881989018" target="_blank">Enabling anyone to submit tickets
(open)</a></li>
<li class="li"><a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408883658906" target="_blank">Permitting only added users to
submit tickets (closed)</a></li>
<li class="li"><a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408893912986" target="_blank">Permitting only users with approved
email addresses to submit tickets
(restricted)</a></li>
</ul>
</div>
</div>
<div aria-labelledby="ariaid-title3" class="topic nested1" id="topic_rdm_jkx_53">
<h2 class="title topictitle2" id="ariaid-title3">Options for end-user registration</h2>
<div class="body">
<p class="p">You can require that your end users register before they can begin a
conversation with your Zendesk instance. This means that users must
first register (sign up) by providing their name and email address. </p>
<p class="p"><img class="image img-screenshot" id="topic_rdm_jkx_53__image_rw2_xkk_v3" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/captcha_signin2.png" width="300">
</p>
<div class="p">The registration process starts when an end user does one of the
following:<ul class="ul" id="topic_rdm_jkx_53__ul_4h4_jgx_53">
<li class="li">Visits your help center and clicks <strong class="ph b">Submit a
request</strong>
</li>
<li class="li">Visits your help center and clicks <strong class="ph b">Sign in</strong> for
the first time and then <strong class="ph b">Sign up</strong>
</li>
<li class="li">Sends an email support request to your support email
address for the first time</li>
</ul>
</div>
<p class="p">After signing up, users receive a welcome email message that prompts them
to verify their email address and create a password to sign in to
Zendesk.</p>
<p class="p"><img class="image img-screenshot" id="topic_rdm_jkx_53__image_tt2_c4k_v3" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/welcome_email.png" width="600"></p>
<div class="p">
<div class="note important">
<span class="importanttitle">Important:</span> When you require your end users to register,
requests they submit to Zendesk Support before registering
are sent to the suspended tickets view; they are not added
as tickets in your Zendesk Support instance. When the end
user verifies their email address, their future requests
will create tickets. Their previous requests must be
recovered from the suspended tickets view.</div>
</div>
<p class="p">Requiring your end users to register helps you ensure that the support
requests you receive are legitimate and not spam. Registration does
not guarantee that spam won't get through to your Zendesk account,
but other tools are provided to handle those that do manage to get
through. See <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408889141146" target="_blank">Understanding and managing suspended
tickets and spam</a>. </p>
<div class="p">Registering and signing in to your Zendesk Support instance allows the
end user to do the following:<ul class="ul" id="topic_rdm_jkx_53__ul_cx5_4gx_53">
<li class="li">Submit tickets in your help center without being
prompted to provide their email address</li>
<li class="li">Track their tickets in your help center</li>
<li class="li">Comment on articles in your help center, participate in
community discussions, and more. See <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408846795674-Getting-started-with-Help-Center#topic_p5y_31c_qk" target="_blank">Getting started with your help
center</a>.</li>
<li class="li">Update their user profile and add additional contact
information (email addresses and social media
accounts) so that they can submit requests from any
of these accounts, and Zendesk will pair them to
their Zendesk user account</li>
</ul>
</div>
<div class="p">
<div class="note">
<span class="notetitle">Note:</span> End users must allow third-party cookies in their browser to be added as a new user when using
an incognito or private window.</div>
</div>
</div>
<div aria-labelledby="ariaid-title4" class="topic nested2" id="topic_mwz_cwc_v3">
<h3 class="title topictitle3" id="ariaid-title4">Allowing unregistered users to submit requests</h3>
<div class="body">
<p class="p">You can still provide support to your end users without requiring
them to register and sign in. Many companies provide
email-only support and never require their end users to
register because they don't want or need them to visit and
use their help center.</p>
<div class="p">
<div class="note">
<span class="notetitle">Note:</span> You can actually do both: not require registration and
also allow your end users to use your help center.
You'd do this by hiding all the sign-in access
points into your knowledge base and providing
content that anyone can see. For more information,
see <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408888722842" target="_blank">Turning off ticket management in
your help center to allow email-only
support</a>. </div>
</div>
<p class="p">Even when you don't require your end users to register, a user
account is created for each of them in your Zendesk account.
This is required because Zendesk (and you) need to
communicate with them via email. The user account contains
their email address and other personal data. These users
remain unverified in your Zendesk account, which is fine
because you don't require registration. </p>
<p class="p">When unregistered users submit a support request, users don’t
receive the welcome email that prompts them to verify their
email address and create a password so that they can sign in
to your help center. Instead, submissions from anonymous end
users will <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408889141146" target="_blank">create a suspended
ticket</a> and send a verification email to the
email address entered by the requester.</p>
<p class="p">See <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408881989018" target="_blank">Enabling anyone to
submit tickets</a> for more information about
setting up your Zendesk Support instance to allow
unregistered users.</p>
</div>
</div>
<div aria-labelledby="ariaid-title5" class="topic nested2" id="topic_1gm_24x_53">
<h3 class="title topictitle3" id="ariaid-title5">End-user accounts created by agents</h3>
<div class="body">
<p class="p">In addition to self-registration, your agents can manually add
end users. Administrators can bulk import a list of users
using a CSV file or add users via the Zendesk API. </p>
<p class="p">If you require registration, you can <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408824350746#topic_vcv_xqj_v1b" target="_blank">send a welcome
message</a> to the end users you've added. This
is an admin setting called <strong class="ph b">Also send a welcome email when
a new user is created by an agent or
administrator</strong>. Choosing this setting prompts end
users to verify their email and choose a password just as if
they had created the user account themselves. If you don't
require registration, don't choose this option. </p>
</div>
</div>
</div>
<div aria-labelledby="ariaid-title6" class="topic nested1" id="topic_ry4_2hk_v3">
<h2 class="title topictitle2" id="ariaid-title6">Options for end-user sign-in</h2>
<div class="body">
<p class="p">If you've decided that your end users must sign in to access Zendesk
Support, determine how you want to authenticate them so that you're
assured that they are who they say they are. You can use Zendesk's
user authentication (the standard sign-in process) or remotely
authenticate your end users outside of Zendesk and then seamlessly
sign them into your Zendesk Support instance. You can also allow
your end users to sign in using popular social media such as
Facebook and Google. </p>
<p class="p">When discussing users that are authenticated outside of your Zendesk
account, you will see these terms: <em class="ph i">single sign-on</em> (or SSO)
and <em class="ph i">remote authentication</em>. <em class="ph i">Single sign-on</em> is often
used interchangeably with <em class="ph i">remote authentication</em>. For clarity,
it's best to think of <em class="ph i">single sign-on</em> as allowing your users
to sign in to your Zendesk Support instance using a password from an
outside system. That's made possible by <em class="ph i">remote
authentication</em>; users are authenticated outside of your Zendesk
account and then seamlessly sign in. </p>
<p class="p">You can set one authentication method for end users and another for team
members (agents and admins). For example, you can specify stricter
password requirements for agents who have access to more sensitive
information. You can also provide different single sign-on options
for each set of users.</p>
<p class="p">Zendesk provides a lot of flexibility regarding configuring sign-in
options for your users. You can offer multiple sign-in options and
let users choose how to sign in or require users to sign in using
SSO.</p>
</div>
<div aria-labelledby="ariaid-title7" class="topic nested2" id="topic_v1w_jsl_v3">
<h3 class="title topictitle3" id="ariaid-title7">Standard Zendesk sign-in</h3>
<div class="body">
<p class="p">This is the user authentication that Zendesk provides. You set
your Zendesk account to require registration, and the end
user signs up (registers), verifies their email address, and
creates a password. They then sign in to your help center
using their email address and password. All user data is
contained and managed within your Zendesk account. </p>
<div class="p">When you use the standard Zendesk sign-in process, you can
also:<ul class="ul" id="topic_v1w_jsl_v3__ul_fgb_bsn_gyb">
<li class="li">Set the security level for passwords, password
expiration rules, and so on. See <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408822149018#topic_tcn_ppr_2j" target="_blank">Setting the
password security level</a>.</li>
<li class="li">Turn on two-factor authentication for agents and
administrators individually. After entering their
password as usual, they'll be asked to enter a
6-digit passcode. The passcodes can be received in
text messages, or they can be generated by a
two-factor authentication app installed on a
mobile device. See <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408826974874" target="_blank">Managing two-factor
authentication (2FA)</a>.</li>
</ul>
</div>
</div>
</div>
<div aria-labelledby="ariaid-title8" class="topic nested2" id="topic_xck_mtl_v3">
<h3 class="title topictitle3" id="ariaid-title8">Social and business SSO</h3>
<div class="body">
<p class="p">In addition to the end user's Zendesk user account sign-in (email
address and password), you can allow your end users to sign
in to your Zendesk Support instance using their Facebook,
Google, and Microsoft accounts. </p>
<p class="p"><img class="image img-screenshot" id="topic_xck_mtl_v3__image_yzm_lwx_vcc" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/ac_security_end_user_login_no_X.png" width="600"></p>
<p class="p">These social and business sign-in options are convenient for your
end users, so they don't need to remember another password
to sign in to your Zendesk account.</p>
<p class="p">The social media account, rather than Zendesk, is authorized to
authenticate the end user. Zendesk trusts Facebook, for
example, to make sure that the user is who they say they
are. </p>
<div class="p">
<div class="note">
<span class="notetitle">Note:</span> End users signing in to your Zendesk instance using
their personal Facebook account is different than
using the <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408819897242" target="_blank">Facebook
channel</a> or <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408835753370" target="_blank">Facebook Messenger
channel</a> in Zendesk. Facebook channels are
used to receive support requests and message
customers through Facebook.</div>
</div>
<p class="p">For more information, see <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408885847962" target="_blank">Enabling social and business single
sign-on (SSO)</a>. </p>
</div>
</div>
<div aria-labelledby="ariaid-title9" class="topic nested2" id="topic_n4j_n5l_v3">
<h3 class="title topictitle3" id="ariaid-title9">Single sign-on with JSON Web Token (JWT)</h3>
<div class="body">
<p class="p">You can also create a locally hosted custom remote authentication
script that connects to your external user management
system. This is possible using JSON Web Token (JWT). Single
sign-on is based on a shared secret between your local
authenticating script and Zendesk. This secret is used to
securely generate a hash (one-way encryption) that Zendesk
uses to ensure that users who sign in to your account using
remote authentication are who they claim to be and have been
pre-approved to do so by implicitly knowing the shared
secret. </p>
<p class="p">For more information about JWT, see <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408845838874" target="_blank">Enabling JWT single sign-on</a>. </p>
</div>
</div>
<div aria-labelledby="ariaid-title10" class="topic nested2" id="topic_pr4_l5l_v3">
<h3 class="title topictitle3" id="ariaid-title10">Single sign-on with SAML</h3>
<div class="body">
<p class="p">If you prefer to manage your users and their sign-in to your
Zendesk account yourself, you have the option of using
identity provider services such as OneLogin, Okta, and
PingIdentity. These use SAML (Secure Assertion Markup
Language) to store all your user data or connect to your
enterprise user management systems such as Active Directory
and LDAP. </p>
<p class="p">You might set up your Zendesk sign-in this way if you're using
Zendesk Support as corporate IT help desk, for example. You
have complete control over your users; they don't need a
separate password to sign in to your Zendesk account.
Instead, when users visit your Zendesk Support instance and
attempt to sign in, they are seamlessly redirected to your
SAML server for authentication. When authenticated, users
are redirected back to your Zendesk Support instance and
automatically signed in.</p>
<p class="p">The only user data in your Zendesk account is the user's email
address or an external ID you define. </p>
<p class="p">For more information about setting up your Zendesk account to use
a SAML identity provider, see <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408887505690" target="_blank">Enabling SAML single
sign-on</a>.</p>
</div>
</div>
</div>
<script id="docs-schema-markup" type="application/ld+json">{
"@context": "https://schema.org",
"@type": "TechArticle",
"@id": "https://support.zendesk.com/hc/en-us/articles/4408887573274-Understanding-options-for-end-user-access-and-sign-in",
"url": "https://support.zendesk.com/hc/en-us/articles/4408887573274-Understanding-options-for-end-user-access-and-sign-in",
"headline": "Understanding options for end-user access and sign-in",
"description": "You can configure end-user access, registration, and sign-in options to control how users submit support requests and authenticate in your support system.",
"articleSection": "User sign-in",
"datePublished": "2021-10-16T16:36:01+00:00",
"dateModified": "2026-04-15T19:09:27.343209+00:00",
"inLanguage": "en-US",
"mainEntityOfPage": {
"@type": "WebPage",
"@id": "https://support.zendesk.com/hc/en-us/articles/4408887573274-Understanding-options-for-end-user-access-and-sign-in"
},
"author": {
"@type": "Organization",
"name": "Zendesk",
"url": "https://www.zendesk.com"
},
"publisher": {
"@type": "Organization",
"name": "Zendesk"
},
"isPartOf": {
"@type": "WebSite",
"name": "Zendesk Help",
"url": "https://support.zendesk.com/hc/en-us"
},
"about": {
"@type": "SoftwareApplication",
"name": "Zendesk"
}
}</script><script id="ai-summary-script">
//<![CDATA[
const ai_summary_style = document.createElement('style');
ai_summary_style.innerHTML = `#styled-article-body{padding:0 0 0}#article-body #docs-ai-summary{background-color:#f3f3f3;border:1px solid #d3d3d3;padding:10px 10px 6px;margin-bottom:16px}#article-body #docs-ai-summary #docs-ai-summary-toggle{font-size:.9em;font-weight:700;margin-bottom:4px;cursor:pointer;display:flex;justify-content:space-between;align-items:center}#article-body #docs-ai-summary #docs-ai-summary-toggle #up-triangle{margin-left:auto;padding-right:10px;display:none}#article-body #docs-ai-summary #docs-ai-summary-toggle #down-triangle{margin-left:auto;padding-right:10px}#article-body #docs-ai-summary #docs-ai-summary-content{font-size:.9em;padding-left:25px;padding-right:25px;margin-bottom:12px}`;
document.head.appendChild(ai_summary_style);

const toggleAISummary = () => {
const summary = document.getElementById("docs-ai-summary-content");
const upTriangle = document.getElementById("up-triangle");
const downTriangle = document.getElementById("down-triangle");
if (summary.style.display === "none") {
summary.style.display = "block";
upTriangle.style.display = "none";
downTriangle.style.display = "inline";
} else {
summary.style.display = "none";
upTriangle.style.display = "inline";
downTriangle.style.display = "none";
}
};

document.getElementById("docs-ai-summary-toggle").addEventListener("click", toggleAISummary);
//]]>
</script>
</body>