Single sign-on (SSO) options in Zendesk

<body>
<div class="article-banners">
<div id="docs-wmp-link">
<a href="https://support.zendesk.com/hc/en-us/articles/5411234991258-plan" rel="noopener" target="_blank">What's my plan?</a>
</div>

<div class="article-banner" id="suite_all">
<table>
<tbody>
<tr>
<td>
<strong>All Suites</strong>
</td>
<td>Team, Growth, Professional, Enterprise, or Enterprise Plus</td>
</tr>
</tbody>
</table>
</div>

<div class="article-banner" id="support_all">
<table>
<tbody>
<tr>
<td>
<strong>Support</strong>
</td>
<td>Team, Professional, or Enterprise</td>
</tr>
</tbody>
</table>
</div>

</div>
<div id="docs-ai-summary">
<p id="docs-ai-summary-toggle">Verified AI summary <span id="up-triangle">◀</span><span id="down-triangle">▼</span></p>
<p id="docs-ai-summary-content">Single sign-on (SSO) options let you authenticate users externally, enhancing security and user management. You can choose from social, business, or enterprise SSO methods like SAML, OIDC, or JWT. Ensure email verification with your identity provider. Configure multiple SSO setups for different user groups, and maintain access control even if your SSO service is down.</p>
</div>

<div class="body">

<p class="p">In addition to the user authentication provided by Zendesk, you can also use
single sign-on (SSO) to authenticate your users outside of Zendesk. There
are three types of SSO: social account, business account, and enterprise. </p>
<p class="p">Zendesk recommends configuring and enforcing SSO for all admins and agents, if
possible. Email addresses are used as user IDs, so when using SSO, it is
critical that email addresses associated with users provisioned by the
identity provider are verified.</p>
<p class="p">This article covers the following topics:</p>
<ul class="ul" id="topic-1__ul_dsz_jkp_4x">
<li class="li"><a class="xref" href="#topic_a5v_1pm_pz">Essential facts for
SSO</a></li>
<li class="li"><a class="xref" href="#topic_v5q_hnm_yj">Social and business account
SSO</a></li>
<li class="li"><a class="xref" href="#topic_ftf_knm_yj">Enterprise SSO</a></li>
</ul>
<div class="p">Related articles:<ul class="ul" id="topic-1__ul_v5t_ks4_vwb">
<li class="li"><a class="xref" href="https://support.zendesk.com/hc/en-us/articles/5380943678106" target="_blank">Giving users
different ways to sign into Zendesk</a></li>
<li class="li"><a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408845838874" target="_blank">Enabling JWT single
sign-on</a></li>
<li class="li"><a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408887505690" target="_blank">Enabling SAML single
sign-on</a></li>
<li class="li"><a class="xref" href="https://support.zendesk.com/hc/en-us/articles/7957465432474" target="_blank">Setting up single
sign-on with OpenID Connect (OIDC)</a></li>
</ul>
</div>
</div>
<div aria-labelledby="ariaid-title2" class="topic nested1" id="topic_a5v_1pm_pz">
<h2 class="title topictitle2" id="ariaid-title2">Essential facts for SSO</h2>
<div class="body">
<p class="p">Below are some essential facts about the available SSO options. These are
explained in greater detail in this article.</p>
<div class="p">
<ul class="ul" id="topic_a5v_1pm_pz__ul_nlp_gpm_pz">
<li class="li">Admins and agents can sign in with their Google,
Microsoft, and Zendesk accounts, or can sign in
directly by going to their Zendesk URL and entering
their username and password. End users can sign in
with social accounts and their Zendesk
accounts.</li>
<li class="li">If your Zendesk account is closed or restricted, and a
user tries to sign in with a different email than
the one registered in Zendesk Support, their request
will be rejected.</li>
<li class="li">You can have multiple active SAML, JWT, and OpenID
Connect (OIDC) SSO configurations, which can be
assigned to different collections of users. Each
will have their own remote sign-in pages.</li>
<li class="li">No matter what authentication method you choose, Zendesk
stores all users in the same database. </li>
<li class="li">If you're using a third-party identity provider to
authenticate, you must configure the Zendesk app
with the identity provider. </li>
<li class="li">It is not possible to apply different SSO options to
individual brands, unless you use <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408886711066-Multibrand-Using-multiple-JWT-Single-Sign-on-URL-s-Professional-Add-on-and-Enterprise-" target="_blank">a custom script for
JWT</a>. </li>
<li class="li">If you place a wildcard (*) in the blocklist, users will
no longer be able to authenticate or create an
account with SSO. See <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408886840986" target="_blank">Using the allowlist and blocklist
to control access to your
Zendesk</a>.</li>
</ul>
</div>
</div>
</div>
<div aria-labelledby="ariaid-title3" class="topic nested1" id="topic_v5q_hnm_yj">
<h2 class="title topictitle2" id="ariaid-title3">Social and business account SSO</h2>
<div class="body">
<div class="p">Social and business account SSO are additional sign-in options you can
provide for your users' convenience. You can make these available on
your help center sign-in page so that users can authenticate with
their Zendesk Support account or a social or business account. <ul class="ul" id="topic_v5q_hnm_yj__ul_hcs_sfj_mxb">
<li class="li">Agents and admins can use Google and Microsoft
(Microsoft Entra ID and Office 365) SSO methods to
log into their <em class="ph i">business</em> accounts.</li>
<li class="li">End users can use Facebook, Google, and Microsoft SSO
methods using their <em class="ph i">social/personal</em>
accounts.</li>
</ul>
</div>
<p class="p"><img class="image img-screenshot" id="topic_v5q_hnm_yj__image_yzm_lwx_vcc" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/ac_security_end_user_login_no_X.png" width="600"></p>
<p class="p">When using business account SSO, it's important to note that the Google
sign-in supports both Gmail and Google Workspace.</p>
<p class="p">To add social and business account SSO to your sign-in page, see <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408885847962" target="_blank">Enabling social and business account single
sign-on</a>. </p>
</div>
</div>
<div aria-labelledby="ariaid-title4" class="topic nested1" id="topic_ftf_knm_yj">
<h2 class="title topictitle2" id="ariaid-title4">Enterprise SSO</h2>
<div class="body">
<p class="p">You can require users to sign in using enterprise SSO, or you can
activate multiple sign-in options (for example, enterprise SSO
<em class="ph i">and</em> Zendesk authentication) and let users decide how
they want to sign in. (The word "enterprise" in this context doesn't
refer to Zendesk Enterprise plans.) See <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/5380943678106" target="_blank">Giving users different ways to sign into Zendesk</a>. </p>
<div class="note important" id="topic_ftf_knm_yj__note_fk1_2rq_tyb">
<span class="importanttitle">Important:</span> When you use Enterprise SSO,
you are responsible for verifying your users' identities, including
their email addresses. If you don't verify your users and their
email addresses, your account is at risk of unauthorized access, and
Zendesk cannot guarantee or warrant the security of your account. </div>
<div class="p">This section contains the following topics:<ul class="ul" id="topic_ftf_knm_yj__ul_ygn_jph_4z">
<li class="li"><a class="xref" href="#topic_n42_lph_4z">About
enterprise SSO</a></li>
<li class="li"><a class="xref" href="#topic_ftf_knm_yj">Enterprise
SSO options</a></li>
</ul>
</div>
</div>
<div aria-labelledby="ariaid-title5" class="topic nested2" id="topic_n42_lph_4z">
<h3 class="title topictitle3" id="ariaid-title5">About enterprise SSO</h3>
<div class="body">
<p class="p">When you direct users to enterprise SSO, you're bypassing Zendesk
and authenticating your users externally. When users
navigate to your Zendesk sign-in page or click a link to
access your Zendesk account, they can authenticate by
signing into a corporate server or a third-party identity
provider, such as OneLogin or Okta. Enabling enterprise SSO
also affects the iOS and Android versions of the Zendesk
mobile app.</p>
<div class="note">
<span class="notetitle">Note:</span> It isn't possible to enable enterprise SSO for individual
brands, unless you use <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408886711066-Multibrand-Using-multiple-JWT-Single-Sign-on-URL-s-Professional-Add-on-and-Enterprise-" target="_blank">a custom script for
JWT SSO</a>.</div>
<div class="p">If you're using enterprise SSO, your users' sign-in flow will
follow the sequence below:<ol class="ol" id="topic_n42_lph_4z__ol_lmn_t2x_tz">
<li class="li">Users navigate to a Zendesk page or
subdomain.</li>
<li class="li">If not already authenticated, users are
redirected to your corporate server or third-party
identity provider sign-in page, depending on the
enterprise SSO option you selected. </li>
<li class="li">Users enter their sign-in credentials. </li>
<li class="li">If valid, users are redirected back to the
original Zendesk page.</li>
</ol>
<div class="note">
<span class="notetitle">Note:</span> Users can also start the sign-on process from
your corporate server or the third-party identity
provider sign-in page. They will then be
authenticated automatically when accessing Zendesk.
</div>
</div>
<p class="p">Both your end users and team members can sign in to your Zendesk
using enterprise SSO. You can configure enterprise SSO only
for end users, team members, or a mix of both. Users
authenticating through Zendesk end-user SSO are assigned the
role specified in Zendesk, which may include team member
access. </p>
<p class="p">The advantage of using enterprise SSO is that you have complete
control over your users behind your firewall. You
authenticate your users once, against your own user
authentication system, and then grant them access to many
other resources both inside and outside of your firewall.
Your user management is performed outside of Zendesk, but
your corporate user authentication system is still synced
with Zendesk. When you add a user account for a new
employee, they will have immediate access to Zendesk, or if
you delete a user account, that employee will no longer have
access to Zendesk.</p>
<p class="p">By default, the only data that Zendesk stores for each user is
their name and email address, but it's possible to sync more
user data to Zendesk, like the user's organization.</p>
<p class="p">You have the option of keeping Zendesk authentication with your
enterprise SSO authentication. If you decide to turn off
Zendesk authentication, all Zendesk user passwords will be
permanently deleted within 24 hours.</p>
<p class="p">If your SSO service is temporarily unavailable, you can still
access your Zendesk account. See <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408882128666" target="_blank">Accessing your
Zendesk account when your SSO service is
down</a>. </p>
</div>
</div>
<div aria-labelledby="ariaid-title6" class="topic nested2" id="topic_ewb_lph_4z">
<h3 class="title topictitle3" id="ariaid-title6">Enterprise SSO options</h3>
<div class="body">
<div class="p">There are three enterprise SSO options available in Zendesk:<ul class="ul" id="topic_ewb_lph_4z__ul_dxm_5rh_4z">
<li class="li">
<strong class="ph b">Secure Assertion Markup Language (SAML)</strong>:
SAML is supported by many identity provider
services, such as Okta, OneLogin, Active
Directory, and LDAP. For information on
configuring SAML SSO, see <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408887505690" target="_blank">Enabling SAML single
sign-on</a>.</li>
<li class="li">
<strong class="ph b">OpenID Connect (OIDC)</strong>: Built on the OAuth
2.0 framework, OIDC uses ID tokens to verify the
identity of users based on the authentication
performed by an authorization server. See <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/7957465432474" target="_blank">Setting up single
sign-on with OpenID Connect (OIDC)</a>.</li>
<li class="li">
<strong class="ph b">JSON Web Token (JWT)</strong>: Credentials and
user information is sent in JSON format encrypted
using a Zendesk Shared Secret. For information on
configuring JWT SSO, see <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408845838874" target="_blank">Enabling JWT single
sign-on</a>.</li>
</ul>
</div>
<p class="p">You can use the same option for all users or different options
for different collections of users. This is ideal if you
have separate sets of users in different locations that you
don't want to merge. If you use more than one enterprise SSO
configuration, you can present users with multiple SSO
sign-in options on the Zendesk sign-in page or redirect
users to the primary SSO. See <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/5380943678106" target="_blank">Giving users
different ways to sign into Zendesk</a>.</p>
</div>
</div>
</div>
<script id="ai-summary-script">
//<![CDATA[
const ai_summary_style = document.createElement('style');
ai_summary_style.innerHTML = `#styled-article-body{padding:0 0 0}#article-body #docs-ai-summary{background-color:#f3f3f3;border:1px solid #d3d3d3;padding:10px 10px 6px;margin-bottom:16px}#article-body #docs-ai-summary #docs-ai-summary-toggle{font-size:.9em;font-weight:700;margin-bottom:4px;cursor:pointer;display:flex;justify-content:space-between;align-items:center}#article-body #docs-ai-summary #docs-ai-summary-toggle #up-triangle{margin-left:auto;padding-right:10px;display:none}#article-body #docs-ai-summary #docs-ai-summary-toggle #down-triangle{margin-left:auto;padding-right:10px}#article-body #docs-ai-summary #docs-ai-summary-content{font-size:.9em;padding-left:25px;padding-right:25px;margin-bottom:12px}`;
document.head.appendChild(ai_summary_style);

const toggleAISummary = () => {
const summary = document.getElementById("docs-ai-summary-content");
const upTriangle = document.getElementById("up-triangle");
const downTriangle = document.getElementById("down-triangle");
if (summary.style.display === "none") {
summary.style.display = "block";
upTriangle.style.display = "none";
downTriangle.style.display = "inline";
} else {
summary.style.display = "none";
upTriangle.style.display = "inline";
downTriangle.style.display = "none";
}
};

document.getElementById("docs-ai-summary-toggle").addEventListener("click", toggleAISummary);
//]]>
</script>
</body>