To access the security settings from Admin Center

1. InAdmin Center, click theAccounticon () in the sidebar.
2. In theSecuritysection, select one of the security options.

You can use Zendesk authentication (the standard sign-in process) for team members and end users. Zendesk authentication is enabled by default.

For end users, the following conditions must be met before they can use Zendesk authentication:

• Help center must be activated. Help center is the only publicly accessible side of Support and Chat for end users. SeeGetting started with Guidein the Support help center.
• 最终用户must register. After registering, an end user is prompted to verify their email address and create a password, which the user can then use to sign in. SeeRequiring your users to registerin the Support help center.

To enable Zendesk authentication

1. Open the security settings forTeam membersor最终用户.
   • InAdmin Center, clickAccountin the sidebar, then selectSecurity > Team member authentication.
   • InAdmin Center, clickAccountin the sidebar, then selectSecurity > End user authentication.

     You can set one sign-in option for team members and a different one for end users.

2. Make sureZendesk Authenticationis selected.

   The option is selected by default.

3. Set the password security level.

   SeeSetting the password security levelin the Support help center.

4. ClickSave.

If you enable Zendesk authentication, you can manage the following additional settings:

• Restricting access by IP addresses
• Sending password-change notifications
• Requiring 2-factor authentication
• Setting an inactivity time-out period

In some cases, you may choose to disable Zendesk authentication and use another authentication method, such as SSO, for team members and end users.

To disable Zendesk authentication

1. Open the security settings forTeam membersor最终用户.
   • InAdmin Center, clickAccountin the sidebar, then selectSecurity > Team member authentication.
   • InAdmin Center, clickAccountin the sidebar, then selectSecurity > End user authentication.
2. DeselectZendesk Authentication.
3. ClickSave.

If you're disabling Zendesk authentication for end users, also do the following:

1. InAdmin Center, clickPeoplein the sidebar, then selectConfiguration > End users.
2. Determine if you want to enable or disable theAnybody can submit ticketssetting.

   Typically, when Zendesk authentication is disabled for end users, you would disable this setting also to keep unauthenticated end users from submitting tickets. But if you want end users to send email to their support addresses without allowing them to login in anywhere, leave this setting enabled.

   If you disable Zendesk authentication for end users, but you still haveAnyone can submit ticketsenabled, end users will not see a sign up page when they submit a ticket. Instead, they are redirected back to the help center home page.

3. Saveyour changes.

Users can sign in to Zendesk using their credentials for certain social and business accounts. Thesocialaccounts are Facebook and Twitter. Thebusinessaccounts are Google and Microsoft.

最终用户can use all four – Twitter, Facebook, Google, and Microsoft. Team members can only use Google or Microsoft.

To learn more, seeSSO (single sign-on) options in Zendeskin the Support help center.

To enable social and business single sign-on

1. Open the security settings forTeam membersor最终用户.
   • InAdmin Center, clickAccountin the sidebar, then selectSecurity > Team member authentication.
   • InAdmin Center, clickAccountin the sidebar, then selectSecurity > End user authentication.
2. Select the social or business SSO option you want to enable.
3. If you want users to use only the SSO option, disable theZendesk Authenticationoption.
   Warning:Disabling Zendesk authentication permanently deletes any Zendesk passwords on record within 24 hours. API requests using an email address and password combination will also fail for both agents and end users.
4. ClickSave.

Zendesk supports two enterprise single sign-on solutions:

• Secure Assertion Markup Language (SAML)SAML is supported by many identity provider services, such as Okta, OneLogin, Active Directory, and LDAP. For information on configuring SAML single sign-on, see支持SAML单点登录.
• JSON Web Token (JWT)Credentials and user information is sent in JSON format encrypted using a Zendesk shared secret. For information on configuring JWT single sign-on, seeEnabling JWT (JSON Web Token) single sign-on.

To learn more, seeEnterprise single sign-onin the Support help center.

You can enable SAML or JWT single sign-on only for team members, only for end users, or for both groups.

To enable SAML or JWT single sign-on

1. InAdmin Center, clickAccountin the sidebar, then selectSecurity > Single sign-on.
2. Click theConfigurelink of one of the SSO options and enter the configuration information.
   For details, see the following topics:

   • Enabling SAML SSO
   • Enabling JWT SSO
3. After configuring your SSO option, clickTeam membersor最终用户and select theExternal authenticationoption if not already selected.
4. If you want all users to only use the single sign-on method, deselect theZendesk authenticationoption.

   Any Zendesk passwords will be permanently deleted from the account within 24 hours.

5. Select theSingle sign-onoption in theExternal authenticationsection.

   For end users, selecting the SSO option deselects the Zendesk Authentication option if enabled.

   Warning:Disabling Zendesk authentication permanently deletes any Zendesk passwords on record within 24 hours.
6. ClickSave.

If Zendesk authentication is enabled, you can restrict users from specific IP addresses from accessing your account. For example, to restrict access to users in your company, specify the IP addresses of your company. You can also allow end users to bypass the restrictions. IP restrictions that you manage in Admin Center apply to sign in for all products.

Enabling IP-based access restrictions can break third-party integrations that access your account. Make sure to create an allowlist for all external IPs that access your account through the Zendesk APIs. Some integrations use variable IP addresses that can't be included in an allowlist. If you want to use these integrations, you must disable IP restrictions.

You can specify ranges of IP addresses, separating each range with a space. Two methods are available to specify a range. The first is to use asterisk (*) wildcards. An IP address consists of four numbers separated by periods, such as192.168.0.1. You can substitute a single asterisk character (*) for any number group to let Zendesk know that it should accept any value in that space. For example,192.*.*.*allows any IP address whose first number is 192.

The second way to specify an IP range is to useIP subnet mask syntax. For example,192.168.1.0/25specifies all the IP addresses between 192.168.1.0 and 192.168.1.127.

You cannot specify IP ranges where the CIDR (Classless Inter-Domain Routing) value is 0. For example, if you specify10.0.0.0/0,/0is a valid format, but it's not accepted by Zendesk.

To set IP restrictions

1. InAdmin Center, clickAccountin the sidebar, then selectSecurity > Advanced.
2. On theIP Restrictionstab, selectEnabled,n enter theAllowed IP Rangesyou want to restrict.
3. If you don't want the IP restrictions to apply to end users, make sureAllow customers to bypass IP restrictionsis selected.
4. ClickSave.

For more information, seeRestricting access to Zendesk Support using IP restrictions.

If Zendesk authentication is enabled, you can send email notifications to team members and end users when their passwords change.

To send password-change notifications

1. InAdmin Center, clickAccountin the sidebar, then selectSecurity > Advanced.
2. On thePasswordstab, selectEmail notifications.
3. ClickSave.

如果启亚博用了Zendesk认证,你可以require team members to use 2-factor authentication when they sign in. Once this setting enabled, all team members will be required to set up 2-factor authentication the next time they sign in. For instructions for your team, seeUsing 2-factor authentication.

要求2因素身份验证

1. InAdmin Center, clickAccountin the sidebar, then selectSecurity > Advanced.
2. On theAuthenticationtab, selectRequire two-factor authentication (2FA).
3. ClickSave.

For more information, seeManaging 2-factor authentication.

If Zendesk authentication is enabled, you can customize the session expiration period for team members and end users. If a user is inactive for the specified period, they are signed out.

Users remain signed in as long as they actively use the product. Active use includes typing and clicking links. SeeUnderstanding your Zendesk session time.

A session expires after 8 hours of inactivity for all users by default. If your security requirements differ for your team members and end users, you can set separate expiration periods for each.

To set an inactivity time-out period

1. InAdmin Center, clickAccountin the sidebar, then selectSecurity > Advanced.
2. On theAuthenticationtab, select a session expiration period for team members and end users underSession expiration.
3. ClickSave.

To troubleshoot an issue, you can let a Zendesk agent assume the role of agent in your account for a specified time. This setting is disabled by default.

This setting can be useful to help Zendesk solve the following issues with your account:

• Highly-technical issues
• Issues that Zendesk can't be reproduce anywhere else
• Issues where Zendesk needs to visually analyze console information that's not obtainable with any other method
• IP configuration issues
• Issues where Zendesk needs to create test tickets to test or troubleshoot possible causes and solutions

To allow Zendesk to assume the role of agent in your account

1. InAdmin Center, clickAccountin the sidebar, then selectSecurity > Advanced.
2. On theAccount Assumptiontab, selectEnable account assumption.
3. Select a duration from theDurationmenu.
4. ClickSave.