This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
Download Microsoft Edge
More info about Internet Explorer and Microsoft Edge
In this tutorial, you'll learn how to integrate Zendesk with Azure Active Directory (Azure AD). When you integrate Zendesk with Azure AD, you can:
Control in Azure AD who has access to Zendesk.
Enable your users to be automatically signed-in to Zendesk with their Azure AD accounts.
Manage your accounts in one central location - the Azure portal.
Prerequisites
To get started, you need the following items:
An Azure AD subscription. If you don't have a subscription, you can get a
free account
.
Zendesk single sign-on (SSO) enabled subscription.
Scenario description
In this tutorial, you configure and test Azure AD SSO in a test environment.
Zendesk supports
SP
initiated SSO.
Zendesk supports
Automated
user provisioning
.
Adding Zendesk from the gallery
To configure the integration of Zendesk into Azure AD, you need to add Zendesk from the gallery to your list of managed SaaS apps.
Sign in to the Azure portal using either a work or school account, or a personal Microsoft account.
On the left navigation pane, select the
Azure Active Directory
service.
Navigate to
Enterprise Applications
and then select
All Applications
.
To add new application, select
New application
.
In the
Add from the gallery
section, type
Zendesk
in the search box.
Select
Zendesk
from results panel and then add the app. Wait a few seconds while the app is added to your tenant.
Alternatively, you can also use the
Enterprise App Configuration Wizard
. In this wizard, you can add an application to your tenant, add users/groups to the app, assign roles, as well as walk through the SSO configuration as well.
Learn more about Microsoft 365 wizards.
Configure and test Azure AD SSO with Zendesk using a test user called
B.Simon
. For SSO to work, you need to establish a link relationship between an Azure AD user and the related user in Zendesk.
To configure and test Azure AD SSO with Zendesk, perform the following steps:
Configure Azure AD SSO
- to enable your users to use this feature.
Create an Azure AD test user
- to test Azure AD single sign-on with B.Simon.
Assign the Azure AD test user
- to enable B.Simon to use Azure AD single sign-on.
Configure Zendesk SSO
- to configure the single sign-on settings on application side.
Create Zendesk test user
- to have a counterpart of B.Simon in Zendesk that is linked to the Azure AD representation of user.
Test SSO
- to verify whether the configuration works.
Follow these steps to enable Azure AD SSO in the Azure portal.
In the Azure portal, on the
Zendesk
application integration page, find the
Manage
section and select
single sign-on
.
On the
Select a single sign-on method
page, select
SAML
.
On the
Set up single sign-on with SAML
page, click the pencil icon for
Basic SAML Configuration
to edit the settings.
On the
Basic SAML Configuration
section, perform the following steps:
a. In the
Sign on URL
text box, type a URL using the following pattern:
https://<subdomain>.zendesk.com
b. In the
Identifier (Entity ID)
text box, type a URL using the following pattern:
https://<subdomain>.zendesk.com
c. In the
Reply URL
text box, type a URL using the following pattern:
https://<subdomain>.zendesk.com/access/saml
These values are not real. Update these values with the actual Sign on URL, Identifier and Reply URL. Contact
Zendesk Client support team
to get these values. You can also refer to the patterns shown in the
Basic SAML Configuration
section in the Azure portal.
Zendesk application expects the SAML assertions in a specific format. There are no mandatory SAML attributes but optionally you can manage from the
User Attributes
section on application integration page. On the
Set up Single Sign-On with SAML
page, click
Edit
button to open
User Attributes
dialog.
You use extension attributes to add attributes that are not in Azure AD by default. Click
User attributes that can be set in SAML
to get the complete list of SAML attributes that
Zendesk
accepts.
In the
SAML Signing Certificate
section, click
Edit
button to open
SAML Signing Certificate
dialog.
In the
SAML Signing Certificate
section, copy the
Thumbprint Value
and save it on your computer.
On the
Set up Zendesk
section, copy the appropriate URL(s) based on your requirement.
Create an Azure AD test user
In this section, you'll create a test user in the Azure portal called B.Simon.
From the left pane in the Azure portal, select
Azure Active Directory
, select
Users
, and then select
All users
.
Select
New user
at the top of the screen.
In the
User
properties, follow these steps:
In the
Name
field, enter
B.Simon
.
In the
User name
field, enter the username@companydomain.extension. For example,
B.Simon@contoso.com
.
Select the
Show password
check box, and then write down the value that's displayed in the
Password
box.
Click
Create
.
Assign the Azure AD test user
In this section, you'll enable B.Simon to use Azure single sign-on by granting access to Zendesk.
In the Azure portal, select
Enterprise Applications
, and then select
All applications
.
In the applications list, select
Zendesk
.
In the app's overview page, find the
Manage
section and select
Users and groups
.
Select
Add user
, then select
Users and groups
in the
Add Assignment
dialog.
In the
Users and groups
dialog, select
B.Simon
from the Users list, then click the
Select
button at the bottom of the screen.
If you are expecting a role to be assigned to the users, you can select it from the
Select a role
dropdown. If no role has been set up for this app, you see "Default Access" role selected.
In the
Add Assignment
dialog, click the
Assign
button.
You can set up one SAML configuration for team members and a second SAML configuration for end users.
To automate the configuration within
Zendesk
, you need to install
My Apps Secure Sign-in browser extension
by clicking
Install the extension
.
After adding extension to the browser, click on
setup Zendesk
will direct you to the Zendesk application. From there, provide the admin credentials to sign into Zendesk. The browser extension will automatically configure the application for you and automate steps 3-6.
If you want to set up Zendesk manually, open a new web browser window and sign into your Zendesk company site as an administrator and perform the following steps:
In the
Zendesk Admin Center
, go to
Account -> Security -> Single sign-on
, then click
Create SSO configuration
and select
SAML
.
Perform the following steps in the
Single sign-on
page.
a. In
Configuration name
, enter a name for your configuration. Up to two SAML and two JWT configurations are possible.
b. In
SAML SSO URL
textbox, paste the value of
Login URL
which you have copied from Azure portal.
c. In
Certificate fingerprint
textbox, paste the
Thumbprint
value of certificate which you have copied from Azure portal.
d. In
Remote logout URL
textbox, paste the value of
Logout URL
which you have copied from Azure portal.
e. Click
Save
.
After creating your SAML configuration, you must activate it by assigning it to end users or team members.
In the
Zendesk Admin Center
, go to
Account -> Security
and select either
Team member authentication
or
End user authentication
.
If you're assigning the configuration to team members, select
External authentication
to show the authentication options. These options are already displayed for end users.
Click the
Single sign-on (SSO)
option in the
External authentication
section, then select the name of the SSO configuration you want to use.
Select the primary SSO method for this group of users if you have more than one authentication method assigned to the group. This option sets the default method used when users go to a page that requires authentication.
Click
Save
.
Create Zendesk test user
The objective of this section is to create a user called Britta Simon in Zendesk. Zendesk supports automatic user provisioning, which is by default enabled. You can find more details
here
on how to configure automatic user provisioning.
Test SSO
In this section, you test your Azure AD single sign-on configuration with following options.
Click on
Test this application
in Azure portal. This will redirect to Zendesk Sign-on URL where you can initiate the login flow.
Go to Zendesk Sign-on URL directly and initiate the login flow from there.
You can use Microsoft My Apps. When you click the Zendesk tile in the My Apps, this will redirect to Zendesk Sign-on URL. For more information about the My Apps, see
Introduction to the My Apps
.
Next steps
Once you configure Zendesk you can enforce session control, which protects exfiltration and infiltration of your organization’s sensitive data in real time. Session control extends from Conditional Access.
Learn how to enforce session control with Microsoft Defender for Cloud Apps
.
