Skip to main content
Connect ManageEngine ServiceDesk Plus Cloud to Oleria to see who can sign in to your service desk portal, what each technician can do there, and what changed. Oleria reads users, groups, roles, sites, built-in integrations, and the portal audit log from the ServiceDesk Plus API using OAuth credentials from a Zoho Self Client. You can review access to your service desk and take action directly from Oleria.

​
What Oleria discovers

Once connected, Oleria continuously discovers and maps the following from your ServiceDesk Plus portal:
  • Accounts - every technician and requester, with their name, email address, employee ID, job title, department, and creation date. Users with login enabled are imported as enabled. Technicians use a paid seat, and requesters are free. Oleria also imports each technician’s last login time.
  • Administrators - the portal owner and technicians with the SDAdmin role or the site-scoped SDSiteAdmin role are marked as administrators.
  • Non-human identities - the built-in System, Zia, and $Department_Head principals, and every built-in integration (for example Live Chat or Zoho Logs), imported as machine accounts. A disabled integration is shown as disabled.
  • Groups - technician support groups, with their members, and requester groups. Requester-group membership is a rule in ServiceDesk Plus rather than a list of members, so requester groups are imported without members.
  • Roles - every technician role, both built-in (such as SDAdmin, SDSiteAdmin, and SDReport) and custom, with the technicians who hold them. Requesters hold the built-in SDGuest role.
  • Sites - every site in the portal, with the technicians associated with each site. A technician’s roles apply within their associated sites, so the site access shows the roles the technician holds there.
  • Activity - the portal audit log: records created, changed, and deleted, logins enabled or disabled, role and group changes, site-association changes, and API reads made by other integrations, such as reads of users, groups, requesters, and technicians. Each event carries the user who made it, the time, and the IP address.
Oleria refreshes this data on its regular sync schedule. Activity is imported continuously, a few minutes behind real time, because ServiceDesk Plus indexes audit events with a short delay. The first sync imports up to 90 days of audit history.
Oleria doesn’t import requests, problems, changes, assets, or any other service desk content. Oleria also leaves out the record reads its own connection makes, so they don’t clutter your activity. Changes Oleria makes, such as remediation actions and their reverts, are kept.

​
Prerequisites

  • A ServiceDesk Plus Cloud portal.
  • A Zoho user with the SDAdmin role in that portal. ServiceDesk Plus lets only SDAdmin read every user, role, and audit log entry, and change other users’ logins, roles, and groups.
  • Access to the Zoho API Console for the data center your portal is hosted in.
  • Admin access to the Oleria workspace.
Generate the credentials while signed in as a dedicated service-account user with the SDAdmin role in the portal. The refresh token acts as the user who created it, so the connection stops working if that user is removed from the portal or loses the SDAdmin role. A Zoho user who isn’t a member of the portal can’t connect at all, even if they own the Self Client.The service-account user must be a technician with login enabled and the SDAdmin role, so it uses one technician license. The SDSiteAdmin role isn’t enough: Oleria checks for SDAdmin when you select Authenticate.

​
Find your data center and portal name

1

Identify your data center

Your data center is the host in your ServiceDesk Plus address. In Oleria, choose the Data Center option that shows the same host, for example United States (sdpondemand.manageengine.com). Use the matching API Console and accounts server in the steps below:
2

Copy your portal name

Sign in to ServiceDesk Plus and look at the address bar. The portal name is the part after /app/. For example, in https://sdpondemand.manageengine.com/app/itdesk/HomePage.do the portal name is itdesk.

​
Create a Self Client and refresh token in Zoho

1

Create a Self Client

Sign in to the API Console for your data center as the SDAdmin user. Select Add Client (or Get Started), choose Self Client, and select Create.
2

Copy the client credentials

Open the Client Secret tab and copy the Client ID and Client Secret.
3

Generate a grant code

Open the Generate Code tab and enter these scopes exactly:
SDPOnDemand.users.ALL lets Oleria read users and run the remediation actions. SDPOnDemand.setup.ALL covers roles, groups, sites, integrations, the license, and the audit log. SDPOnDemand.general.ALL covers the portal settings Oleria uses to confirm the user’s role.Choose a time duration, enter a description such as Oleria, and select Create. If Zoho asks you to choose a portal, select the ServiceDesk Plus portal you’re connecting. Copy the grant code.
The grant code expires after the duration you chose, which can be as short as a few minutes. Complete the next step before it expires.
4

Exchange the grant code for a refresh token

On a trusted machine, run the following commands. Replace the accounts server with the one for your data center and the placeholders with your values. The first command prompts for the client secret without showing it or saving it to your shell history:
Copy the refresh_token value from the response. Don’t paste the response into tickets or chat, because it contains the refresh token.
Zoho returns the refresh token only once. Store it securely. If you lose it, generate a new grant code and repeat this step.
The exact location of these settings can change over time. If the steps above don’t match what you see, refer to Zoho’s own API documentation.

​
Connect ServiceDesk Plus to Oleria

1

Open the integration

Go to your Oleria workspace, select Integrations -> select ManageEngine ServiceDesk Plus.
2

Complete the connection form

Select Continue and provide the following:
3

Confirm the connection

Select Authenticate to validate the credentials. Oleria checks that the refresh token works in the selected data center, that its user belongs to the portal and holds the SDAdmin role, and that the user list can be read. Find the newly connected portal on the Connected tab of your Oleria Integrations page.
If Authenticate fails, check the Data Center and the Portal first. A refresh token issued in one data center doesn’t work in another, and a user who isn’t a member of the portal can’t read it.
You can connect each ServiceDesk Plus portal to Oleria once. To connect a different portal, add a new integration.

​
Verify the integration

Confirm the ServiceDesk Plus portal appears on the Connected tab of your Oleria Integrations page with a status of Healthy. After the first sync completes, you can review the discovered accounts, groups, roles, sites, and activity in your Oleria workspace.
If you revoke the refresh token or replace the Self Client in Zoho, update the integration in Oleria with the new values. To keep the stored client secret or refresh token when you edit other settings, leave that field empty. You can’t change the portal of an existing integration.

​
Remediation actions

Oleria can take these actions in ServiceDesk Plus. Each one runs with the permissions of the user who created the refresh token, and each one except deleting a user can be reverted:
  • Disable login and enable login. Disabling a technician’s login also removes their roles in ServiceDesk Plus, so Oleria records the roles first, and reverting the action restores the login together with those roles.
  • Add a role to a technician and remove a role from a technician. If the technician’s login was disabled after a role was removed, reverting the removal enables the login again with that role.
  • Add a technician to a support group and remove a technician from a support group. Other group memberships are kept.
  • Create a user. Oleria creates a requester with the name and email address you give, with login enabled if you choose to activate the user. Reverting the action deletes that requester. If a user with that email address already exists, the action completes without changing anything, unless you chose to activate the user: then it fails, so the existing user is never changed. Requesters have no support groups, so a request that includes groups is refused.
  • Delete a user. Oleria deletes the technician or requester from the portal. If the user is already deleted, the action completes without changing anything. ServiceDesk Plus can’t restore a deleted user, so this action can’t be reverted.
  • Disable a non-human identity. Oleria disables a built-in integration, such as Live Chat. Reverting the action enables it again.
If the user or integration no longer exists in ServiceDesk Plus, the action fails without changing anything (deleting a user who is already deleted counts as done). A revert whose target no longer exists completes without changing anything. Keep these limits in mind:
  • Roles can be added only to technicians whose login is enabled.
  • A technician with login enabled must keep at least one role. To remove access entirely, disable the login instead.
  • To enable login for a technician who has none, ServiceDesk Plus needs roles at the same time. Use Revert on the disable action, or enable the login in ServiceDesk Plus.
  • Roles and groups belong to technicians. For requesters, Oleria can disable or enable the login, and create or delete the requester.
  • Oleria won’t disable the login of, change the roles of, or delete the user who created the refresh token, because that would disconnect the integration. The built-in System, Zia, and $Department_Head principals can’t be changed from Oleria.

​
Known limitations

  • Oleria doesn’t import MFA or single sign-on settings for ServiceDesk Plus users. These are managed in Zoho Accounts and Zoho Directory. Oleria reports MFA as unavailable, and reports single sign-on as not configured unless your portal is licensed for SAML login.
  • Oleria doesn’t import sign-in events or password changes. Zoho Accounts records these, not the ServiceDesk Plus audit log.
  • Oleria doesn’t import the Zoho Self Clients or OAuth tokens that other tools use to call the ServiceDesk Plus API. These are managed in the Zoho API Console.
  • Requesters don’t have a last login time in the ServiceDesk Plus API.
  • Projects are available only on higher ServiceDesk Plus editions and aren’t imported.
  • A role’s detailed permissions are configured only in the ServiceDesk Plus interface. Oleria imports the role names.
  • Oleria can’t create support groups. Create them in ServiceDesk Plus under Setup > Users & Permissions > Technician Groups, then add technicians to them from Oleria.
  • Oleria paces its requests to leave room for your other ServiceDesk Plus integrations.

​
Contact us

For questions about this integration, contact us at support@oleria.com.