> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oleria.com/llms.txt
> Use this file to discover all available pages before exploring further.

# ManageEngine ServiceDesk Plus

> Connect ManageEngine ServiceDesk Plus Cloud to Oleria to bring technicians, requesters, groups, roles, site access, non-human identities, and audit activity into your identity and access graph.

Connect ManageEngine ServiceDesk Plus Cloud to Oleria to see who can sign in to your service desk portal, what each technician can do there, and what changed. Oleria reads users, groups, roles, sites, built-in integrations, and the portal audit log from the ServiceDesk Plus API using OAuth credentials from a Zoho Self Client. You can review access to your service desk and take action directly from Oleria.

## What Oleria discovers

Once connected, Oleria continuously discovers and maps the following from your ServiceDesk Plus portal:

* **Accounts** - every technician and requester, with their name, email address, employee ID, job title, department, and creation date. Users with login enabled are imported as enabled. Technicians use a paid seat, and requesters are free. Oleria also imports each technician's last login time.
* **Administrators** - the portal owner and technicians with the **SDAdmin** role or the site-scoped **SDSiteAdmin** role are marked as administrators.
* **Non-human identities** - the built-in **System**, **Zia**, and **\$Department\_Head** principals, and every built-in integration (for example Live Chat or Zoho Logs), imported as machine accounts. A disabled integration is shown as disabled.
* **Groups** - technician support groups, with their members, and requester groups. Requester-group membership is a rule in ServiceDesk Plus rather than a list of members, so requester groups are imported without members.
* **Roles** - every technician role, both built-in (such as SDAdmin, SDSiteAdmin, and SDReport) and custom, with the technicians who hold them. Requesters hold the built-in **SDGuest** role.
* **Sites** - every site in the portal, with the technicians associated with each site. A technician's roles apply within their associated sites, so the site access shows the roles the technician holds there.
* **Activity** - the portal audit log: records created, changed, and deleted, logins enabled or disabled, role and group changes, site-association changes, and API reads made by other integrations, such as reads of users, groups, requesters, and technicians. Each event carries the user who made it, the time, and the IP address.

Oleria refreshes this data on its [regular sync schedule](/integrations/overview#sync-model). Activity is imported continuously, a few minutes behind real time, because ServiceDesk Plus indexes audit events with a short delay. The first sync imports up to 90 days of audit history.

<Note>
  Oleria doesn't import requests, problems, changes, assets, or any other service desk content. Oleria also leaves out the record reads its own connection makes, so they don't clutter your activity. Changes Oleria makes, such as remediation actions and their reverts, are kept.
</Note>

## Prerequisites

* A ServiceDesk Plus Cloud portal.
* A Zoho user with the **SDAdmin** role in that portal. ServiceDesk Plus lets only SDAdmin read every user, role, and audit log entry, and change other users' logins, roles, and groups.
* Access to the Zoho API Console for the data center your portal is hosted in.
* Admin access to the Oleria workspace.

<Warning>
  Generate the credentials while signed in as a dedicated service-account user with the SDAdmin role in the portal. The refresh token acts as the user who created it, so the connection stops working if that user is removed from the portal or loses the SDAdmin role. A Zoho user who isn't a member of the portal can't connect at all, even if they own the Self Client.

  The service-account user must be a technician with login enabled and the **SDAdmin** role, so it uses one technician license. The **SDSiteAdmin** role isn't enough: Oleria checks for SDAdmin when you select **Authenticate**.
</Warning>

## Find your data center and portal name

<Steps>
  <Step title="Identify your data center">
    Your data center is the host in your ServiceDesk Plus address. In Oleria, choose the **Data Center** option that shows the same host, for example **United States (sdpondemand.manageengine.com)**. Use the matching API Console and accounts server in the steps below:

    | Data Center in Oleria | API Console | Accounts server |
    | :- | :- | :- |
    | **United States (sdpondemand.manageengine.com)** | `api-console.zoho.com` | `accounts.zoho.com` |
    | **Europe (sdpondemand.manageengine.eu)** | `api-console.zoho.eu` | `accounts.zoho.eu` |
    | **India (sdpondemand.manageengine.in)** | `api-console.zoho.in` | `accounts.zoho.in` |
    | **Australia (servicedeskplus.net.au)** | `api-console.zoho.com.au` | `accounts.zoho.com.au` |
    | **Japan (servicedeskplus.jp)** | `api-console.zoho.jp` | `accounts.zoho.jp` |
    | **Canada (servicedeskplus.ca)** | `api-console.zohocloud.ca` | `accounts.zohocloud.ca` |
    | **Saudi Arabia (servicedeskplus.sa)** | `api-console.zoho.sa` | `accounts.zoho.sa` |
    | **United Kingdom (servicedeskplus.uk)** | `api-console.zoho.uk` | `accounts.zoho.uk` |
    | **UAE (servicedeskplus.ae)** | `api-console.zoho.ae` | `accounts.zoho.ae` |
    | **China (servicedeskplus.cn)** | `api-console.zoho.com.cn` | `accounts.zoho.com.cn` |
  </Step>

  <Step title="Copy your portal name">
    Sign in to ServiceDesk Plus and look at the address bar. The portal name is the part after `/app/`. For example, in `https://sdpondemand.manageengine.com/app/itdesk/HomePage.do` the portal name is `itdesk`.
  </Step>
</Steps>

## Create a Self Client and refresh token in Zoho

<Steps>
  <Step title="Create a Self Client">
    Sign in to the API Console for your data center as the SDAdmin user. Select **Add Client** (or **Get Started**), choose **Self Client**, and select **Create**.
  </Step>

  <Step title="Copy the client credentials">
    Open the **Client Secret** tab and copy the **Client ID** and **Client Secret**.
  </Step>

  <Step title="Generate a grant code">
    Open the **Generate Code** tab and enter these scopes exactly:

    ```text theme={null}
    SDPOnDemand.users.ALL,SDPOnDemand.setup.ALL,SDPOnDemand.general.ALL
    ```

    `SDPOnDemand.users.ALL` lets Oleria read users and run the [remediation actions](#remediation-actions). `SDPOnDemand.setup.ALL` covers roles, groups, sites, integrations, the license, and the audit log. `SDPOnDemand.general.ALL` covers the portal settings Oleria uses to confirm the user's role.

    Choose a time duration, enter a description such as `Oleria`, and select **Create**. If Zoho asks you to choose a portal, select the ServiceDesk Plus portal you're connecting. Copy the grant code.

    <Note>
      The grant code expires after the duration you chose, which can be as short as a few minutes. Complete the next step before it expires.
    </Note>
  </Step>

  <Step title="Exchange the grant code for a refresh token">
    On a trusted machine, run the following commands. Replace the accounts server with the one for your data center and the placeholders with your values. The first command prompts for the client secret without showing it or saving it to your shell history:

    ```bash theme={null}
    read -rs ZOHO_CLIENT_SECRET
    curl -X POST "https://accounts.zoho.com/oauth/v2/token" \
      -d "grant_type=authorization_code" \
      -d "client_id=YOUR_CLIENT_ID" \
      --data-urlencode "client_secret=$ZOHO_CLIENT_SECRET" \
      -d "code=YOUR_GRANT_CODE"
    ```

    Copy the `refresh_token` value from the response. Don't paste the response into tickets or chat, because it contains the refresh token.

    <Warning>
      Zoho returns the refresh token only once. Store it securely. If you lose it, generate a new grant code and repeat this step.
    </Warning>
  </Step>
</Steps>

<Note>
  The exact location of these settings can change over time. If the steps above don't match what you see, refer to Zoho's own API documentation.
</Note>

## Connect ServiceDesk Plus to Oleria

<Steps>
  <Step title="Open the integration">
    Go to your Oleria workspace, select **Integrations** -> select **ManageEngine ServiceDesk Plus**.
  </Step>

  <Step title="Complete the connection form">
    Select **Continue** and provide the following:

    | Field | Notes |
    | :- | :- |
    | Data Center | Required. The data center your portal is hosted in. Defaults to **United States (sdpondemand.manageengine.com)**. |
    | Portal | Required. The portal name from your ServiceDesk Plus address, for example `itdesk`. |
    | Client ID | Required. The Client ID of your Self Client. |
    | Client Secret | Required. The Client Secret of your Self Client. |
    | Refresh Token | Required. The refresh token you generated. |
  </Step>

  <Step title="Confirm the connection">
    Select **Authenticate** to validate the credentials. Oleria checks that the refresh token works in the selected data center, that its user belongs to the portal and holds the SDAdmin role, and that the user list can be read. Find the newly connected portal on the **Connected** tab of your Oleria **Integrations** page.
  </Step>
</Steps>

If **Authenticate** fails, check the **Data Center** and the **Portal** first. A refresh token issued in one data center doesn't work in another, and a user who isn't a member of the portal can't read it.

<Note>
  You can connect each ServiceDesk Plus portal to Oleria once. To connect a different portal, add a new integration.
</Note>

## Verify the integration

Confirm the ServiceDesk Plus portal appears on the **Connected** tab of your Oleria **Integrations** page with a status of **Healthy**. After the first sync completes, you can review the discovered accounts, groups, roles, sites, and activity in your Oleria workspace.

<Note>
  If you revoke the refresh token or replace the Self Client in Zoho, update the integration in Oleria with the new values. To keep the stored client secret or refresh token when you edit other settings, leave that field empty. You can't change the portal of an existing integration.
</Note>

## Remediation actions

Oleria can take these actions in ServiceDesk Plus. Each one runs with the permissions of the user who created the refresh token, and each one except deleting a user can be reverted:

* **Disable login** and **enable login**. Disabling a technician's login also removes their roles in ServiceDesk Plus, so Oleria records the roles first, and reverting the action restores the login together with those roles.
* **Add a role to a technician** and **remove a role from a technician**. If the technician's login was disabled after a role was removed, reverting the removal enables the login again with that role.
* **Add a technician to a support group** and **remove a technician from a support group**. Other group memberships are kept.
* **Create a user**. Oleria creates a requester with the name and email address you give, with login enabled if you choose to activate the user. Reverting the action deletes that requester. If a user with that email address already exists, the action completes without changing anything, unless you chose to activate the user: then it fails, so the existing user is never changed. Requesters have no support groups, so a request that includes groups is refused.
* **Delete a user**. Oleria deletes the technician or requester from the portal. If the user is already deleted, the action completes without changing anything. ServiceDesk Plus can't restore a deleted user, so this action can't be reverted.
* **Disable a non-human identity**. Oleria disables a built-in integration, such as Live Chat. Reverting the action enables it again.

If the user or integration no longer exists in ServiceDesk Plus, the action fails without changing anything (deleting a user who is already deleted counts as done). A revert whose target no longer exists completes without changing anything.

Keep these limits in mind:

* Roles can be added only to technicians whose login is enabled.
* A technician with login enabled must keep at least one role. To remove access entirely, disable the login instead.
* To enable login for a technician who has none, ServiceDesk Plus needs roles at the same time. Use **Revert** on the disable action, or enable the login in ServiceDesk Plus.
* Roles and groups belong to technicians. For requesters, Oleria can disable or enable the login, and create or delete the requester.
* Oleria won't disable the login of, change the roles of, or delete the user who created the refresh token, because that would disconnect the integration. The built-in System, Zia, and \$Department\_Head principals can't be changed from Oleria.

## Known limitations

* Oleria doesn't import MFA or single sign-on settings for ServiceDesk Plus users. These are managed in Zoho Accounts and Zoho Directory. Oleria reports MFA as unavailable, and reports single sign-on as not configured unless your portal is licensed for SAML login.
* Oleria doesn't import sign-in events or password changes. Zoho Accounts records these, not the ServiceDesk Plus audit log.
* Oleria doesn't import the Zoho Self Clients or OAuth tokens that other tools use to call the ServiceDesk Plus API. These are managed in the Zoho API Console.
* Requesters don't have a last login time in the ServiceDesk Plus API.
* Projects are available only on higher ServiceDesk Plus editions and aren't imported.
* A role's detailed permissions are configured only in the ServiceDesk Plus interface. Oleria imports the role names.
* Oleria can't create support groups. Create them in ServiceDesk Plus under **Setup** > **Users & Permissions** > **Technician Groups**, then add technicians to them from Oleria.
* Oleria paces its requests to leave room for your other ServiceDesk Plus integrations.

## Contact us

For questions about this integration, contact us at [support@oleria.com](mailto:support@oleria.com).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.