Skip to main content
Oleria provides identity security and access management teams with visibility and intelligence into who has access to what, where they got that access, how they use it, and whether they should even have it. As part of that promise, we integrate your Zendesk instance into the Oleria platform. This page provides step-by-step guidance for connecting Zendesk to your Oleria workspace using OAuth 2.0.

​
What Oleria discovers

Once connected, Oleria continuously discovers and maps the following from your Zendesk instance:
  • Accounts - every agent and admin in your Zendesk instance. End-user (customer) accounts are not in scope - Oleria focuses on the team members who have access to Zendesk itself.
  • Groups - all groups, including the default group Zendesk creates automatically, and each account’s group membership.
  • Roles - both built-in roles (Agent, Admin) and any custom roles you’ve defined, along with each account’s role assignment.

​
Prerequisites

  • Zendesk Admin Center access to create an OAuth client (Apps and integrations -> Connections -> OAuth clients)
  • Admin access to the Oleria workspace
Use a service account (not an employee account) to create the OAuth client, so the integration keeps working if the employee leaves or changes roles.

​
Create an OAuth client in Zendesk

1

Add a new OAuth client

In your Zendesk Admin Center, go to Apps and integrations -> Connections -> OAuth clients and add a new client. Set Client kind to Confidential - Public clients are forced to use PKCE, which this integration doesn’t support.
2

Add the redirect URL

In the same OAuth client, add a Redirect URL: your Oleria workspace URL (the one in your browser’s address bar), followed by /workspace/integrations/zendesk/connect. For example:
Zendesk rejects the connection if this doesn’t match exactly. This step is required even though the redirect happens automatically - Zendesk validates it against the OAuth client before allowing the connection.
3

Set the scopes

In the Scopes box, check read. If you also want Oleria to perform remediation actions (suspending users, managing group and role membership), check write as well.
Zendesk caps the connection to whatever scopes are checked here, regardless of what you request when connecting in Oleria. If you enable write actions in Oleria but the OAuth client itself only has read checked, the connection succeeds but write actions fail - check write in both places.
4

Copy the client credentials

Copy the Client ID and Client Secret for the new OAuth client. Zendesk shows the secret only once.
You’ll enter these into Oleria’s connection form as OAuth Client Identifier and OAuth Client Secret - same values, different labels.

​
Connect Zendesk to Oleria

1

Open the integration

Go to your Oleria workspace, select Integrations -> select Zendesk.
2

Complete the connection form

Select Continue and provide the following:
3

Authorize the connection

Select Authenticate. You’re redirected to Zendesk to log in and approve access, then redirected back to Oleria automatically.

​
Verify the integration

Confirm Zendesk appears in your Oleria workspace connected integrations. After the first sync completes, you can review the discovered agents, admins, groups, and roles in your Oleria workspace.

​
Governance actions

Beyond discovery, Oleria can act on Zendesk access to remediate risk. Governance actions require the write scope, granted in both the Zendesk OAuth client’s Scopes box and the Oleria connection form.

​
Known limitations

  • End-users are out of scope. Oleria inventories agents and admins only - Zendesk’s end-user (customer) accounts are not workforce identities and aren’t collected.
  • MFA and SSO status are unavailable. Zendesk doesn’t expose an API signal for organization-wide MFA or SSO policy in the scope Oleria uses, so these fields report as unavailable rather than a false negative.
  • API-access detection is best-effort. Oleria infers whether an account can generate or use API credentials from its custom role’s permissions. This is the closest available signal, not a field Zendesk exposes directly.

​
Contact us

For questions about this integration, contact us at support@oleria.com.