Skip to main content
Connect Zendesk to Oleria to see every agent and admin in your Zendesk instance, the groups they belong to, and the built-in and custom roles they hold. Oleria connects to Zendesk using OAuth 2.0.

​
What Oleria discovers

Once connected, Oleria continuously discovers and maps the following from your Zendesk instance:
  • Accounts - every agent and admin in your Zendesk instance. End-user (customer) accounts are not in scope - Oleria focuses on the team members who have access to Zendesk itself.
  • Groups - all groups, including the default group Zendesk creates automatically, and each account’s group membership.
  • Roles - both built-in roles (Agent, Admin) and any custom roles you’ve defined, along with each account’s role assignment.

​
Prerequisites

  • Zendesk Admin Center access to create an OAuth client (Apps and integrations -> Connections -> OAuth clients)
  • Admin access to the Oleria workspace
Use a service account (not an employee account) to create the OAuth client, so the integration keeps working if the employee leaves or changes roles.

​
Create an OAuth client in Zendesk

1

Add a new OAuth client

In your Zendesk Admin Center, go to Apps and integrations -> Connections -> OAuth clients and add a new client. Set Client kind to Confidential - Public clients are forced to use PKCE, which this integration doesn’t support.
2

Add the redirect URL

In the same OAuth client, add a Redirect URL: your Oleria workspace URL (the one in your browser’s address bar), followed by /workspace/integrations/zendesk/connect. For example:
Zendesk rejects the connection if this doesn’t match exactly. This step is required even though the redirect happens automatically - Zendesk validates it against the OAuth client before allowing the connection.
3

Set the scopes

In the Scopes box, check read. If you also want Oleria to perform remediation actions (suspending users, managing group and role membership), check write as well.
Zendesk caps the connection to whatever scopes are checked here, regardless of what you request when connecting in Oleria. If you enable write actions in Oleria but the OAuth client itself only has read checked, the connection succeeds but write actions fail - check write in both places.
4

Copy the client credentials

Copy the Client ID and Client Secret for the new OAuth client. Zendesk shows the secret only once.
You’ll enter these into Oleria’s connection form as OAuth Client Identifier and OAuth Client Secret - same values, different labels.

​
Connect Zendesk to Oleria

1

Open the integration

Go to your Oleria workspace, select Integrations -> select Zendesk.
2

Complete the connection form

Select Continue and provide the following:
3

Authorize the connection

Select Authenticate. You’re redirected to Zendesk to sign in and approve access, then redirected back to Oleria automatically.

​
Verify the integration

Confirm Zendesk appears on the Connected tab of your Oleria Integrations page. After the first sync completes, you can review the discovered agents, admins, groups, and roles in your Oleria workspace.

​
Remediation actions

Beyond discovery, Oleria can act on Zendesk access to remediate risk. Remediation actions require the write scope, granted in both the Zendesk OAuth client’s Scopes box and the Oleria connection form.

​
Known limitations

  • End-users are out of scope. Oleria inventories agents and admins only - Zendesk’s end-user (customer) accounts are not workforce identities and aren’t collected.
  • MFA and SSO status are unavailable. Zendesk doesn’t expose an API signal for organization-wide MFA or SSO policy in the scope Oleria uses, so these fields report as unavailable rather than a false negative.
  • API-access detection is best-effort. Oleria infers whether an account can generate or use API credentials from its custom role’s permissions. This is the closest available signal, not a field Zendesk exposes directly.

​
Contact us

For questions about this integration, contact us at support@oleria.com.