> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oleria.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Zendesk

> Connect your Zendesk instance to Oleria to continuously discover and map who has access across your Zendesk agents, admins, groups, and custom roles.

Oleria provides identity security and access management teams with visibility and intelligence into who has access to what, where they got that access, how they use it, and whether they should even have it. As part of that promise, we integrate your Zendesk instance into the Oleria platform. This page provides step-by-step guidance for connecting Zendesk to your Oleria workspace using OAuth 2.0.

## What Oleria discovers

Once connected, Oleria continuously discovers and maps the following from your Zendesk instance:

* **Accounts** - every agent and admin in your Zendesk instance. End-user (customer) accounts are not in scope - Oleria focuses on the team members who have access to Zendesk itself.
* **Groups** - all groups, including the default group Zendesk creates automatically, and each account's group membership.
* **Roles** - both built-in roles (Agent, Admin) and any custom roles you've defined, along with each account's role assignment.

## Prerequisites

* Zendesk Admin Center access to create an OAuth client (**Apps and integrations** -> **Connections** -> **OAuth clients**)
* Admin access to the Oleria workspace

<Note>
  Use a service account (not an employee account) to create the OAuth client, so the integration keeps working if the employee leaves or changes roles.
</Note>

## Create an OAuth client in Zendesk

<Steps>
  <Step title="Add a new OAuth client">
    In your Zendesk Admin Center, go to **Apps and integrations** -> **Connections** -> **OAuth clients** and add a new client. Set **Client kind** to **Confidential** - Public clients are forced to use PKCE, which this integration doesn't support.
  </Step>

  <Step title="Add the redirect URL">
    In the same OAuth client, add a **Redirect URL**: your Oleria workspace URL (the one in your browser's address bar), followed by `/workspace/integrations/zendesk/connect`. For example:

    ```
    https://acme.oleria.com/workspace/integrations/zendesk/connect
    ```

    <Warning>
      Zendesk rejects the connection if this doesn't match exactly. This step is required even though the redirect happens automatically - Zendesk validates it against the OAuth client before allowing the connection.
    </Warning>
  </Step>

  <Step title="Set the scopes">
    In the **Scopes** box, check **read**. If you also want Oleria to perform remediation actions (suspending users, managing group and role membership), check **write** as well.

    <Note>
      Zendesk caps the connection to whatever scopes are checked here, regardless of what you request when connecting in Oleria. If you enable write actions in Oleria but the OAuth client itself only has **read** checked, the connection succeeds but write actions fail - check **write** in both places.
    </Note>
  </Step>

  <Step title="Copy the client credentials">
    Copy the **Client ID** and **Client Secret** for the new OAuth client. Zendesk shows the secret only once.

    <Note>
      You'll enter these into Oleria's connection form as **OAuth Client Identifier** and **OAuth Client Secret** - same values, different labels.
    </Note>
  </Step>
</Steps>

## Connect Zendesk to Oleria

<Steps>
  <Step title="Open the integration">
    Go to your Oleria workspace, select **Integrations** -> select **Zendesk**.
  </Step>

  <Step title="Complete the connection form">
    Select **Continue** and provide the following:

    | Field                                                  | Notes                                                                                                                                 |
    | :----------------------------------------------------- | :------------------------------------------------------------------------------------------------------------------------------------ |
    | Zendesk Subdomain                                      | The part of your Zendesk URL before `.zendesk.com` - for example `acme` if you access Zendesk at `acme.zendesk.com`.                  |
    | OAuth Client Identifier                                | Copied from the OAuth client you created in Zendesk                                                                                   |
    | OAuth Client Secret                                    | Copied from the OAuth client you created in Zendesk                                                                                   |
    | I authorize Oleria to perform write actions in Zendesk | Check this if you also checked **write** in the OAuth client's Scopes box, and want Oleria to be able to perform remediation actions. |
  </Step>

  <Step title="Authorize the connection">
    Select **Authenticate**. You're redirected to Zendesk to log in and approve access, then redirected back to Oleria automatically.
  </Step>
</Steps>

## Verify the integration

Confirm Zendesk appears in your Oleria workspace connected integrations. After the first sync completes, you can review the discovered agents, admins, groups, and roles in your Oleria workspace.

## Governance actions

Beyond discovery, Oleria can act on Zendesk access to remediate risk. Governance actions require the **write** scope, granted in both the Zendesk OAuth client's Scopes box and the Oleria connection form.

| Action            | Reversible?                                                                                        |
| :---------------- | :------------------------------------------------------------------------------------------------- |
| Suspend user      | Yes - reversed by reactivating the same user.                                                      |
| Reactivate user   | Yes - reversed by re-suspending the same user.                                                     |
| Assign role       | Yes - reversed by restoring the account's previous role (or clearing it, if the account had none). |
| Remove role       | No - reassigning the removed role automatically isn't supported.                                   |
| Add to group      | No - removing the account from the group automatically isn't supported.                            |
| Remove from group | No - re-adding the account to the group automatically isn't supported.                             |

## Known limitations

* **End-users are out of scope.** Oleria inventories agents and admins only - Zendesk's end-user (customer) accounts are not workforce identities and aren't collected.
* **MFA and SSO status are unavailable.** Zendesk doesn't expose an API signal for organization-wide MFA or SSO policy in the scope Oleria uses, so these fields report as unavailable rather than a false negative.
* **API-access detection is best-effort.** Oleria infers whether an account can generate or use API credentials from its custom role's permissions. This is the closest available signal, not a field Zendesk exposes directly.

## Contact us

For questions about this integration, contact us at [support@oleria.com](mailto:support@oleria.com).