# Integrating SailPoint with Zendesk SaaS SailPoint's Zendesk SaaS connector is used to manage Zendesk user accounts. This guide is designed to provide the information required to configure a working instance. After it is successfully configured, your organization will be able to aggregate and provision accounts for Zendesk user accounts. > [!NOTE] > > To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes]() page. ## Supported Features The Zendesk SaaS connector supports the following features: - Aggregate Zendesk users and groups - Provision Zendesk users - \*Certification - \*Password Management - Delete Account For more information on features, refer to [Source Features](). > [!NOTE] > > Before you can use any item marked with an asterisk (\*), SailPoint must activate the feature for your site. The Zendesk SaaS connector supports multiple group objects. The details of the features are: | Feature | Users | | --- | --- | | Aggregate | ✔ | | Create | ✔ | | Group Entitlements (Read, Request, Revoke) | Groups, Organizations, Custom Agent Role | | Password Management | ✔ | ### Group Entitlements Group Entitlements are the entitlement types for which SailPoint provides the ability to aggregate additional details (of these entitlement types) from the managed system. These objects have a separate schema defining list of attributes. The aggregation task fetches the attributes as additional details when aggregation is run for that group entitlement type. | Feature | Groups | Organizations | Custom Agent Role | | --- | --- | --- | --- | | Aggregation | ✔ | ✔ | ✔ | ### Activity Insights Activity Insights supports activity from Zendesk and its associated accounts. This allows you to gather account information and activity data from Zendesk. > [!IMPORTANT] > > Contact your SailPoint Customer Success Manager (CSM) for more information on Activity Insights. For more information on configuring Activity Insights, refer to Activity Insights Settings. ### Password Management If Password Management is enabled for your organization, you can change the password for a user of the source. After enabling password management on the source, be aware of the following: - The password policy defined in SailPoint applies to accounts on this source. - If you change the password for an application connected to this source, the change will automatically be made to the source itself. For more information on configuring password management, refer to [Password Management Overview](). ## Supported Managed Systems The Zendesk SaaS connector supports the Zendesk Cloud application as configured. Ensure that an appropriate plan is activated in the Zendesk instance. ## Prerequisites You must set up a service account that has the administrator role to perform all the operations. If you want to use the Zendesk SaaS for read only operations, assign the agent role to the source service account with appropriate permission in the role for End-user profile access and View user profile lists on the Zendesk system. ### For Basic Authentication - Set the Password Access or Token Access as Enabled in the Zendesk API admin configuration. ### For OAuth 2.0 Authentication - Set the Password Access as Enabled in the Zendesk API admin configuration. - Create a new OAuth client by providing the Client Name in the Zendesk API admin configuration. - Use the same Client Name for the Client ID and generated Client Secret on your Zendesk application. - The Client Secret is visible in the Zendesk managed system only during the creation of the OAuth client. For the most up-to-date information about performing tasks in Zendesk, refer to the [Zendesk documentation](). ### Enable Password or Token Access Follow the following steps to enable password or token access: 1. In Zendesk Support, select **Admin \> Channels \> API**. 2. In the **Settings** tab, enable Password Access or Token Access. ### Create OAuth Client Follow the following steps to create OAuth client: 1. In Zendesk Support, select **Admin \> Channels \> API**, and then select the **OAuth clients** tab. 2. Select the plus icon **(+)** located beside the client list. 3. Complete the following fields to create a client: - **Client Name**: Enter a name for your app. This is the name that users will see when asked to grant access to your application, and when they check the list of third-party apps that have access to their Zendesk. - **Description**: Optional. This is a short description of your app that users will see when asked to grant access to it. - **Company**: Optional. This is the company name that users will see when asked to grant access to your application. The information can help them understand who they're granting access to. - **Logo**: Optional. This is the logo that users will see when asked to grant access to your application. The image can be a JPG, GIF, or PNG. For best results, upload a square image. It will be resized for the authorization page. - **Unique Identifier**: The field is auto-populated with a reformatted version of the name you entered for your app. You can change it if you want. - **Redirect URLs**: Enter the URL or URLs that Zendesk should use to send the user's decision to grant access to your application. The URLs must be absolute and not relative, https (unless localhost or 127.0.0.1), and newline-separated. 4. Select **Save**. After the page refreshes, a new pre-populated Secret field appears on the lower side. This is the `client_secret` value specified in the OAuth2 spec. 5. Copy the **Secret** value to your clipboard and save it somewhere safe. > **Note** > > The characters may extend past the width of the text box, so make sure to select everything before copying. > **Important** > > For security reasons, your secret is displayed fully only once. After selecting **Save**, you'll only have access to the first nine characters. 6. Select **Save**. Use the unique identifier and the secret value in the source configuration. ## Required Permissions - The service account must have the administrator role to perform all the operations. > **Note** > > If the connector is used for read only operations, then the service account can be limited to an agent role with the appropriate permission in the role for End-user profile access and View user profile lists.