Onboard a Zendesk App to SSPM
Table of Contents
Onboard a Zendesk App to SSPM
Connect a Zendesk instance to SSPM to detect posture risks.
For SSPM to detect posture risks in your Zendesk instance, you must onboard your Zendesk
instance to SSPM. Through the onboarding process, SSPM logs in to Zendesk using
administrator account credentials. SSPM uses this account to scan your Zendesk
instance for misconfigured settings. If there are misconfigured settings, SSPM
suggests a remediation action based on best practices.
During the onboarding process, you will supply Zendesk account credentials to SSPM.
SSPM can access the account directly or through the Okta or Microsoft Azure identity
providers. If you are configuring the connection for direct login, you can
optionally configure MFA, which adds an extra layer of security. If you configure
the connection to use an identity provider, then MFA is required.
To onboard your Zendesk instance, you complete the following actions:
Collect Information for Connecting to Your Zendesk Instance
To access your Zendesk instance, SSPM requires the following information, which you
will specify during the onboarding process.
| Item | Description |
|---|---|
| User | The username or email address of the
administrator account. The format that you use can depend on
whether SSPM will be logging in directly to your account or
through an identity provider. (Required Permissions)
The user must be assigned to the Admin role in Zendesk.
|
| Password | The password for the administrator account. |
| Zendesk subdomain | A character string that uniquely identifies your Zendesk account. By default, your subdomain is included in the URL that you use to access your Zendesk account. Your subdomain is also shown on the Admin home page in Zendesk. |
If SSPM will be connecting to the Zendesk account by using direct login, you can
optionally have SSPM connect by using MFA. To enable SSPM to log in using MFA,
you will specify the following additional information.
| Item | Description |
|---|---|
| Zendesk 2FA secret | (Optional) A key that is used to generate one-time passcodes for multi-factor authentication. |
If you are using Okta as your identity provider, you must provide SSPM with the
following additional information:
| Item | Description |
|---|---|
| Okta subdomain | The Okta subdomain for your organization. The subdomain was included in the login URL that Okta assigned to your organization. |
| Okta 2FA secret | A key that is used to generate one-time passcodes for MFA. |
If you are using Azure Active Directory (AD) as your identity provider, you must
provide SSPM with the following additional information:
| Item | Description |
|---|---|
| Azure 2FA secret | A key that is used to generate one-time passcodes for MFA. |
As you complete the following steps, make note of the values of the items
described in the preceding tables. You will need to enter these values during
onboarding to access your Zendesk instance from SSPM.
- Identify the administrator account that SSPM will use to access your Zendesk instance. The administrator must be assigned to the Admin role in Zendesk. SSPM needs this administrator access to monitor your Zendesk instance.Determine whether you want SSPM to log in to the administrator account directly, or through an identity provider. If you want SSPM to log in to the administrator account directly, determine if you want SSPM to log in using MFA.MFA provides an extra layer of security by requiring one-time passcodes in addition to the administrator credentials. For direct login, MFA is optional unless the Zendesk administrator account is already configured for MFA. For login using an identity provider (Okta or Microsoft Azure), MFA is required.
- (For direct login with MFA) To configure MFA for the
administrator account:
- Decide which authenticator app you will use and download it to your cellphone. You can use any authenticator app that can generate time-based one-time passcodes (TOTP), such as Microsoft Authenticator or Google Authenticator.
- Log in to your Zendesk administrator account.
- Navigate to your Profile. To navigate to your Profile, locate your profile icon in the upper-right corner of the window and select .
- Navigate to your profile's Security Settings.
- On the Security Settings tab, locate the Two-Factor Authentication section and click Manage.
- Set up 2FA.
- On the Set up two-factor authentication page, select Authenticator app as your preferred 2FA method.
- Click Next and follow the onscreen
instructions for setting up the authenticator app, but, when
you are presented with a QR code that contains the MFA
secret key, don't scan it with your authenticator app.
Instead, copy the MFA secret key character string, which is
also displayed in the dialog, and paste it into a text
file.Do not continue to the next step unless you have copied the MFA secret key. You will provide this key to SSPM during the onboarding process.
- Continue configuring your authenticator app by scanning the QR code or by manually entering the MFA key. Complete the remaining setup steps as prompted by the dialog.
- (For Okta log in) To access the administrator account through Okta:
- (For Microsoft Azure log in) To access the administrator account through Microsoft Azure:
Identify your Zendesk subdomain.Unless you enabled the host-mapping feature in Zendesk, your subdomain is included in your account's URL. The URL format is <subdomain>.zendesk.com.If you have enabled the host-mapping feature in Zendesk, then the subdomain is mapped to your own domain, and you cannot identify the subdomain from your account's URL. In this case, you can identify your Zendesk subdomain from the Admin home page in Zendesk.- To access the Admin home page, click on the gear icon in Zendesk's left navigation pane.
- Locate the account domain name in the upper right corner of the Admin home page. This account domain name contains your subdomain in the format <subdomain>.zendesk.com.
Connect SSPM to Your Zendesk Instance
By adding a Zendesk app in SSPM, you enable SSPM to connect to your Zendesk instance.- From the Add Application page ( ), click the Zendesk tile.Under posture security instances, Add Instance or, if there is already an instance configured, Add New instance.Specify how you want SSPM to connect to your Zendesk instance. SSPM can Log in with Credentials, Log in with Okta, or Log in with Azure.When prompted, provide SSPM with the administrator credentials and the Zendesk subdomain. If you've configured direct login for MFA, or if SSPM is connecting to the account through an identity provider, specify the information that SSPM needs for MFA.Connect.
