>
    Onboard a Zendesk App to SSPM
    Focus
    Download PDF
    Focus
    1. Home
    2. SaaS Security
    3. Onboard SaaS Apps Supported by SSPM
    4. Onboard a Zendesk App to SSPM
    Download PDF
    SaaS Security

    Onboard a Zendesk App to SSPM

    Table of Contents

    Onboard a Zendesk App to SSPM

    Connect a Zendesk instance to SSPM to detect posture risks.
    Where Can I Use This?What Do I Need?
    • Strata Cloud Manager
    • SaaS Security Posture Management license
    Or any of the following licenses that include the Data Security license:
    • CASB-X
    • CASB-PA
    For SSPM to detect posture risks in your Zendesk instance, you must onboard your Zendesk instance to SSPM. Through the onboarding process, SSPM logs in to Zendesk using administrator account credentials. SSPM uses this account to scan your Zendesk instance for misconfigured settings. If there are misconfigured settings, SSPM suggests a remediation action based on best practices.
    During the onboarding process, you will supply Zendesk account credentials to SSPM. SSPM can access the account directly or through the Okta or Microsoft Azure identity providers. If you are configuring the connection for direct login, you can optionally configure MFA, which adds an extra layer of security. If you configure the connection to use an identity provider, then MFA is required.
    To onboard your Zendesk instance, you complete the following actions:

    Collect Information for Connecting to Your Zendesk Instance

    To access your Zendesk instance, SSPM requires the following information, which you will specify during the onboarding process.
    ItemDescription
    UserThe username or email address of the administrator account. The format that you use can depend on whether SSPM will be logging in directly to your account or through an identity provider.
    (Required Permissions) The user must be assigned to the Admin role in Zendesk.
    PasswordThe password for the administrator account.
    Zendesk subdomainA character string that uniquely identifies your Zendesk account. By default, your subdomain is included in the URL that you use to access your Zendesk account. Your subdomain is also shown on the Admin home page in Zendesk.
    If SSPM will be connecting to the Zendesk account by using direct login, you can optionally have SSPM connect by using MFA. To enable SSPM to log in using MFA, you will specify the following additional information.
    ItemDescription
    Zendesk 2FA secret(Optional) A key that is used to generate one-time passcodes for multi-factor authentication.
    If you are using Okta as your identity provider, you must provide SSPM with the following additional information:
    ItemDescription
    Okta subdomainThe Okta subdomain for your organization. The subdomain was included in the login URL that Okta assigned to your organization.
    Okta 2FA secretA key that is used to generate one-time passcodes for MFA.
    If you are using Azure Active Directory (AD) as your identity provider, you must provide SSPM with the following additional information:
    ItemDescription
    Azure 2FA secretA key that is used to generate one-time passcodes for MFA.
    As you complete the following steps, make note of the values of the items described in the preceding tables. You will need to enter these values during onboarding to access your Zendesk instance from SSPM.
    1. Identify the administrator account that SSPM will use to access your Zendesk instance. The administrator must be assigned to the Admin role in Zendesk. SSPM needs this administrator access to monitor your Zendesk instance.
    2. Determine whether you want SSPM to log in to the administrator account directly, or through an identity provider. If you want SSPM to log in to the administrator account directly, determine if you want SSPM to log in using MFA.
      MFA provides an extra layer of security by requiring one-time passcodes in addition to the administrator credentials. For direct login, MFA is optional unless the Zendesk administrator account is already configured for MFA. For login using an identity provider (Okta or Microsoft Azure), MFA is required.
      1. (For direct login with MFA) To configure MFA for the administrator account:
        1. Decide which authenticator app you will use and download it to your cellphone. You can use any authenticator app that can generate time-based one-time passcodes (TOTP), such as Microsoft Authenticator or Google Authenticator.
        2. Log in to your Zendesk administrator account.
        3. Navigate to your Profile. To navigate to your Profile, locate your profile icon in the upper-right corner of the window and select profile-iconView Profile.
        4. Navigate to your profile's Security Settings.
        5. On the Security Settings tab, locate the Two-Factor Authentication section and click Manage.
        6. Set up 2FA.
        7. On the Set up two-factor authentication page, select Authenticator app as your preferred 2FA method.
        8. Click Next and follow the onscreen instructions for setting up the authenticator app, but, when you are presented with a QR code that contains the MFA secret key, don't scan it with your authenticator app. Instead, copy the MFA secret key character string, which is also displayed in the dialog, and paste it into a text file.
          Do not continue to the next step unless you have copied the MFA secret key. You will provide this key to SSPM during the onboarding process.
        9. Continue configuring your authenticator app by scanning the QR code or by manually entering the MFA key. Complete the remaining setup steps as prompted by the dialog.
      2. (For Okta log in) To access the administrator account through Okta:
        1. Identify your Okta subdomain.
        2. Generate and copy an MFA secret key.
      3. (For Microsoft Azure log in) To access the administrator account through Microsoft Azure:
        1. Enable third-party software OATH tokens for the administrator account.
        2. Configure the account for MFA and copy the MFA secret key.
    3. Identify your Zendesk subdomain.
      Unless you enabled the host-mapping feature in Zendesk, your subdomain is included in your account's URL. The URL format is <subdomain>.zendesk.com.
      If you have enabled the host-mapping feature in Zendesk, then the subdomain is mapped to your own domain, and you cannot identify the subdomain from your account's URL. In this case, you can identify your Zendesk subdomain from the Admin home page in Zendesk.
      1. To access the Admin home page, click on the gear icon in Zendesk's left navigation pane.
      2. Locate the account domain name in the upper right corner of the Admin home page. This account domain name contains your subdomain in the format <subdomain>.zendesk.com.

    Connect SSPM to Your Zendesk Instance

    By adding a Zendesk app in SSPM, you enable SSPM to connect to your Zendesk instance.
    1. Log in to Strata Cloud Manager.
    2. Select ManageConfigurationSaaS SecurityPosture SecurityApplicationsAdd Application and click the Zendesk tile.
    3. Under posture security instances, Add Instance or, if there is already an instance configured, Add New instance.
    4. Specify how you want SSPM to connect to your Zendesk instance. SSPM can Log in with Credentials, Log in with Okta, or Log in with Azure.
    5. When prompted, provide SSPM with the administrator credentials and the Zendesk subdomain. If you've configured direct login for MFA, or if SSPM is connecting to the account through an identity provider, specify the information that SSPM needs for MFA.
    6. Connect.

    © 2025 Palo Alto Networks, Inc. All rights reserved.