With the Zendesk integration, you can manage support platform access through Opal:
- Allow users to request just-in-time access to Zendesk groups, organizations, and custom roles from the web and Slack
- Set the right resource owners to delegate approvals to those with the most context
- Configure day-one access to Zendesk resources with groups from your identity provider
Supported resources
| Resource | Read | Grant and revoke access | Notes |
|---|
| Zendesk Groups | ✔️ | ✔️ | |
| Zendesk Organizations | ✔️ | ✔️ | |
| Zendesk Custom Roles | ✔️ | ✔️ | Enterprise only |
Requirements
- You must be an Opal admin.
- You must have admin access to your Zendesk account to generate an API token.
- Be on version 1.1168.0 or greater, if you self-host Opal.
1. Create a Zendesk API token
In Zendesk, generate an API token by navigating to Admin Center > Apps and integrations > APIs > Zendesk API and enabling token access if not already on. Click Add API token, give it a description (e.g., Opal), and copy the token — it is only shown once.
2. Create a Zendesk app in Opal
In Opal, go to Inventory > +App and select Zendesk. Fill in the following fields and hit create.
| Field | Value |
|---|
| App admin | The team or user that should manage the Zendesk app in Opal. |
| Description | Let your end users know what they’re requesting access to. |
| Subdomain | The subdomain of your Zendesk instance (e.g., mycompany from mycompany.zendesk.com). |
| Admin email | The email address of the Zendesk admin/agent who generated the API token. |
| API token | The API token you generated in Step 1. |
3. Import Zendesk resources
After creating the app, you can import resources from … > Import items. Users will now be able to request access to Zendesk groups, organizations, and custom roles through Opal.
User provisioning
Opal can automatically provision and deprovision users in Zendesk.
When provisioning is enabled, users who don’t already have a Zendesk account are automatically created as agents when they are granted access to a Zendesk resource. Deprovisioning permanently deletes users from Zendesk when their access is revoked.
Organizations: multiple organization support
By default, Zendesk only allows a user to belong to one organization at a
time. If you plan to manage organization membership through Opal, enable
Multiple organizations in your Zendesk account settings under Admin
Center > People > Configuration > End users. Without this
setting, granting a user access to a second organization will remove them from
their current one.
Custom roles
Custom roles are only available on Zendesk Enterprise plans. On other plans, the custom roles resource type will not appear when importing items. 
