Notifications
Clear all
Topic starter
08/07/2026 6:57 pm
TL;DR: Zendesk access is often consolidated through SSO, but the article shows how Active Directory teams can trade usability for weaker MFA, added complexity, and broader identity risk when SaaS access spans multiple credentials and control layers. The real issue is not convenience versus security, but whether access governance stays anchored to policy, monitoring, and lifecycle control.
NHIMG editorial — based on content published by IS Decisions: Zendesk SSO in Active Directory environments
Questions worth separating out
Q: How should security teams implement SSO for SaaS apps in Active Directory environments?
A: Start by treating the SSO path as a control boundary, not just a login shortcut.
Q: Why do stacked SSO and MFA flows create governance problems?
A: They create problems when teams optimise for convenience by removing one control layer instead of aligning policy across all layers.
Q: What breaks when access reviews do not cover the SSO-to-SaaS path?
A: Review quality breaks because the team may certify the directory account while missing the actual SaaS entitlement and session behaviour.
Practitioner guidance
- Map the full authentication chain Document every step from Active Directory logon to SSO session issuance to Zendesk access so you can see where MFA, policy checks, and revocation actually happen.
- Keep MFA policy consistent across layers Do not remove MFA from one layer simply to improve usability.
- Apply session concurrency limits Restrict how many concurrent sessions a single identity can maintain, especially when SSO fans out into multiple SaaS applications under one account.
What's in the full article
IS Decisions' full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step Zendesk and UserLock SSO configuration guidance for Active Directory environments
- Admin console settings needed to enable SaaS access through the SSO flow
- Policy wizard details for configuring MFA and concurrent session restrictions
- Practical implementation notes for keeping authentication anchored on-premises
👉 Read IS Decisions' guide to Zendesk SSO in Active Directory →
Zendesk SSO and Active Directory: are your access controls enough?
Explore further
08/07/2026 7:19 pm
SaaS SSO failures are usually governance failures, not integration failures. The article shows that the hard part is not wiring Zendesk into an SSO portal. The hard part is deciding where assurance lives, how MFA is enforced, and which team owns the trust boundary between directory, broker, and application. That is a human IAM control problem with direct implications for SaaS estate governance.
A few things that frame the scale:
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities.
A question worth separating out:
Q: How do organisations reduce SaaS access risk without making logins unusable?
A: Use policy consistency instead of control removal. Keep MFA aligned across directory and SSO, add session limits, and make offboarding verifiable end to end. That approach preserves usability while avoiding the common mistake of weakening one layer to compensate for friction in another.
👉 Read our full editorial: Zendesk SSO in Active Directory: security trade-offs for IAM teams
