Audit access to customer-support triage by starting with job duties, not the current list of administrators. Map who must see or change tickets, customer profiles, routing rules, reports, exports, integrations, and billing. Compare that need with assigned roles, group membership, tokens, and real test results. Record exceptions and remove access only through an authorized change process.
Define assets and actions
Inventory intake channels, queues, tickets, attachments, customer records, internal notes, macros, triggers, service targets, reports, exports, apps, API clients, and audit data. For each asset, list view, create, edit, assign, merge, delete, export, administer, and impersonate-like actions separately. Broad labels such as "agent" can hide materially different powers.
Classify information and identify special queues containing payment disputes, health information, employee cases, legal requests, security reports, or other restricted material. Use invented test tickets. Do not open unrelated customer records merely to prove access.
Build a role-to-duty matrix
List employees, contractors, service accounts, vendor integrations, shared mailboxes, and emergency accounts. Map each identity to job, manager, groups, support role, other product roles, last sign-in, authentication method, and review owner. Flag former workers, duplicate accounts, direct grants, inactive accounts, and roles created for one person.
NIST defines least privilege as limiting access to the minimum necessary for assigned tasks. Apply it to data visibility and administrative power independently. An agent who needs every ticket in a region may still not need permission to edit triggers or export the customer directory.
Inspect platform permissions
Vendor documentation can reveal controls that a friendly role name obscures. Zendesk's custom-role guidance describes separate permissions across tickets, people, channels, workflow rules, routing, security, analytics, and help-center functions on eligible plans. Record plan limits and the actual settings visible in the tenant.
Review account owners and administrators first, then role managers, workflow editors, group leads, agents, light agents, reporters, and external collaborators. Check whether someone can change their own authority, grant roles, create tokens, install apps, change attachment settings, or export data. Document compensating review where separation of duties is not practical.
Test effective access
Use controlled accounts for each representative role. Attempt to find a standard ticket, restricted ticket, unassigned ticket, other-group ticket, deleted item, customer profile, internal note, report, export control, routing rule, and audit history. Check view and modification separately. Capture the result without recording test passwords or live personal data.
Inspect the audit trail for role, group, app, export, sign-in, and configuration changes. Zendesk's audit-log documentation describes time, actor, IP address, item, activity type, and detail fields. Availability varies, so note absent evidence rather than assuming no change occurred.
Audit exports and integrations
An export can exceed ordinary screen access. Zendesk's data-export documentation describes plan, enablement, permission, format, recency, size, and field-coverage limitations. Confirm who can request an export, who receives the link, where files are stored, and how they expire or are deleted.
List OAuth clients, API tokens, webhooks, email connectors, bots, and analytics destinations. Record owner, scopes, last use, rotation process, and revocation route. Do not rotate or delete a credential during evidence gathering unless that action is separately authorized and recovery is ready.
Close exceptions and recertify
For every mismatch, record identity, asset, observed ability, required ability, risk, approver, due date, change ticket, and retest. Prioritize orphaned owners, former-worker access, unnecessary exports, unrestricted integrations, and the ability to modify roles or routing. Preserve emergency access with controlled use and review rather than hiding it in an ordinary admin account.
The audit is complete when each material privilege has an owner and job rationale, representative roles have been tested, export and integration access is included, and approved changes have been retested. Schedule recertification after staffing, plan, workflow, integration, or product-permission changes, not only once a year.
Sources
- Least privilege — National Institute of Standards and Technology
- Creating custom roles and assigning agents — Zendesk Documentation
- Viewing the audit log for changes to your account — Zendesk Documentation
- Exporting ticket, user, or organization data from your account — Zendesk Help