Accounts and permissions when your support team works in a client's Zendesk or Freshdesk

When your support team works inside a client’s help desk, you have three things to settle. Whose email address does each account use? How much access does each rep get? How do you shut off people who leave? A help desk is a tool like Zendesk or Freshdesk that takes in customer questions and lets staff reply. Each question becomes a record called a ticket.

One agent for each rep

In both tools, each person who answers tickets is set up as an agent, a user registered to handle tickets. Both contracts let outside firms work in the customer’s account. Section 1.1 of the Zendesk Customer Agreement grants access to the customer’s “service providers,” among others, and makes the customer responsible for their use. The Freshworks Terms of Service define users to include a customer’s “consultants, contractors.”

Both companies, though, rule out several people using one login. Section 2.2 of the Zendesk agreement lists prohibited uses, including that “no more than one individual may use each purchased Agent login.” The Freshworks terms say “Agent login credentials cannot be shared or used by more than one (1) individual per license.” Zendesk’s help center adds the practical reason: with a shared login, it’s hard to tell which agent made a change. So your client creates one agent for each of your reps.

Whose email address to use

Every agent is registered with an email address. Freshdesk requires one, and creating the agent sends an activation email to it. The agent then sets their own password from that email. Freshdesk Support says “You cannot set a static password,” so an admin can’t set one in advance. If the email doesn’t arrive, the agent can use Forgot Password on the sign-in page to get a new one.

So in Freshdesk, whoever controls the address controls the password. If the agent uses a rep’s personal address, the rep can set a new password after leaving. That stays possible until the client turns the agent off. One option is a company-controlled address for each rep, which the client uses to create the agent. Shut the address off on the rep’s last day, and reset emails stop reaching them. This has a limit. As long as the rep can still read that mailbox, they can reset the password. A rep who stays with your company but moves to another client keeps access until the agent is turned off.

Roles and which tickets they can see

In both tools, an agent gets two separate settings. One is what they can do, called a role. The other is which tickets they can see, called ticket access or scope. Their help centers describe the two settings this way (Enterprise and Pro are plan names).

For your reps, a role that can answer tickets and access to the tickets they handle is enough. An admin role goes further. In Zendesk, an admin can add, manage and delete other agents. If your team handles only part of the queue, such as first-line questions, you can ask for a group for that work and limit access to the group.

Narrow access has costs in Zendesk on standard roles. An agent limited to some tickets can’t add or change customer records (end users, the people who send in questions). Reports stay closed to anyone without access to every ticket. Weigh these limits against the work before you settle on access.

Also check whether reps can export tickets, which hold customers’ names and contact details. In Zendesk custom roles, the CSV Export setting controls whether agents can export a view of tickets as a spreadsheet file. In Freshdesk, the help center lists “account exports” among the settings the default Agent role can reach. Before roles are assigned, ask the client’s admin to confirm on screen what your reps will be able to export.

Turning off reps who leave

When a rep rotates off or leaves, the client’s admin turns off the agent. Your job is to tell the client who and when, then confirm it happened.

Zendesk’s help center describes this order:

1. Reassign the agent’s open tickets. If you don’t, those tickets go to the agent’s group.
2. Downgrade the agent to end user. This keeps their ticket history, and afterward they can see only tickets they requested themselves.
3. Suspend the account if needed. A downgraded user can still sign in to the help center until suspended.

Freshdesk offers two choices, deactivate and delete. A deactivated agent can’t sign in. Their tickets, articles and other work stay on record, and open tickets with a running response-time clock move to the unassigned queue. Deleting wipes the agent from their tickets and other work, though they stay on the contact list. If you may need the rep’s history to explain something to the client later, deactivation keeps it.

Keeping a list when reps serve several clients

A rep who serves several clients has one agent per client. Turning them off also happens separately, in each client’s admin screen. A list on your side, with one row per rep and client, keeps you from missing one. Track the tool, the agent’s email address, the role, ticket access, the date you asked for the agent, and the date you confirmed it was turned off. On a rep’s last day, pull their rows and send a request to each client. The full process for that day is in the account handover checklist.

The same list helps when a client asks questions. Tickets hold customers’ names and contact details, so your team processes personal information for the client. If the client is a “business” under the California Consumer Privacy Act, you may be its “service provider” (Cal. Civ. Code 1798.140(ag)). Its contract with you must let it take “reasonable and appropriate steps” to help ensure you use that information in line with its own obligations (1798.100(d)(3)). When the client asks who can get into its help desk, the list is your answer.