Zendesk is killing API tokens, and your Entra ID provisioning still runs on one
Entra ID provisions Zendesk users with an API token, and Zendesk stopped issuing new ones on October 27. All tokens die on April 30, 2027. Protect the one you have, and plan the move to OAuth, which Microsoft is aiming to add to the connector in mid-December 2026.
part 11 of 11 · Identity security, from the ground upthe ideaNo new tokens, a last date, and OAuth on the way
after reading, you can- Find out if Entra ID creates your Zendesk users, then track down the token it signs in with
- Protect that token now, since Zendesk won't issue a new one without an exception
- Plan the move to OAuth in the Entra connector before 30 April 2027
Microsoft Entra ID creates and removes Zendesk users with one Zendesk API tokendefinitionA long-lived Zendesk secret that, sent with an admin's email address, lets a program call Zendesk's APIs. Zendesk is retiring them., and Zendesk is getting rid of API tokens. You can't make new ones any more, and the old ones die on April 30, 2027. Don't touch the token Entra uses today, check that it's still active, and plan the switch to OAuth once Microsoft's connector supports it.
Your Zendesk joiners and leavers ride on one API token, and Zendesk is retiring all of them
If your company lets Microsoft Entra ID, its company directory, look after Zendesk accounts, this is for you. A new support agent gets a Zendesk login on day one, and someone who leaves loses it. Behind that sits a Zendesk admin's username and an API token, pasted into Entra once and then forgotten. Zendesk stopped letting anyone create new API tokens on October 27, 2026, and it will switch every remaining token off for good on April 30, 2027. Until Entra can sign in another way, that one token is the only thing keeping provisioning alive.
Think of a master key cut years ago for the cleaning contractor. The building has stopped cutting master keys and will change every lock next spring. The contractor's key still works, but if it's lost there's no copy, and the new keycards the contractor needs aren't printed yet.
- Teams provisioning Zendesk from Entra ID
- Zendesk admins who own API tokens
- IT providers who set up Entra for a client
- Anyone setting up a new Zendesk account
Why it matters to you
If the token stops working, Entra can't reach Zendesk. New agents wait for an account, and people who've left keep theirs, with whatever they could see in your tickets. Microsoft's provisioningdefinitionCreating, updating and removing accounts in an app automatically, based on who's assigned to it in Entra ID. service treats bad credentials as a reason to quarantinedefinitionWhat Entra does with a provisioning job that keeps failing, for example on invalid admin credentials. Runs slow to once a day, and after four weeks the job stops. the job, and a job that stays in quarantine for more than four weeks is switched off.
The token is also a bigger risk than it looks. Zendesk says an API token can be used to act as any user in the account, admins included, it never expires while it's in use, and it can't be limited to certain tasks. That's why Zendesk is removing tokens, and it's why a token copied into an old runbook deserves attention now.
This is a planned deprecation, not a response to a published vulnerability. It's a forced change with a fixed date. Zendesk says there's no opt-out and no extension past April 30, 2027.
-
01 Entra calls Zendesk with the token
Entra sends the Admin Username and the Secret Token when it has users to create, update or disable. Someone pasted both in at go-live.
-
02 Zendesk stops issuing tokens
Since 27 October nobody can make a new one. Lose or delete the current token and you can't make a replacement unless Zendesk grants an exception.
-
03 Idle tokens switch off
A token nobody uses for 30 days is deactivated. A paused job, or a quiet month with no changes to send, can leave yours unused.
-
04 Entra quarantines the job
Bad credentials push the job into quarantine. Runs slow down to once a day, and after four weeks the job stops.
-
05 Switch to OAuth before 30 April
Microsoft is adding OAuth client credentials to the connector, targeted for mid-December. Move to it once it's there.
For engineers: Microsoft's tutorial still has you create the token under Apps and integrations, APIs, Zendesk APIs, with Token Access enabled, then paste it into the Secret Token box with the admin's username and your Zendesk subdomain. The checks it gives you are Test Connection and on-demand provisioning for a few users. When the connection fails, it tells you to make sure the account has admin permissions.
What changed, and what's still coming
Three phases from Zendesk, and which one bites your Entra job
Leave a token unused for 30 days and Zendesk switches it off. You still have 60 days to switch it back on before it's deleted for good.
Zendesk accounts created on or after 28 July 2026 can't create or use API tokens. Entra's current setup steps don't work there as written.
Existing accounts can't create tokens in Admin Center or through the API. Tokens already active keep working until 30 April 2027, as long as they're used.
Whatever tokens are left get switched off, and nobody can turn them back on. Zendesk also pulls the token pages out of Admin Center, so you can't even look.
Setting up Entra provisioning and Zendesk won't give you a token? Microsoft says you can ask Zendesk Support or your account manager for an exception. It doesn't say whether that covers accounts opened after 28 July.
Microsoft is working on OAuth client credentials for the Zendesk provisioning connector. It's a target date, so plan around it and don't bet on it.
The second phase can catch you out. Before October you could fix almost any token problem by making a new one. Now the token sitting in Entra is the last one you'll get without asking Zendesk, so deleting it during a clean-up or "rotating" it out of habit leaves provisioning with nothing to sign in with.
The inactivity rule is the quieter risk. Each Entra cycle works from what changed since the last one, so a quiet month might leave the token unused, and so might a job someone stopped for a migration. Zendesk counts 30 days from the token's Last used date, and it emails all admins on day 25 and day 29 before switching it off. If those emails go to an admin who has left, nobody reads them.
| Date | Zendesk change | Effect on Entra provisioning |
|---|---|---|
| 28 Jul 2026 | Tokens unused for 30 days deactivate; new accounts can't use tokens | A paused job can lose its token. New Zendesk accounts can't follow the tutorial |
| 27 Oct 2026 | Nobody can create new tokens | The token in Entra can't be replaced without a Zendesk exception |
| Mid-Dec 2026 (target) | Microsoft's planned OAuth client credentials for the connector | The way off tokens, once it's available in your tenant |
| 30 Apr 2027 | All tokens deactivated, no reactivation | Any job still on a token fails and goes into quarantine |
Dates for Zendesk provisioning from Entra
- 1 Jun 2026Zendesk announces token removal
Zendesk lays out three phases and tells everyone to be on OAuth before the last one.
- 28 Jul 2026Idle tokens start to switch off
From here on, a token left idle for 30 days gets switched off. Zendesk accounts opened from this date can't use tokens at all, so the Entra tutorial stops working for them.
- 27 Oct 2026Token creation blocked
Existing tokens keep working. Nobody can make a new one.
- 3 Nov 2026Microsoft updates its tutorial
Microsoft's Zendesk provisioning page now mentions the exception route. It also gives mid-December as the OAuth target.
- Mid-Dec 2026OAuth target for the connector
Microsoft aims to have OAuth client credentials in the connector by then. Test it before you move the live job.
- 30 Apr 2027All tokens deactivated
Token sign-ins fail for good. Every integration has to be on OAuth by then.
Your options, side by side
If your token is healthy, there's no choice to make before December. The token keeps working while it's used, and Microsoft's OAuthdefinitionA way for programs to sign in with tokens that expire quickly, so a leaked one doesn't work for long. Zendesk's last 30 minutes by default. support is what you're waiting for. The decision is about what you do if the target slips, and how you handle new Zendesk accounts in the meantime.
- Nobody checks whether the token is still active
- A job sits paused for a month, and Zendesk quietly switches its token off
- Someone clears out the "old" token in a tidy-up. Then they find out Zendesk won't let them make another
- OAuth arrives in the connector and nobody schedules the switch
- The last day comes, the job quarantines, and leavers keep Zendesk access
- Check the token's Last used date and the job's status this week
- Lock the token down in a vault with a named owner
- Watch for Microsoft's OAuth support and test it in a separate app first
- Agree with Zendesk on the exception route if you need a new setup
- Move the job to OAuth with months to spare. Then you retire the token
| Route | When it fits | Effort | Main risk |
|---|---|---|---|
| Keep the token, move to Entra OAuth when it's out | You already provision with a working token | Unknown until Microsoft publishes setup steps | The mid-December target slips |
| Ask Zendesk for a token exception | A new Entra setup that can't create a token | A support request, and not guaranteed | Still a token, so it dies on 30 April 2027 |
| Build your own OAuth integration | Microsoft's support isn't there in time | High: code, hosting and upkeep | You now own a custom provisioning service |
The third route is a last resort. Zendesk's OAuth guide covers client credentialsdefinitionThe OAuth option for background jobs where nobody clicks anything. The job trades its client ID and secret for a fresh access token when it needs one. for server-to-server jobs, but the token exchange still needs code or a tool like Postman, and you'd be rebuilding what the Entra connector does. Only plan for it if April gets close and the connector still can't sign in with OAuth.
Find every token before Zendesk does
Entra's token may not be the only one. Zendesk's own list of what breaks includes webhooks that update tickets, custom scripts, middleware and apps built by contractors. Use the Entra job as the starting point, then go after the rest while you're in the API tokens page.
Inventory the Zendesk API tokens and find Entra's
- 01Note the Entra settings
In the Entra admin center, open Enterprise apps, then your Zendesk app, then Provisioning. Write down the Admin Username and the Domain, and check whether the job is running or in quarantine.
- 02Open the API tokens page
In Zendesk Admin Center, go to Apps and integrations, then APIs, then API tokens. Read Last used and Deactivates on for each one. A token that hasn't been used lately is the one to worry about.
- 03Run the usage report
Run the usage report from the same page. Each row has the IP address, the user agent and the email sent with the token, so Entra's calls should show up under the Admin Username.
- 04Repeat it for a few weeks
A report only goes back seven days. Zendesk suggests running it every few days to build up a 30 to 60 day history. Otherwise a job that runs once a month never shows up.
- 05Give every token an owner
Write down which system uses each token and who owns it. Zendesk recommends a separate OAuth client per integration when you migrate, so this list becomes your migration plan.
- 06Test from Entra
Run Test Connection on the Zendesk provisioning app, then provision one user on demand and read the log. If both pass, the token is alive today.
What to do now, by role
Who does what before 30 April 2027
- Ask your IT lead whether Entra ID creates and removes your Zendesk users, and who owns that setup.
- Get a written answer on where the Zendesk token lives and who can see it.
- If an IT provider runs it, ask them for the switch date to OAuth in writing.
- Check Last used and Deactivates on for the token Entra uses. Don't delete or rotate it.
- Run the usage report. Write down which system uses each token and who owns it.
- Zendesk sends token warnings to every admin. Check someone who still works here actually reads them.
- Run Test Connection on every Zendesk provisioning app in the tenant and provision one test user on demand.
- Put a shared inbox in each app's notification email so quarantine alerts reach someone.
- Watch Microsoft's Zendesk tutorial for the OAuth option, and test it in a separate app first.
- Treat the token as a privileged secret, since Zendesk says it can act as any user, admins included.
- Check if the token sits on a person's admin login or on a dedicated account. If it's a person, ask who signs off that access, because provisioning goes with it.
- Put the token deadline on the risk register with an owner. It comes off once the job runs on OAuth.
Make the switch to OAuth stick
OAuth removes the forever-token, but it moves some questions around. Zendesk's guide says changes made with a client credentials token are credited to the Zendesk user who created the OAuth client, usually an admin. That shows up in audit logs and in who appears to have changed a user. Microsoft hasn't published its OAuth setup steps yet, so check them when they appear. If they follow Zendesk's model, create the client from a dedicated service account, never from a person.
Today: one admin token nobody owns
A setup we'd worry about. The token was made by an admin at go-live, it can act as anyone, and quarantine emails go nowhere.
After: OAuth from an owned account
Same connector, own credentials. Each integration has its own OAuth client, and a team hears about it when a job fails.
Durable fixes, each tied to this change
- 01Use a dedicated Zendesk account
Give Entra its own Zendesk admin account, not a person's. When that person leaves, provisioning shouldn't leave with them, and audit logs should show the integration, not a colleague.
- 02One OAuth client per integration
Zendesk recommends a separate client for each integration, with allowed scopes set to what it needs. Then you can revoke one without breaking the others.
- 03Keep secrets in a vault
Get the token out of runbooks and into a secrets manager. Zendesk's guide mentions Azure Key Vault and HashiCorp Vault, among others. The OAuth client secret goes there later.
- 04Point quarantine alerts at a team
Set the notification email to a shared inbox. Entra sends one email when an app goes into quarantine, plus one more if the reason changes.
- 05Retire the token yourself
Once OAuth has run cleanly for a while, deactivate the old token on your schedule. Better a change window you picked than a surprise on 30 April.
If it goes wrong
If Zendesk users stop syncing, get the sign-in back first, then clean up
A common cause is one token that went idle or got deleted. The bigger job is finding the joiners and leavers that didn't sync while it was down.
- 01Confirm the causefirst hour
- Run Test Connection on the Entra Zendesk app and read the provisioning logs for the failure.
- In Zendesk Admin Center, find the token. Is it Deactivated, or gone from the list entirely?
- 02Restore the sign-infirst hour
- If it's been off for under 60 days, use Reactivate in the token's options menu. Zendesk says it's usable again straight away, so test the connection right after.
- Deleted before 30 April 2027? Ask Zendesk Support for a token exception, or move to OAuth if the connector supports it. After that date, OAuth is the only way back.
- Paste any new credential into Entra, then run Test Connection again.
- 03Get out of quarantinefirst day
- Once the connection works, check the job leaves quarantine. Restart provisioning clears it, but runs a full initial cycle that takes longer.
- If the job was disabled after four weeks, restart it from the Provisioning page.
- 04Catch up on leaversfirst day
- List everyone removed or disabled in Entra since the job last ran cleanly, and check their Zendesk accounts by hand.
- Suspend any Zendesk access that should have gone, then let the job reconcile the rest.
- 05If the token leakedfirst day
- Treat it as admin-level exposure. Zendesk says a token can act as any user in the account.
- Revoke it, accept that provisioning stops, and get OAuth or a Zendesk exception in place. Read the usage report for unknown IPs first.
- 06Learn from itthis month
- Write down who owns the integration, where the credential lives and who gets the alerts.
- Book the move to OAuth, if it hasn't happened yet.
What this looks like in practice
The three companies below are made up. Each one is a setup you could easily find in a tenant that provisions Zendesk from Entra, so use them as a checklist for your own.
Three Zendesk setups you might recognise
- the setup
- A software company provisions agents into Zendesk from Entra ID. The token was created at go-live by the head of support, who still owns it, and the job runs every day.
- what happens
- Nothing breaks yet. In a security clean-up someone spots the old token and plans to rotate it, which would leave Entra with no way in.
- what to do
- Stop the rotation. Note the token's owner, keep it in a vault and schedule the switch to OAuth once Microsoft's connector has it.
- the setup
- A retailer stopped Zendesk provisioning while it reworked its support groups. Nobody touched it for over a month, and then someone switched it back on.
- what happens
- The token went 30 days unused and Zendesk deactivated it. The warning emails went to an admin who'd left. Entra quarantines the job on restart.
- what to do
- Reactivate the token inside the 60-day window, test the connection, then check every leaver from the pause by hand.
- the setup
- A healthcare services firm opened a new Zendesk account this autumn. IT wants Entra provisioning from day one and follows Microsoft's tutorial step by step.
- what happens
- Zendesk Admin Center won't create an API token. The account is new, and token creation is blocked for everyone anyway.
- what to do
- Ask Zendesk whether the exception Microsoft describes covers accounts opened after 28 July 2026. If not, wait for OAuth in the connector and provision by hand until then.
How Cohash helps
We go through the provisioning apps in your Entra tenant one by one, and give every integration credential an owner and a place in a vault. When Microsoft's OAuth option is ready, we help you plan and test the connector's move in a separate app first. The Microsoft Entra ID page covers the wider identity work. You can bring in identity engineers for the clean-up, or ask for an assessment if you'd rather someone looked first.
What to take from this
- 01
Nobody can create Zendesk API tokens any more. Treat the one in Entra as the last you'll get without asking Zendesk.
- 02
Don't rotate or delete it. Check its Last used date and keep it in a vault with an owner.
- 03
A token nobody uses for 30 days gets switched off. You've then got 60 days to bring it back before Zendesk deletes it.
- 04
Microsoft is targeting OAuth for the Zendesk connector in mid-December 2026. Test it in a separate app when it appears.
- 05
Every token dies on 30 April 2027. Have the provisioning job on OAuth well before then.
01Do I need to do anything if Entra ID provisions our Zendesk users?
Yes, but nothing drastic yet. Check that the token Entra uses is still active, don't rotate or delete it, and plan to move the job to OAuth once Microsoft's connector supports it. Every Zendesk API token stops working on 30 April 2027.
02When do Zendesk API tokens stop working?
Every one of them stops on 30 April 2027. Zendesk says there's no opt-out and no extension. Until then, a token nobody uses for 30 days gets switched off early.
03When will the Entra Zendesk connector support OAuth?
Microsoft says it's working on OAuth client credentials for the connector, targeted for mid-December 2026. That's a target, so keep the token healthy until you've tested the OAuth option.
04We can't create a token for a new Entra setup. What now?
Go to Zendesk Support or your account manager and ask for an exception. Microsoft's tutorial says you can request one that restores token creation. If you'd rather not, wait for OAuth in the connector and add users by hand until it arrives.
05Does this affect Zendesk single sign-on through Entra?
Zendesk's change is about API tokens. Single sign-on to Zendesk through Entra is a separate SAML setup, and neither vendor's notice about tokens mentions it.
06Our token was deactivated. Can we get it back?
Yes, if it was switched off less than 60 days ago and it's still before 30 April 2027, use Reactivate in the token's options menu. After 60 days Zendesk deletes it and it's gone.
07Are Zendesk Messaging and Chat tokens affected?
No. Zendesk says only Support API tokens are affected, which covers the Ticketing, Help Center and Voice APIs. Tokens for Messaging, Chat and other products aren't part of this change.
Three questions, about a minute
Pick an answer and we'll tell you if it's right, and why it is or isn't. The score stays in this browser.
-
Q1Security wants to rotate the old Zendesk token Entra signs in with. What's your answer?
show the answer
B. Wait until OAuth works, because a new token can't be created Zendesk stopped token creation on 27 October 2026. Revoke the current one and provisioning has no way in until OAuth or a Zendesk exception is in place.
-
Q2Provisioning was paused for five weeks. On restart Entra says the credentials are invalid. What's the most likely cause?
show the answer
D. The token went 30 days unused and was deactivated Zendesk deactivates any token unused for 30 days. You can reactivate it within 60 days, so check the API tokens page before anything else.
-
Q3You set up a brand-new Zendesk account and Admin Center won't create a token for Entra. What's your route?
show the answer
A. Ask Zendesk for an exception, or wait for OAuth in the connector Nobody can create tokens now, and new accounts can't use them anyway. Microsoft's tutorial sends new setups to Zendesk for an exception, so ask whether it covers your account, or wait for OAuth.