Zendesk | CIO Analytics

This guide walks the IT/Zendesk administrator through creating a dedicated read-only custom role and integration user, and authorizing the connection in the Info-Tech portal. It includes the Zendesk objects that need read-only access so the administrator can complete setup without a separate access-requirements document. Zendesk Support has a mature native Fivetran connector, so Fivetran is the primary extraction path; the connection authorized here is what that connector uses.

Note — this integration now uses OAuth
Zendesk is discontinuing API-token authentication, so this integration now connects using OAuth. Rather than generating and sharing an API token, you authorize the connection directly through the Info-Tech portal — Info-Tech never receives a token or password. You still create a dedicated, read-only integration user (below) so the connection's access stays tightly scoped and easy to audit or revoke. The OAuth authorization itself is done in Step 3, and is also covered in the Submit to Info-Tech Portal article. When you authorize the connection, an external OAuth client is generated automatically on your Zendesk instance to represent this connection — you do not need to create an OAuth client manually in Zendesk beforehand.

ABefore you start

You will need:

Administrator access to your Zendesk Support instance
An available Zendesk agent seat for the integration user
A service-account email address you control (e.g., cioanalytics@yourcompany.com)
Your Zendesk subdomain (the part of the URL while logged into Zendesk that comes before .zendesk.com — e.g., yourcompany.zendesk.com)
Access to the Info-Tech portal where the connection will be authorized

BZendesk objects required

The integration requires read-only access to the following Zendesk objects:

Required objects

tickets
ticket_comments
ticket_field_history
ticket_metrics
ticket_metric_events
satisfaction_ratings

Required objects (cont.)

ticket_custom_fields
ticket_custom_statuses
users
groups
organizations
sla_policies

No create, edit, delete, or write-back permissions are required.

Satisfaction (CSAT) in Zendesk is captured in dedicated objects — satisfaction_ratings (and, where the CSAT survey feature is in use, the survey-response object) — not as a field on the ticket. These must be granted and synced for CSAT reporting. Worklog / time entries: Zendesk has no standard row-level worklog object. Agent work time is only available through the Time Tracking app or via metric events. No row-level worklog object is requested in this guide; a row-level fact_worklog is future scope and requires the Time Tracking app or a comparable tenant-supplied source.

Important — Zendesk's permission model
The connection runs with the permissions of the user who authorizes it, so scope that user's role tightly. For this setup, create a custom role with read/view access to tickets and the related objects above, and authorize the connection as a dedicated integration user holding that role. Do not authorize with a personal administrator account or a broad admin role.

Steps in this guide

1Create a read-only custom role
2Create a dedicated integration user
3Authorize the connection in the Info-Tech portal

Step 1 Create a read-only custom role

Admin Center → People → Team → Roles → Create role (custom roles require a qualifying Zendesk plan)

Create a dedicated read-only custom role rather than reusing a broad built-in role. This keeps the integration's permissions scoped tightly and makes them easy to audit and revoke without affecting other Zendesk agents.

Open Admin Center. From the product tray, open Admin Center.
Navigate to Roles. Go to People → Team → Roles.
Create a custom role. Give it a clear name — for example, CIOAnalytics Read-Only — and a description like Read-only access for the Info-Tech Customer Data Store integration.
Set ticket access to view-only. Grant access to all tickets (so the integration sees every ticket, not just a group's), and set the permission to view only — no edit, no comment, no delete.
Do not grant administration or write permissions beyond read/view of the objects this integration needs.
Save the role. If your Zendesk plan does not include custom roles, note this for your Info-Tech onboarding contact — the integration user will need the narrowest available built-in role with read access.

Step 2 Create a dedicated integration user

Admin Center → People → Team members → Add team member (or Support → Add user, depending on layout)

Create a user whose only purpose is this integration. A dedicated account avoids tying the connection to a person and supports clean deactivation if access must be revoked. You will sign in as this user to authorize the connection, so it runs with this user's read-only role.

Add a team member. Name CIOAnalytics; email cioanalytics@yourcompany.com.
Assign the read-only custom role created in Step 1. Do not assign an administrator role.
Save the user and complete any activation/verification step Zendesk requires for the new account.

Step 3 Authorize the connection in the Info-Tech portal

Info-Tech portal

You authorize the connection to your Zendesk data through OAuth, signed in as the dedicated integration user — there is no token to copy or share with Info-Tech. You will need your Zendesk subdomain (as mentioned in the "Before you start" section) and the ability to sign in to Zendesk as the integration user.

NEVER SEND YOUR ZENDESK CREDENTIALS TO INFO-TECH BY EMAIL, CHAT, OR SCREEN SHARE.
Authorize the connection yourself, directly in the Info-Tech portal — Info-Tech never needs your Zendesk password and never receives a token. See the Submit to Info-Tech Portal article for the portal submission steps. Head over to https://us.app.cioanalytics.ai/

Open the Connections page.
On the IT Service Management (ITSM) row, click Connect Tool.
In the Connect to ITSM Tool dialog, select Zendesk from the dropdown.
Click Continue.
Review the notice describing how Info-Tech uses Fivetran to connect to Zendesk.
Click Continue. This accepts Fivetran's Terms of Service and Privacy Policy and authorizes data extraction from Zendesk.
Follow the instructions in the Setup Guide panel on the right to fill in the fields on the left.
Click Authorize. This opens the Zendesk login screen.
Sign in to Zendesk as the dedicated integration user you created in the previous steps, so the connection runs with that user's read-only role.
When every field is complete, click Save & Test.
Wait for the connection test to finish. After the connection test succeeds, CIO Analytics takes over the rest of the process automatically.

Once Save & Test succeeds, you are returned to CIO Analytics.
Your Zendesk data syncs automatically for the first time. Depending on how much history is being pulled, the first sync can take anywhere from a few hours to a few days.
Once that first sync completes, an Info-Tech analyst will reach out to you to continue your onboarding. No further action is needed from you in the meantime.

Notes on this document

Zendesk Admin Center navigation may differ by plan and version. If a menu item is not in the exact location shown, use the closest matching People, Team, or Apps and integrations page.
Custom roles require a qualifying Zendesk plan. If custom roles are unavailable, use the narrowest built-in role that grants read access and note this for your Info-Tech onboarding contact.
This integration no longer uses Zendesk API tokens. If you previously connected using an API token, the connection must be re-authorized through OAuth in the Info-Tech portal; the old token can then be revoked in Admin Center → Apps and integrations → APIs.
Access can be revoked at any time by deactivating the integration user or removing its role — both invalidate the connection, which will then report a 401 or 403 error.
Questions about anything in this guide can be directed to your Info-Tech onboarding contact.

Was this article helpful?