With Zendesk phasing out API tokens, SendSafely has updated our Zendesk Dropzone Connector for Microsoft Azure to use OAuth 2.0 instead. Zendesk's deadlines for this cutover are detailed here. To keep your connector functional, please follow these steps to update it before your deadline passes.

Prerequisites

• An admin of your Azure subscription who can deploy ARM template updates and manage Key Vault access.
• An admin of your Zendesk instance who can access the Admin Center.
• A JSON file with the updated ARM template, provided by your SendSafely account rep.
• Your connector's resource name suffix. You can find this in the Azure Portal by looking at the name of your existing resources — e.g., if your Function App is named zdconnectorlgscj2g, your suffix is lgscj2g.

Step 1: Create an OAuth client in Zendesk

Note. You may wish to perform this step with a shared/admin service account rather than one tied to a specific employee, as Zendesk attributes API activity from this client to whoever created it.

1. In the Zendesk Admin Center, navigate to Apps and integrations > APIs > OAuth clients.
2. Click Add OAuth client.
3. Enter the following:
   • Name. SendSafely Dropzone Connector (or similar)
   • Client Kind: Confidential. Required for the connector's server-to-server authentication to work.
   • Redirect URLs. This field isn't used by the connector. If Zendesk requires it to proceed, enter your Zendesk portal URL (e.g., https://yourcompany.zendesk.com) as a placeholder, otherwise leave it blank.
4. Click Save.
5. Copy the Secret immediately, as Zendesk only displays it once. If you navigate away before copying it, you'll need to generate a new one.

Step 2: Update your Azure deployment

1. In the Azure Portal, search for "Deploy a custom template" and select it.
2. Click "Build your own template in the editor," then "Load file," and upload the updated ARM template provided by your SendSafely account rep.
3. On the Custom Deployment screen, configure the following:
   • deploymentType: Select existing from the dropdown menu.
   • resourceNameSuffix: Enter your resource suffix noted in the Prerequisites (e.g., lgscj2g).
   • Zendesk OAuth Client ID and Zendesk OAuth Client Secret: Enter the values from Step 1.
4. Click "Review + create," then "Create" to run the in-place update.

Because this deployment runs in Incremental Mode, it updates your existing resources (including Key Vault) without duplicating anything like your Cosmos DB account.

Step 3: Test the connector

Test the connector by making a Dropzone submission to a test ticket. If the upgraded connector successfully updates the ticket, proceed to Step 4. If not, reach out to your SendSafely account rep for assistance.

Step 4: Retire your old API token

Once you've confirmed OAuth is working, clean up the legacy credential:

1. Grant yourself access to view and delete Key Vault secrets, since Key Vault RBAC is locked down by default:
   • Open your Key Vault in the Azure Portal and select Access control (IAM).
   • Click "+ Add" > "Add role assignment," search for and select Key Vault Secrets Officer, then click Next.
   • Under Members, click "+ Select members," search for your login email, select it, and click Next.
   • Click "Review + assign."
   • Allow 2–3 minutes for the role to propagate, then refresh your browser.
2. In your Key Vault, click Secrets, locate zendesk-user-api-token, and click Delete. Confirm the deletion.
3. In Zendesk Admin Center, go to Apps and integrations > APIs > Zendesk API, and deactivate the old API token.