Configuring Microsoft ADFS Single Sign On (SSO) with Sell

all Sell plans

If your organization uses Microsoft ADFS, you can configure Zendesk Sell for SSO. This article explains how to set up the ADFS connection, create claim rules in Sell, edit your trust settings, and configure SSO in Sell.

 This article contains the following sections:

Setting up a Relying Party Trust (RPT)

The connection between ADFS and Sell is defined using a Relying Party Trust (RPT).  You set this up in ADFS using a wizard.

Set up an RPT

  1. Launch Microsoft AD FS Management.  From the Actions side bar, select the Relying Party Trusts folder, and click Start. This starts the configuration wizard for a new trust.Screen_Shot_2018-05-21_at_10.43.14_AM.png
  2. In the Select Data Source screen, select the last option, Enter Data About the Party Manually, and click Next.


  3. Enter a display name that you'll recognize in the future, and any notes, and click Next.Screen_Shot_2018-05-21_at_10.52.56_AM.png
  4. Select AD FS profile, and click Next.Screen_Shot_2018-05-21_at_10.54.28_AM.png
  5. Click Next to keep the default certificate settings.Screen_Shot_2018-05-21_at_10.57.32_AM.png
  6. Check Enable support for the SAML 2.0 WebSSO protocol.

    The service URL is your Zendesk Sell Service Provider Assertion Consumer Service URL, which you can find in Settings >Single Sign On.

    Note: Remove any trailing slash at the end of the URL.


  7. Add a Relying party trust identifier using your Zendesk Sell Service Provider Issuer ID, which you can find in Settings >Single Sign On, and click Next.Screen_Shot_2018-05-21_at_10.59.58_AM.png

  8. Select whether you want to configure multi-factor authentication and click Next.Screen_Shot_2018-05-21_at_11.20.28_AM.png

  9. Select the option to permit all users to access this relying party, and click Next.Screen_Shot_2018-05-21_at_11.21.25_AM.png

  10. On the next two screens, the wizard displays an overview of your settings. Click through to the final screen, and click Close to save and exit and open the Claim Rules editor.

Creating claim rules

You can create the claim rules and update the RPT with minor changes that you did not configure in the previous wizard. Configure the claim rules according to your current ADFS setup. 

Setting the secure hash algorithm

Set the secure hash algorithm for the RPT

  1. In Microsoft AD FS Management, from the Actions side bar, select Properties while you have the RPT selected.
  2. Select the Advanced tab and set SHA-256 or SHA-1 as the secure hash algorithm.

Configuring SSO in Sell

The final task is to configure SSO in Sell.

Set up SSO in Sell

  1. Go to Settings >Single Sign On, Configure, and select Manual Setup.
  2. Enter an Identity Provider Issuer ID, for example, http://yourdomain/adfs/services/trust
  3. Enter an Identity Provider SSO URL, for example, https://yourdomain/adfs/ls
  4. Enter an Identity Provider certificate fingerprint.  This is the SHA-1 fingerprint of the token signing certificate installed in the ADFS instance.

Your configuration is complete.