Ticketing
Part of Support platform access
Managing contractor access to a support queue
Define a contractor's support queue access, distinguish day passes from account expiry and hand over open cases before removal.
Give a contractor an individual account for agreed work in an agreed queue, with a named supervisor and an access end date. Plan the departure from the start: unfinished cases need a new owner, and the account and any separate credentials must be dealt with. A short contract or occasional-agent licence does not end platform access by itself.
Set the assignment's limits
Record the queue, channels, case types and dates of work. Decide whether the contractor may reply to customers, add internal notes, reassign cases, view profiles or export records. Assign someone on the permanent team to approve exceptions and accept the final handover.
Choose the narrowest available ticket scope that supports the work. In Freshdesk, agent setup includes roles, ticket scope and groups. In Zendesk, eligible custom roles let administrators set permissions for tickets and other areas. Check the configured account rather than relying only on the queue view.
Key Access and Compliance Metrics
- Narrowest Ticket Scope Used
- Recommended practice to limit exposure
- Role-Based Permissions Set
- Configured via roles in Freshdesk or custom roles in Zendesk
- Contract End Date Aligned with Access Expiry
- Mandatory to prevent lingering access
- Approved Exception Handler Assigned
- Permanent team member responsible for approvals
Treat day passes as licensing
Freshdesk occasional agents consume a day pass when they sign in to the portal. Freshdesk says an occasional agent can reply to notification emails without consuming a day pass and, after retrieving an API key where API access is available, use the API without further day passes.
Day-pass use therefore cannot show whether the person still has access. Set a separate offboarding task for the contract end date.
Zendesk Admin Center can change a team member's product access, while downgrading or removing an agent involves separate steps. Review every Zendesk product area the contractor used, along with any mailbox, identity-provider group or separate credential recorded at onboarding.
Freshdesk vs Zendesk: Contractor Access Management
- Day Pass Consumption
- Freshdesk: consumed on sign-in; occasional agents may reply via email without one
- API Access Without Day Pass
- Freshdesk: possible after retrieving an API key
- Access Revocation Method
- Zendesk: Admin Center allows product access changes; downgrade or remove separately
- Post-Downgrade Sign-In Risk
- Zendesk: downgrading to end user does not block sign-in; suspension required
Hand over cases before changing the account
List cases still assigned to the contractor. For each open case, record the next owner, the latest commitment to the customer and the next action. Confirm that the receiving agent can continue the reply.
Zendesk recommends reassigning open tickets before removing an agent; otherwise, non-closed tickets are reassigned to the group, which may leave the intended owner unclear.
If a departing administrator authorised an app or integration, identify a continuing owner before downgrading the account.
Close and check access
At the agreed end point, have an authorised administrator follow the platform's supported offboarding process. Check the account's role and product access, group membership, mailbox access, identity-provider membership, API key access and app authorisations that were part of the assignment.
In Zendesk, downgrading an agent to an end user does not by itself prevent that user from signing in; its removal guidance describes suspension as a further option to block access.
Record who completed the access change and who accepted the case handover. If the contract is extended, approve a new access period and review its scope.
