Okta Sets Zendesk Provisioning Migration Dates as OAuth Replaces Basic Authentication

Two dates for integration owners

Okta’s October 12 Identity Engine production release notes set out a change to its Zendesk integration: provisioning now uses OAuth 2.0 instead of Basic Authentication. Existing customers using Zendesk provisioning must reauthenticate the API connection in the Admin Console by April 29, 2027, according to Okta. New Zendesk app instances require OAuth 2.0 beginning October 26, 2026. The company explicitly says the change does not affect single sign-on. A successful employee login is therefore not sufficient evidence that the provisioning migration is complete.

Understand the permission being granted

Okta’s integration guide describes an OAuth client that connects without storing the administrator’s credentials. Its requested scopes cover reading users, groups and schema attributes, creating, updating and deactivating users, and managing group memberships. Administrators should review the actual consent request against the intended Zendesk environment. The documented migration is performed through the provisioning settings and includes an API credential test. Okta also notes that existing Basic Auth credentials remain a fallback until authentication is completed; that should not be mistaken for a completed migration.

Test the account lifecycle

Our recommendation is to choose a controlled test account and verify the provisioning operations the business actually enables. Creation, an approved attribute change and deactivation answer different questions from a login test. Document the expected result in both systems, the observed result and any delay or error. Avoid experimenting with a live customer-service agent’s access during an active shift. For an MSP managing multiple clients, the checklist should identify the customer tenant and authorized administrator so a successful test in one organization is not counted as completion for another.

Put service ownership on the calendar

Professional-services firms and online retailers can use the lead time to schedule the change around support operations. Our analysis is that the most avoidable failure would be treating this as an identity-team task with no service owner: the person managing authentication may not own help-desk staffing or account removal. Assign both technical responsibility and business acceptance now, retain the result of the controlled lifecycle test, and track unresolved exceptions before the deadline. This is a migration notice, not a reported Zendesk breach or a claim that current customers have already lost provisioning. Its practical value is time to verify the connection before an otherwise routine personnel change depends on it.

Related: Okta Event-Hook Postmortem Highlights a Blind Spot in Identity Automation →