I am designing my new company building network with Cisco 2960x and 3850ss switches and I want to use port-security for security reasons. I know how to configure 3 types of sticking MAC addresses to a port but I need to know if it is possible to stick some MAC addresses globally to all switches (for help-desk) and after that use port-security sticky command to switch learn latest connected MAC address automatically.
You cannot define it company wide, but per device. Use the interface range configuration to apply the configuration to all relevant ports of one device:
interface range Gi 0/1-20
Then set a maximum number of allowed MAC addresses:
switchport port-security maximum 3
Define the two MAC addresses of your help desk as static:
switchport port-security mac-address a1b1.c1d1.e1f1 switchport port-security mac-address a2b2.c2d2.e2f2
Define the ports as sticky afterwards:
switchport port-security mac-address sticky
You could apply this config company wide by using SNMP, SSH, etc. but not by a master device like it works with VTP.