Zoho Account Security: Access Rights, Two-Factor and Staff Departures
The biggest risk to a business system is rarely sophisticated hacking. It is usually an old account nobody disabled.
Four basic settings
- Two-factor authentication for all users, administrators above all.
- Role-based access rights, rather than handing out admin rights for convenience.
- Restrict data export to roles that genuinely need it.
- An audit log showing who changed, viewed or exported data.
The principle of least access
Give the smallest set of rights that lets someone do their job. Review every six months, because access tends to accumulate over time and almost never shrinks on its own.
When someone leaves
Have a checklist run on the last day: disable the account, transfer record ownership to the successor, revoke connected app access, and check recent data exports. Transferring record ownership is often forgotten, and only surfaces months later when a report comes back empty.
Administrator accounts
Avoid one shared administrator account. Everyone uses their own so the trail is clear. Make sure there is more than one administrator, so the company does not depend on a single person who may be unavailable.
Personal data
Restricting access is part of personal data protection obligations. See the PDP law and your CRM, and confirm your specific obligations with a legal adviser.
Regular review
Make an access review part of the annual Zoho audit.