Zoho One Admin Panel Guide: Users, Groups, SSO, MFA and Offboarding

What is the Zoho One admin panel?

The Zoho One admin panel is where you manage users, apps, security and devices for the whole organisation. Zoho One's plan details list it under Zoho Directory, alongside single sign-on, Active Directory sync, domain management, conditional app assignment, usage reports, security policies and groups.

Where you find it depends on your interface. Zoho's help pages describe three: in some, you click the Admin Panel or Directory Settings icon at the top right, and in the newer unified interface you click Directory in the left menu. The functions are the same.

The admin panel controls who can sign in and which apps they can open. It does not replace permissions inside each app. Zoho CRM still has its own roles and profiles, and Books, Desk and People have their own user roles.

How do you add and provision users in Zoho One?

Zoho gives you three ways to add people: one at a time, by importing a file, or by syncing from Active Directory. Zoho also lists Group Sync for importing groups from third-party apps.

1. 1Verify your domain first, so users get company email addresses and admin actions such as MFA resets work. Zoho has added domain checks to some user management actions.
2. 2Create groups for each team before adding users, so you can assign apps by group.
3. 3Add users from User Management or Directory, enter their details and choose the licence that applies, either a full Zoho One licence or a Lite add-on.
4. 4For larger teams, import users from a file or connect Active Directory sync.
5. 5Add each user to the right groups, which triggers any conditional app assignment.
6. 6Ask users to sign in and set up MFA in their first session.

How should you set up groups and app access?

Use groups for teams or roles, such as Sales, Finance, Support and Leadership, then assign apps to groups rather than to individuals. Zoho's conditional assignment can assign apps automatically to existing and future users based on rules, so a new starter in Finance gets Books without anyone remembering to add it.

Keep the app list short for each group. Users who see 40 icons on day one tend to ignore most of them, and every assigned app is another place where data can be created without an owner.

After app access, set permissions inside each app. For example, our guide to Zoho CRM roles, profiles and data security explains how to decide which records each salesperson can see.

How do SSO and SAML work in Zoho One?

Zoho calls this custom authentication. It supports SAML and JWT single sign-on from identity providers such as Okta, OneLogin, CyberArk and miniOrange, and Zoho says you can set it up for one user group or for everyone. You can also add more than one identity provider and apply each to different users.

Once it is on, users enter their email on the Zoho sign-in page and are sent to your identity provider. If you use Microsoft or another provider that already enforces MFA, check whether you also want Zoho's own MFA, since some admins in Zoho's community report users being asked twice.

Zoho One can also act as the sign-in point for other SAML apps through Zoho Directory. Zoho's help pages warn that deactivating a user in Zoho One does not deactivate them in those connected SAML apps, so offboard there separately.

Which Zoho One security policies and MFA options should you enforce?

Security policies can be set for the whole organisation or customised for groups, and specific users can be excluded where needed. This is a sensible starting point.

Zoho's admin dashboard and sign-in details help you spot unusual sign-ins. Review them monthly, and after any staff change in finance or leadership.

Remote and hybrid teams need extra care with IP restriction. If staff work from home or travel, a strict IP rule will lock them out, so apply it only to groups that always sign in from a known network, and rely on MFA and device management for everyone else.

How do you offboard a user safely in Zoho One?

Zoho says deactivation revokes the user's access to Zoho One and its apps, frees their licence for someone else and keeps their data. Work through these steps first, based on Zoho's own pre-deactivation checks.

1. 1Remove any Zoho One admin roles the user holds.
2. 2Transfer ownership of any apps they own, such as a Creator app or an app subscription.
3. 3Reassign integrations between Zoho One apps that run under their account.
4. 4Transfer Directory store ownership if they hold it.
5. 5Reassign their open records, such as CRM deals, Desk tickets and Projects tasks, inside each app.
6. 6Deactivate the user in Zoho One, then deactivate them in any connected SAML apps.
7. 7Reduce your licence count if you will not replace them.

If you need a copy of a leaver's data for legal or HR reasons, export it before step 6. Our answer on backing up an entire Zoho One account covers the export options.

Who should be a Zoho One admin, and when should you get help?

Every organisation needs an owner and at least one backup admin, so you are not locked out when one person is away. Delegate day-to-day tasks with narrower roles, such as App Admin for a department head or Helpdesk Admin for password and MFA resets. Zoho notes that Lite users cannot hold Zoho One admin roles.

If nobody in-house has time to run the admin panel, Flowpeak's Zoho managed services cover user changes, security reviews and app support for a fixed monthly scope. We are a registered Zoho partner with Zoho-certified consultants, working remotely from Chennai, including in US business hours.

Frequently asked questions