# Super admin count is restricted to 2 or fewer

- Source: https://support.icompaas.com/support/solutions/articles/a_1781206823782116-super-admin-count-is-restricted-to-2-or-fewer
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Identity Provider (IDP)](https://support.icompaas.com/support/solutions/c_1781206270516942) › [Zoho Mail](https://support.icompaas.com/support/solutions/folders/f_1781206562253420)
- Last updated: 2026-06-12
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Description:  
This control ensures that the number of Zoho Organization Administrator accounts is restricted to two or fewer. Limiting the number of administrator accounts reduces the risk of unauthorized changes, privilege misuse, and account compromise while maintaining sufficient administrative coverage.

  

Rationale:  
Organization Administrators have elevated privileges to manage users, security settings, applications, and organizational configurations. Restricting the number of administrator accounts helps enforce the principle of least privilege, reduces the attack surface, and improves accountability for administrative actions.

  

Impact:

-   Reduces the risk of unauthorized administrative changes.
    
-   Limits exposure of highly privileged accounts.
    
-   Improves accountability and administrative oversight.
    
-   Supports compliance requirements related to privileged access management.
    
-   May require the use of delegated administrative roles for routine administrative tasks.
    

  

Default Value:  
Not restricted by default. Organizations must manually limit the number of users assigned administrative privileges.

  

Remediation

Test Plan

1.  Sign in to the Zoho Admin Console with administrative privileges.
    
2.  Navigate to Directory → Users or Admin Roles.
    
3.  Review the list of users assigned administrator privileges.
    
4.  Count the total number of users assigned the highest administrative role.
    
5.  Verify that no more than two users are assigned administrator privileges.
    
6.  If more than two users are assigned administrator privileges, follow the Implementation Steps to remediate the issue and repeat the test.
    

  

Implementation Steps:

1.  Sign in to the Zoho Admin Console with administrative privileges.
    
2.  Navigate to Directory → Admin Roles.
    
3.  Review the list of users assigned the Organization Administrator role.
    
4.  Identify users who do not require Organization Administrator privileges.
    
5.  Remove the Organization Administrator role from users exceeding the approved limit.
    
6.  Assign lower-privileged administrative roles as required for operational responsibilities.
    
7.  Ensure that no more than two users retain the Organization Administrator role.
    
8.  Save the configuration changes.
    
9.  Verify that the total number of Organization Administrators is two or fewer.
    

  

Backout Plan:

1.  Sign in to the Zoho Admin Console with administrative privileges.
    
2.  Navigate to Directory → Admin Roles.
    
3.  Select Organization Administrator.
    
4.  Assign the role to additional authorized users as required.
    
5.  Save the configuration changes.
    
6.  Verify that administrative access functions according to the updated configuration.
    

  

References:

-   [Zoho Directory Administrator Roles Documentation](https://www.zoho.com/directory/help/admin-guide/admin-roles.html)
    
-   [Zoho Directory User Management Documentation](https://www.zoho.com/directory/help/admin-guide/users.html)
    
-   [Zoho Directory Administrator Guide  
    ](https://www.zoho.com/directory/help/admin-guide/overview.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.