# Inactive and suspended accounts are disabled

- Source: https://support.icompaas.com/support/solutions/articles/a_1781206832836588-inactive-and-suspended-accounts-are-disabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Identity Provider (IDP)](https://support.icompaas.com/support/solutions/c_1781206270516942) › [Zoho Mail](https://support.icompaas.com/support/solutions/folders/f_1781206562253420)
- Last updated: 2026-06-12
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Description:  
This control ensures that inactive and suspended user accounts are disabled within the Zoho organization. Disabling unused accounts reduces the risk of unauthorized access through dormant credentials and helps maintain an accurate inventory of active users.

  

Rationale:  
Inactive and suspended accounts present a security risk because they may be overlooked during routine account reviews while still retaining access to organizational resources. Disabling these accounts reduces the attack surface and supports effective identity and access management practices.

  

Impact:

-   Reduces the risk of unauthorized access through dormant accounts.
    
-   Improves user account lifecycle management.
    
-   Supports compliance requirements related to access control and user management.
    
-   Ensures only authorized and active users retain access to organizational resources.
    
-   May require periodic review of user account status.
    

  

Default Value:  
Disabled by default. Administrators must manually deactivate inactive accounts and ensure suspended accounts remain inaccessible.

  

Remediation

Test Plan

1.  Sign in to the Zoho Admin Console with administrative privileges.
    
2.  Navigate to Directory → Users.
    
3.  Review the list of user accounts.
    
4.  Identify inactive or suspended user accounts.
    
5.  Verify that inactive accounts are deactivated or suspended.
    
6.  Select a suspended account and review its status.
    
7.  Verify that the suspended account cannot access Zoho services.
    
8.  If inactive or suspended accounts remain active, follow the Implementation Plan to remediate the issue and repeat the test.
    

  

Implementation Steps:

1.  Sign in to the Zoho Admin Console with administrative privileges.
    
2.  Navigate to Directory → Users.
    
3.  Review user account activity and identify inactive accounts according to organizational policy.
    
4.  Select the inactive user account.
    
5.  Click Deactivate User or Suspend User, as applicable.
    
6.  Confirm the action.
    
7.  Repeat the process for all inactive accounts that no longer require access.
    
8.  Review existing suspended or deactivated accounts to ensure they remain disabled.
    
9.  Verify that suspended or deactivated accounts cannot access Zoho services.
    
10.  Document the account status according to organizational procedures.
     

  

Backout Plan:

1.  Sign in to the Zoho Admin Console with administrative privileges.
    
2.  Navigate to Directory → Users.
    
3.  Select the suspended or deactivated user account.
    
4.  Click Reactivate User or Enable User, as applicable.
    
5.  Confirm the action.
    
6.  Verify that the user can access Zoho services according to the assigned permissions.
    

  

References:

-   [Zoho Directory User Management Documentation](https://www.zoho.com/directory/help/admin-guide/users.html)
    
-   [Zoho Directory User Lifecycle Management Documentation](https://www.zoho.com/directory/help/admin-guide/manage-users.html)
    
-   [Zoho Directory Administrator Guide  
      
    ](https://www.zoho.com/directory/help/admin-guide/overview.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.