# Guest access is properly restricted

- Source: https://support.icompaas.com/support/solutions/articles/a_1781206841322369-guest-access-is-properly-restricted
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Identity Provider (IDP)](https://support.icompaas.com/support/solutions/c_1781206270516942) › [Zoho Mail](https://support.icompaas.com/support/solutions/folders/f_1781206562253420)
- Last updated: 2026-06-12
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Description:  
This control ensures that guest access within the Zoho organization is restricted according to organizational security requirements. Properly restricting guest access helps prevent unauthorized access to organizational resources, data, and applications while allowing controlled external collaboration.

  

Rationale:  
Guest users may require limited access to specific resources for business collaboration. Restricting guest access reduces the risk of data exposure, unauthorized access, and excessive permissions while maintaining secure collaboration with external parties.

  

Impact:

-   Reduces the risk of unauthorized access to organizational resources.
    
-   Limits external user access to approved services and data.
    
-   Improves control over external collaboration activities.
    
-   Supports compliance requirements related to access control and data protection.
    
-   May restrict collaboration options available to external users.
    

  

Default Value:  
Guest access permissions are not fully restricted by default. Administrators must explicitly configure guest user access and sharing settings according to organizational requirements.

  

Remediation

Test Plan

1.  Sign in to the Zoho Admin Console with administrative privileges.
    
2.  Navigate to Directory → Users or the applicable external user management settings.
    
3.  Review guest user and external collaboration settings.
    
4.  Verify that guest access is restricted according to organizational policy.
    
5.  Create or identify a guest user account.
    
6.  Attempt to access organizational resources using the guest account.
    
7.  Verify that access is limited to approved resources and services.
    
8.  If guest access is not properly restricted, follow the Implementation Plan to remediate the issue and repeat the test.
    

  

Implementation Steps:

1.  Sign in to the Zoho Admin Console with administrative privileges.
    
2.  Navigate to Directory → Security Policies.
    
3.  Review the organization's guest user and external collaboration settings.
    
4.  Configure guest access permissions according to organizational policy.
    
5.  Restrict guest users to only the required applications, resources, and services.
    
6.  Disable unnecessary external sharing and guest access features.
    
7.  Apply the security policy to all applicable users and groups.
    
8.  Click Save to apply the configuration changes.
    
9.  Review existing guest accounts and remove any that are no longer required.
    
10.  Verify that guest users have access only to approved resources and services.
     
11.  Verify that guest access restrictions are enforced across the organization.
     

  

Backout Plan:

1.  Sign in to the Zoho Admin Console with administrative privileges.
    
2.  Navigate to Directory → Security Policies.
    
3.  Edit the applicable security policy.
    
4.  Modify the guest access restrictions as required.
    
5.  Click Save to apply the configuration changes.
    
6.  Verify that guest access functions according to the updated configuration.
    

  

References:

-   [Zoho Directory Security Policies Documentation](https://www.zoho.com/directory/help/admin-guide/security-policies.html)
    
-   [Zoho Directory User Management Documentation](https://www.zoho.com/directory/help/admin-guide/users.html)
    
-   [Zoho Directory Administrator Guide  
      
    ](https://www.zoho.com/directory/help/admin-guide/overview.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.