# Privileged access is restricted to authorised admins only

- Source: https://support.icompaas.com/support/solutions/articles/a_1781206881127995-privileged-access-is-restricted-to-authorised-admins-only
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Identity Provider (IDP)](https://support.icompaas.com/support/solutions/c_1781206270516942) › [Zoho Mail](https://support.icompaas.com/support/solutions/folders/f_1781206562253420)
- Last updated: 2026-06-12
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Description:

This control verifies that administrative and privileged access within Zoho is granted only to authorized personnel with a legitimate business requirement. Privileged roles should be assigned following the principle of least privilege and reviewed periodically to prevent unauthorized access to sensitive administrative functions.

  

Rationale:

Administrative accounts have elevated permissions that can impact user management, security settings, data access, and system configurations. Restricting privileged access minimizes the risk of accidental misconfiguration, unauthorized changes, insider threats, and account compromise.

  

Impact:

Implementing this control may:

-   Reduce the number of users with administrative privileges.
    
-   Require role reviews and approval processes for privileged access.
    
-   Limit access to administrative functions for non-authorized users.
    
-   Improve security posture and compliance adherence.
    

  

Default Value:

Zoho allows administrators to assign privileged roles to users. By default, organizations may have multiple administrative accounts depending on their configuration and user provisioning practices.

  

Remediation:

Test Plan:

1.  Sign in to the Zoho Admin Console.
    
2.  Navigate to Roles and Administrators.
    
3.  Generate or review the list of users with administrative privileges.
    
4.  Verify each privileged account belongs to an authorized administrator.
    
5.  Confirm no inactive, terminated, shared, or unauthorized accounts have administrative access.
    
6.  Verify privileged users can perform administrative actions.
    
7.  Verify standard users cannot access administrative functions.
    
8.  Document review results and obtain management approval where required.
    

  

Implementation:

Zoho Directory / Zoho Admin Console

1.  Sign in to the Zoho Admin Console.
    
2.  Navigate to Directory → Users or Roles and Administrators.
    
3.  Review all users assigned privileged roles, including:
    

-   Super Administrator
    
-   Administrator
    
-   Organization Administrator
    
-   Service Administrators
    

5.  Verify each administrator has a documented business justification.
    
6.  Remove administrative privileges from users who do not require elevated access.
    
7.  Assign the minimum role necessary to perform job functions.
    
8.  Ensure shared administrator accounts are not used.
    
9.  Enable Multi-Factor Authentication (MFA) for all privileged accounts.
    
10.  Document and periodically review all privileged role assignments.
     

  

Backout Plan:

1.  Identify users whose administrative access was removed.
    
2.  Obtain management approval for restoration if required.
    
3.  Reassign the appropriate administrative role.
    
4.  Validate access is restored successfully.
    
5.  Monitor administrative activity following restoration.
    

  

References:

-   [Zoho Directory Administration Guide](https://www.zoho.com/directory/help/admin-guide/?utm_source=chatgpt.com)
    
-   [Zoho User and Role Management Documentation](https://www.zoho.com/mail/help/adminconsole/user-management.html?utm_source=chatgpt.com)
    
-   [Zoho Security Best Practices](https://www.zoho.com/security.html?utm_source=chatgpt.com)
    
-   [Principle of Least Privilege Guidance (NIST)](https://csrc.nist.gov/glossary/term/least_privilege?utm_source=chatgpt.com)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.