Summary and recommendation
Zoho CRM user management can be run manually, but complexity usually increases with role models, licensing gates, and offboarding dependencies. This guide gives the exact mechanics and where automation has the biggest impact.
Zoho CRM user management runs through Setup > Users and Control > Users.
Every app in your stack that touches CRM data depends on getting this right: the wrong Profile or Role assignment at invite time means a user either sees too much or too little from day one.
The permission model is a two-layer hybrid - Profiles control which features and modules a user can access, while Roles control which records they can see through a hierarchy.
Both must be assigned at invitation time;
omitting either defaults to the lowest-access configuration.
Quick facts
| Admin console path | Setup > Users and Control > Users |
| Admin console URL | Official docs |
| SCIM available | Yes |
| SCIM tier required | Enterprise |
| SSO prerequisite | Yes |
User types and roles
| Role | Permissions | Cannot do | Plan required | Seat cost | Watch out for |
|---|---|---|---|---|---|
| Administrator | Full access to all CRM data, settings, user management, and customization. Can manage roles, profiles, integrations, and billing. | Cannot exceed the number of administrator seats defined by the plan; some super-admin actions (e.g., account ownership transfer) are restricted to the account owner. | All paid plans | Counts as a paid user seat at the plan's per-user rate | The first user who signs up becomes the 'Super Admin' (account owner); this designation cannot be transferred through normal user settings. |
| Standard User | Access determined by assigned Profile (feature permissions) and Role (data visibility in the hierarchy). Can create, edit, and view records within their data-sharing scope. | Cannot access Setup/admin settings unless the assigned Profile explicitly grants those permissions. | All paid plans | Counts as a paid user seat at the plan's per-user rate | Profile and Role must both be assigned at invitation time; omitting either defaults to the lowest-access profile and a role with no subordinates. |
| Light CRM User (formerly Free User) | Read-only or limited access to CRM records as defined by their profile. Cannot create or edit records unless the profile permits it. | Cannot perform administrative actions; limited module access compared to full users. | Available on Enterprise and above; exact availability subject to current plan terms | Billed at a reduced rate compared to full users; exact cost varies by plan | Light user availability and seat limits depend on the subscribed plan; verify current entitlements in the Zoho CRM pricing page before provisioning. |
Permission model
- Model type: hybrid
- Description: Zoho CRM uses a two-layer hybrid model. Profiles control feature-level permissions (which modules and actions a user can access). Roles define data visibility through a hierarchical structure (users in higher roles can see records owned by subordinate roles). Data Sharing Rules can further expand record visibility across roles. Field-level security is available to restrict individual field access within modules.
- Custom roles: Yes
- Custom roles plan: Available on Standard plan and above
- Granularity: Module-level and field-level permissions via Profiles; record-level visibility via Role hierarchy and Data Sharing Rules; territory-based access available on Enterprise and above.
How to add users
- Log in as an Administrator or user with 'Manage Users' profile permission.
- Navigate to Setup > Users and Control > Users.
- Click '+ New User' (or 'Invite Users').
- Enter the user's First Name, Last Name, and Email Address.
- Select a Role from the role hierarchy.
- Select a Profile to define feature permissions.
- Optionally assign the user to a Territory (Enterprise and above).
- Click 'Save' to send an invitation email to the user.
- The user must accept the invitation and set a password before their account is active.
Required fields: First Name, Last Name, Email Address, Role, Profile
Watch out for:
- The invited user must accept the email invitation before they can log in; the seat is consumed once the invitation is sent, not when accepted.
- Email address must be unique across Zoho accounts; if the user already has a Zoho account under a different organization, they will be prompted to switch.
- Adding a user beyond the purchased seat count will prompt an upsell to purchase additional licenses before the invitation can be sent.
- Users added via invitation are active immediately upon acceptance; there is no draft/pending state that holds a seat without consuming it.
| Bulk option | Availability | Notes |
|---|---|---|
| CSV import | Yes | Setup > Users and Control > Users > Import Users (CSV upload option within the Users page) |
| Domain whitelisting | No | Automatic domain-based user add |
| IdP provisioning | Yes | Enterprise (via Zoho Directory SCIM provisioning with supported IdPs such as Okta and Azure AD) |
How to remove or deactivate users
- Can delete users: Yes
- Delete/deactivate behavior: This app exposes delete operations in its API documentation, but the admin-console path may present removal as deactivation, archiving, or deletion depending on tenant configuration. Confirm whether the UI action is reversible before treating removal as recoverable.
- Navigate to Setup > Users and Control > Users.
- Locate the user in the Active Users list.
- Click the user's name to open their profile, or use the action menu (three-dot icon) next to the user.
- Select 'Deactivate'.
- Confirm the deactivation in the dialog prompt.
- The user is moved to the Inactive Users list and can no longer log in.
| Data impact | Behavior |
|---|---|
| Owned records | Records owned by a deactivated user remain in the CRM and retain the deactivated user as owner. Before deleting a user, the admin must transfer ownership of all records to another active user. |
| Shared content | Reports, dashboards, and other shared content created by the deactivated user remain accessible to users with appropriate permissions. |
| Integrations | API tokens and integration credentials associated with the deactivated user may stop functioning; integrations using that user's credentials should be re-authenticated under an active user. |
| License freed | Deactivating a user frees the paid seat, making it available for reassignment. The seat count decreases in the subscription upon deactivation. |
Watch out for:
- A user cannot be deleted until all records owned by that user are transferred to another active user; the system enforces this before allowing deletion.
- The Super Admin (account owner) cannot be deactivated or deleted without first transferring account ownership.
- Deactivated users still appear in historical activity logs and audit trails, preserving data integrity.
- If a deactivated user is the only member of a role, that role remains in the hierarchy but has no active members; this can affect data sharing rule calculations.
License and seat management
| Seat type | Includes | Cost |
|---|---|---|
| Standard User | Full CRM access as defined by assigned Profile and Role; all Standard plan features | $20/user/month (billed annually) on Standard plan; $35/user/month on Professional; $50/user/month on Enterprise (as of current pricing page) |
| Light CRM User | Limited/read-oriented CRM access; exact feature set defined by assigned Profile | Reduced rate compared to full user seats; exact pricing listed on Zoho CRM pricing page under Enterprise plan details |
- Where to check usage: Setup > Users and Control > Users - the Users page displays total active users vs. purchased seats. Subscription details are also visible under Setup > Subscription.
- How to identify unused seats: Navigate to Setup > Users and Control > Users and filter by 'Active Users'. Review the 'Last Login' column to identify users who have not logged in recently. No built-in 'unused seat' report exists; admins must manually review last-login timestamps.
- Billing notes: Zoho CRM is billed per user per month. Seats are consumed when a user invitation is sent (not when accepted). Deactivating a user frees the seat for reassignment. Annual billing requires purchasing a minimum number of seats upfront; mid-cycle seat additions are prorated. Seat reductions on annual plans typically take effect at the next renewal cycle.
The cost of manual management
Seats are consumed the moment an invitation is sent, not when the user accepts it. That means a delayed onboarding or a bounced invite email still costs a license. Identifying idle users requires manually reviewing the Last Login column under Active Users - there is no built-in unused-seat report or automated alert.
On annual plans, seat reductions typically take effect only at renewal, so over-provisioning mid-cycle has a real cost that doesn't self-correct quickly.
What IT admins are saying
Community evidence is not specific enough to quote or summarize yet for this app.
The decision
Deactivation is the safer default for offboarding: it blocks login, preserves all owned records, and keeps the user visible in audit trails. Deletion is available but requires a full record-transfer step first and is irreversible.
The Super Admin designation cannot be transferred through normal user settings - it belongs to the original account owner and requires a separate ownership-transfer process. Light CRM User seats offer a reduced-access option, but seat availability and limits vary by plan, so verify current entitlements before provisioning them at scale.
Bottom line
Zoho CRM's manual user management is functional but requires deliberate setup at every step. Every app that relies on CRM data visibility is only as accurate as the Profile and Role combination assigned to each user.
The absence of automated idle-seat detection and the mandatory record-transfer step before deletion are the two operational gaps most likely to create ongoing admin overhead.
Teams managing more than a handful of users should establish a documented offboarding checklist and a recurring Last Login audit cadence to keep seat usage clean.
Automate Zoho CRM workflows without one-off scripts
Stitchflow builds and maintains end-to-end IT automation across your SaaS stack, including apps without APIs. Built for exactly how your company works, with human approvals where they matter.