Stitchflow
Zoho CRM logo

Zoho CRM User Management Guide

Manual workflow

How to add, remove, and manage users with operational caveats that matter in production.

UpdatedMar 17, 2026

Summary and recommendation

Zoho CRM user management can be run manually, but complexity usually increases with role models, licensing gates, and offboarding dependencies. This guide gives the exact mechanics and where automation has the biggest impact.

Zoho CRM user management runs through Setup > Users and Control > Users.

Every app in your stack that touches CRM data depends on getting this right: the wrong Profile or Role assignment at invite time means a user either sees too much or too little from day one.

The permission model is a two-layer hybrid - Profiles control which features and modules a user can access, while Roles control which records they can see through a hierarchy.

Both must be assigned at invitation time;

omitting either defaults to the lowest-access configuration.

Quick facts

Admin console pathSetup > Users and Control > Users
Admin console URLOfficial docs
SCIM availableYes
SCIM tier requiredEnterprise
SSO prerequisiteYes

User types and roles

Role Permissions Cannot do Plan required Seat cost Watch out for
Administrator Full access to all CRM data, settings, user management, and customization. Can manage roles, profiles, integrations, and billing. Cannot exceed the number of administrator seats defined by the plan; some super-admin actions (e.g., account ownership transfer) are restricted to the account owner. All paid plans Counts as a paid user seat at the plan's per-user rate The first user who signs up becomes the 'Super Admin' (account owner); this designation cannot be transferred through normal user settings.
Standard User Access determined by assigned Profile (feature permissions) and Role (data visibility in the hierarchy). Can create, edit, and view records within their data-sharing scope. Cannot access Setup/admin settings unless the assigned Profile explicitly grants those permissions. All paid plans Counts as a paid user seat at the plan's per-user rate Profile and Role must both be assigned at invitation time; omitting either defaults to the lowest-access profile and a role with no subordinates.
Light CRM User (formerly Free User) Read-only or limited access to CRM records as defined by their profile. Cannot create or edit records unless the profile permits it. Cannot perform administrative actions; limited module access compared to full users. Available on Enterprise and above; exact availability subject to current plan terms Billed at a reduced rate compared to full users; exact cost varies by plan Light user availability and seat limits depend on the subscribed plan; verify current entitlements in the Zoho CRM pricing page before provisioning.

Permission model

  • Model type: hybrid
  • Description: Zoho CRM uses a two-layer hybrid model. Profiles control feature-level permissions (which modules and actions a user can access). Roles define data visibility through a hierarchical structure (users in higher roles can see records owned by subordinate roles). Data Sharing Rules can further expand record visibility across roles. Field-level security is available to restrict individual field access within modules.
  • Custom roles: Yes
  • Custom roles plan: Available on Standard plan and above
  • Granularity: Module-level and field-level permissions via Profiles; record-level visibility via Role hierarchy and Data Sharing Rules; territory-based access available on Enterprise and above.

How to add users

  1. Log in as an Administrator or user with 'Manage Users' profile permission.
  2. Navigate to Setup > Users and Control > Users.
  3. Click '+ New User' (or 'Invite Users').
  4. Enter the user's First Name, Last Name, and Email Address.
  5. Select a Role from the role hierarchy.
  6. Select a Profile to define feature permissions.
  7. Optionally assign the user to a Territory (Enterprise and above).
  8. Click 'Save' to send an invitation email to the user.
  9. The user must accept the invitation and set a password before their account is active.

Required fields: First Name, Last Name, Email Address, Role, Profile

Watch out for:

  • The invited user must accept the email invitation before they can log in; the seat is consumed once the invitation is sent, not when accepted.
  • Email address must be unique across Zoho accounts; if the user already has a Zoho account under a different organization, they will be prompted to switch.
  • Adding a user beyond the purchased seat count will prompt an upsell to purchase additional licenses before the invitation can be sent.
  • Users added via invitation are active immediately upon acceptance; there is no draft/pending state that holds a seat without consuming it.
Bulk option Availability Notes
CSV import Yes Setup > Users and Control > Users > Import Users (CSV upload option within the Users page)
Domain whitelisting No Automatic domain-based user add
IdP provisioning Yes Enterprise (via Zoho Directory SCIM provisioning with supported IdPs such as Okta and Azure AD)

How to remove or deactivate users

  • Can delete users: Yes
  • Delete/deactivate behavior: This app exposes delete operations in its API documentation, but the admin-console path may present removal as deactivation, archiving, or deletion depending on tenant configuration. Confirm whether the UI action is reversible before treating removal as recoverable.
  1. Navigate to Setup > Users and Control > Users.
  2. Locate the user in the Active Users list.
  3. Click the user's name to open their profile, or use the action menu (three-dot icon) next to the user.
  4. Select 'Deactivate'.
  5. Confirm the deactivation in the dialog prompt.
  6. The user is moved to the Inactive Users list and can no longer log in.
Data impact Behavior
Owned records Records owned by a deactivated user remain in the CRM and retain the deactivated user as owner. Before deleting a user, the admin must transfer ownership of all records to another active user.
Shared content Reports, dashboards, and other shared content created by the deactivated user remain accessible to users with appropriate permissions.
Integrations API tokens and integration credentials associated with the deactivated user may stop functioning; integrations using that user's credentials should be re-authenticated under an active user.
License freed Deactivating a user frees the paid seat, making it available for reassignment. The seat count decreases in the subscription upon deactivation.

Watch out for:

  • A user cannot be deleted until all records owned by that user are transferred to another active user; the system enforces this before allowing deletion.
  • The Super Admin (account owner) cannot be deactivated or deleted without first transferring account ownership.
  • Deactivated users still appear in historical activity logs and audit trails, preserving data integrity.
  • If a deactivated user is the only member of a role, that role remains in the hierarchy but has no active members; this can affect data sharing rule calculations.

License and seat management

Seat type Includes Cost
Standard User Full CRM access as defined by assigned Profile and Role; all Standard plan features $20/user/month (billed annually) on Standard plan; $35/user/month on Professional; $50/user/month on Enterprise (as of current pricing page)
Light CRM User Limited/read-oriented CRM access; exact feature set defined by assigned Profile Reduced rate compared to full user seats; exact pricing listed on Zoho CRM pricing page under Enterprise plan details
  • Where to check usage: Setup > Users and Control > Users - the Users page displays total active users vs. purchased seats. Subscription details are also visible under Setup > Subscription.
  • How to identify unused seats: Navigate to Setup > Users and Control > Users and filter by 'Active Users'. Review the 'Last Login' column to identify users who have not logged in recently. No built-in 'unused seat' report exists; admins must manually review last-login timestamps.
  • Billing notes: Zoho CRM is billed per user per month. Seats are consumed when a user invitation is sent (not when accepted). Deactivating a user frees the seat for reassignment. Annual billing requires purchasing a minimum number of seats upfront; mid-cycle seat additions are prorated. Seat reductions on annual plans typically take effect at the next renewal cycle.

The cost of manual management

Seats are consumed the moment an invitation is sent, not when the user accepts it. That means a delayed onboarding or a bounced invite email still costs a license. Identifying idle users requires manually reviewing the Last Login column under Active Users - there is no built-in unused-seat report or automated alert.

On annual plans, seat reductions typically take effect only at renewal, so over-provisioning mid-cycle has a real cost that doesn't self-correct quickly.

What IT admins are saying

Community evidence is not specific enough to quote or summarize yet for this app.

The decision

Deactivation is the safer default for offboarding: it blocks login, preserves all owned records, and keeps the user visible in audit trails. Deletion is available but requires a full record-transfer step first and is irreversible.

The Super Admin designation cannot be transferred through normal user settings - it belongs to the original account owner and requires a separate ownership-transfer process. Light CRM User seats offer a reduced-access option, but seat availability and limits vary by plan, so verify current entitlements before provisioning them at scale.

Bottom line

Zoho CRM's manual user management is functional but requires deliberate setup at every step. Every app that relies on CRM data visibility is only as accurate as the Profile and Role combination assigned to each user.

The absence of automated idle-seat detection and the mandatory record-transfer step before deletion are the two operational gaps most likely to create ongoing admin overhead.

Teams managing more than a handful of users should establish a documented offboarding checklist and a recurring Last Login audit cadence to keep seat usage clean.

Automate Zoho CRM workflows without one-off scripts

Stitchflow builds and maintains end-to-end IT automation across your SaaS stack, including apps without APIs. Built for exactly how your company works, with human approvals where they matter.

Every app coverage, including apps without APIs
60+ app integrations plus browser automation for apps without APIs
IT graph reconciliation across apps and your IdP
Less than a week to launch, maintained as APIs and admin consoles change
SOC 2 Type II. ~2 hours of your team's time

UpdatedMar 17, 2026

* Details sourced from official product documentation and admin references.

Keep exploring

Related apps

15Five logo

15Five

Full API + SCIM
AutomationAPI + SCIM
Last updatedFeb 2026

15Five uses a fixed role-based permission model with six predefined roles: Account Admin, HR Admin, Billing Admin, Group Admin, Manager, and Employee. No custom roles can be constructed. User management lives at Settings gear → People → Manage people p

1Password logo

1Password

Full API + SCIM
AutomationAPI + SCIM
Last updatedFeb 2026

1Password's admin console at my.1password.com covers the full user lifecycle — invitations, group assignments, vault access, suspension, and deletion — without any third-party tooling. Like every app that mixes role-based and resource-level permissions

8x8 logo

8x8

Full API + SCIM
AutomationAPI + SCIM
Last updatedFeb 2026

8x8 Admin Console supports full lifecycle user management — create, deactivate, and delete — across its X Series unified communications platform. Every app a user can access (8x8 Work desktop, mobile, web, Agent Workspace) is gated by license assignmen