Once your core Directory environment is working, you can strengthen it with security policies, delegated administration, SSO, automation, integrations, and monitoring.
You do not need to configure every advanced feature immediately.
Choose the capabilities that match your organization's security, compliance, and operational requirements.
Define how users should authenticate and under what conditions they can access organizational resources.
You can configure areas such as
- Password requirements
- Multi-factor authentication
- Session controls
- Sign-in restrictions
- Authentication requirements
- Other security policies supported by your setup
What to consider
Your security requirements may differ depending on:
- User role
- Application sensitivity
- Work location
- Device
- Network
- Business requirements
For example, access to a finance application may require stronger authentication than access to a general internal application.
Why it matters
User credentials are often the first line of access to your organization's applications and data.
Authentication and security policies help reduce the risk of unauthorized access and establish consistent security requirements across your users.
Best practice
Avoid applying restrictive policies to your entire organization without testing them first.
Start with a small set of users or administrators, validate the behavior, and then expand gradually.
Once users and applications are configured, you can simplify sign-in by enabling single sign-on for supported applications.
SSO allows employees to access multiple connected applications using their organizational identity.
What to do
For applications that support SSO:
- Add or configure the application
- Configure the required SSO protocol
- Exchange the required identity provider and service provider information
- Test sign-in
- Roll out access to the required users
Why it matters
SSO can:
- Reduce the number of credentials users manage
- Provide a more consistent sign-in experience
- Give administrators greater control over application authentication
- Make it easier to revoke access centrally
Roll out gradually
Configure and test one or a few applications before enabling SSO across your entire application environment.
This helps you identify configuration issues without affecting all employees.
Delegate administration
As your Directory environment grows, avoid relying on a single administrator to manage everything.
Assign administrative responsibilities to trusted users based on their responsibilities.
What to do
Identify who should manage areas such as:
- Users
- Applications
- Security
- Directory integrations
- Domains
- Organization settings
Then assign appropriate administrative roles.
Why it matters
Delegated administration allows teams to manage the areas they are responsible for without unnecessarily giving them complete control over Zoho Directory.
Automate user provisioning and deprovisioning
For supported applications, automate account creation and removal based on user access in Zoho Directory.
What provisioning can help with
Depending on the application and integration, you may be able to automate activities such as:
- Creating user accounts
- Updating user information
- Assigning application access
- Removing or disabling access
- Keeping user information synchronized
Why it matters
Without provisioning, administrators may need to create and remove employee accounts separately in every application.
Automation reduces manual work and can make onboarding and offboarding more consistent.
Once your core security setup is in place, you can configure advanced access policies based on your organization's requirements.
Zoho Directory provides two advanced policy areas:
Conditional Access Policy
Conditional Access Policy lets you control access based on specific conditions rather than relying only on whether an application has been assigned to a user.
Depending on your Zoho Directory plan, you can configure supported conditions such as:
- IP-based restrictions - Control access based on the network or IP address from which the user is signing in.
- Device-related conditions - Allow or restrict access based on device-related requirements.
- Context-based conditions - Apply access decisions based on supported contextual factors around the sign-in attempt.
The Conditional Access options available to your organization depend on the Zoho Directory plan you are subscribed to. Review the capabilities included in your plan before designing or applying policies.
Routing Policy
Routing Policy is another advanced access capability that lets you determine how authentication should be routed for specific users or scenarios.
Use Routing Policy when your organization needs to direct authentication through different identity or authentication systems based on its configuration requirements.
Why it matters
Basic application assignment answers:
“Who should have access to this application?”
Conditional Access adds another layer by helping you determine:
“Under what conditions should that access be allowed?”
Routing Policy, on the other hand, helps determine:
“How should this user's authentication be routed?”
Keeping these as separate policy concepts makes it easier to choose the right control for each requirement.
Example
You might assign an application to a group but use Conditional Access to further control whether users can access it based on:
- The network they are connecting from
- The device being used
- Other supported contextual conditions
Routing Policy can be configured separately when authentication needs to follow a particular route for specific users or scenarios.
Best practice
Plan advanced policies carefully and test them with a limited set of users before applying them across the organization.
For Conditional Access, also verify that the policy conditions you intend to use are supported by your current Zoho Directory plan.
Connect your existing directory infrastructure
If your organization already uses another directory or identity environment, integrate it with Zoho Directory where appropriate.
Depending on your setup, this could include:
- Active Directory
- LDAP
- Directory stores
- Cloud directory services
- Other supported identity systems
What to consider
Before integrating, decide:
- Which system is the authoritative source for users
- Which attributes should be synchronized
- How frequently synchronization should happen
- What should happen when a user is disabled or removed
- How conflicts between systems should be handled
Why it matters
Directory integration allows organizations to adopt Zoho Directory without necessarily rebuilding their existing identity infrastructure from scratch.
It also reduces duplicate user administration.
Monitor activity and review your environment
Setting up Zoho Directory is not a one-time activity.
As employees, applications, and security requirements change, your Directory environment should be reviewed periodically.
Review areas such as
- Active and inactive users
- Administrator access
- Group membership
- Application assignments
- Authentication activity
- Security events
- Reports
- Audit logs
- Directory synchronization
- Access policies
Why it matters
Regular reviews help identify:
- Outdated access
- Unused accounts
- Incorrect administrator privileges
- Unexpected sign-in activity
- Configuration changes
- Access that is no longer required
Recommended practice
Establish a regular review cycle for your organization's identity and access configuration.
For example:
- Review administrators quarterly
- Review high-risk application access periodically
- Check synchronization regularly
- Review audit and security information when investigating access changes
Explore additional Zoho Directory capabilities
Once your core setup and security configuration are stable, explore additional capabilities based on your organization's needs.
These may include:
- Custom authentication
- Device management
- Device authentication
- Cloud LDAP
- RADIUS
- Directory Stores
- Anomaly Detection
- Controls
- Custom fields
- Advanced reports
- BYOK
- Other advanced security and identity-management capabilities
You do not need to configure every feature.
Choose capabilities based on your organization's identity architecture, application environment, security requirements, and compliance needs.