Deactivated Zoho One account can sign in

Deactivated Zoho One account can sign in

I am concerned by the fact that deactivated users in Zoho One have the ability to sign in even after their account has been deactivated (not deleted).

these inactive identities have no access to individual Zoho apps or data. based on my experience they can still access accounts.zoho.com though. this is not desired as it means they can still access some basic org data such as SAML metadata, verified domains (read access) or even create a new group (write access). basically almost anything within accounts.zoho.com. 

while probably not dangerous directly, I am uncomfortable with such 'feature' as it could be misused in some creative ways including an attack involving social engineering for example. I also wonder if this behaviour of deactivated accounts meets compliance such as SOC 2 stated on the homepage https://www.zoho.com/compliance.html.

based on my conversation with Zoho support this 'feature' seems to be by design. what's the reason?

should I delete inactive accounts? but then I do not want to lose historical data. or is there another way / layer of user deactivation that I am not aware of?

I understand there might be use cases where one Zoho account could be linked with to different orgs. perhaps this open behaviour for accounts.zoho.com was designed for that. for us this is unexpected behaviour at least, against basic security expectations and even more controversial in an enterprise setting.

expected behaviour: a deactivated account should not be able to sign in.

here is a screenshot where I logged in as inactive user (with their old password / MFA) and created a group Foo.


    • Sticky Posts

    • How to Add Users to your Organization in ZohoMail?

      A better clarity so you can create other users to start using Zoho Mail. You can directly Add Users from the Control Panel to your Organization. You can invite users with the existing email address. If the person (user) already uses ZohoCRM, then you can import users from Zoho CRM. You can also import them using a .csv file. (if you are planning to add them in Bulk)  In this topic, We will be discussing on how to Add and Invite users only.  The Import options are self explanatory. ____________________________________________________________________________________________________________