Can a Zoho CRM Admin / Super User Deactivate Two-Factor Authentication on a User?

Yes. A Zoho Super Admin or organisation administrator can disable or reset Multi-Factor Authentication (MFA/2FA) for a specific user. Because MFA is managed at the Zoho Accounts/Directory level, rather than strictly inside the CRM module itself, this needs to be actioned through the central admin panel rather than a CRM-specific setting.

Who Can Do This

This action requires one of: Organisation Owner, Organisation Admin, or a Custom role with the specific Disable MFA permission granted.

Prerequisite: The User's Domain Must Be Verified

This is a genuine, non-optional requirement, not just an edge case. Zoho enforces domain verification specifically to protect sensitive user management actions: Reset MFA, Disable MFA, Generate Backup Code, Create Mailbox, and Manage Email Address can only be performed for users whose email domain is verified within your organisation. This exists because an admin otherwise has broad access to a user's app data, and without this restriction, could unintentionally (or maliciously) take control of authentication settings for users on domains the organisation doesn't actually own or control, for example accounts using a personal Gmail address, or a domain added to the org but never fully verified.

Before attempting to disable or reset MFA for a user, confirm their domain shows as Verified (not pending) in your Zoho Directory or Zoho One Admin Panel, under the Domains section. If it isn't verified yet, verify it first (typically via a DNS TXT or CNAME record), then proceed with the MFA action once verification completes.

Method 1: Disabling MFA Entirely for a Specific User

Suited to situations where a user is locked out, changed phones, or lost their authenticator app and simply needs MFA switched off (temporarily or otherwise).

Sign in to Zoho One or Zoho Directory as an admin.
Go to Users (in Zoho One's Unified UI, this is under Directory in the left menu; in the older Spaces UI, it's a top-right icon then Users).
Click on the specific user.
Go to the Security Policies tab, and turn off the toggle under Multi-Factor Authentication (MFA).
On the pop-up, click Verify and re-authorize, confirming with your own admin password. Turn the toggle off again and click Yes, Confirm to finish.

Note: Beyond the domain itself needing to be verified, you also cannot disable MFA for an individual user whose own verified-domain email address is still unconfirmed on their end (shown with a "Yet to Verify" tag), until that user approves it. To disable MFA for multiple users at once, use the Quick Actions menu in the top-right corner instead of doing this one user at a time.

Method 2: Resetting MFA

If you'd rather the user set up a fresh authenticator device from scratch, without permanently switching security off for them, Reset MFA is the better option, and importantly, this remains available even when MFA is enforced organisation-wide (though it's still subject to the same domain verification prerequisite above).

Sign in to Zoho One, then click the Admin Panel icon (or Directory Settings, depending on your UI version) in the top-right corner.
Click on the specific user, or use the meatball menu (⋮) next to a user in the list.
Click Reset MFA.
On the pop-up, click Verify and re-authorize, confirming with your admin password.
Confirm on the following screen, then click Yes, Reset.

The next time the affected user logs into Zoho CRM (or any Zoho service), they'll be prompted to register a new MFA method from scratch.

Also worth knowing: Reset MFA cannot be performed for external users (though you can invite them to join your organisation first, after which their MFA becomes manageable), or for users who have a mobile number set as their primary login identifier instead of an email address.

Important Exceptions

Organisation-wide enforced policies. If MFA is enforced across the whole organisation via Zoho Security Policies or Zoho One, the individual Disable MFA toggle for that user simply won't be available; it doesn't appear in the interface at all while enforcement is active. In this scenario, Reset MFA (so the user can re-enrol) or temporarily moving the user into a security policy that excludes MFA enforcement are the available options instead.
Third-party identity providers (SSO). If your organisation logs into Zoho CRM via Google Workspace, Microsoft Entra ID (Azure AD), or Okta through SAML/SSO, MFA is managed entirely within that third-party provider's own admin panel, not within Zoho at all. Disabling or resetting MFA in this scenario needs to be done through Google, Microsoft, or Okta's own admin console.