Yes, and this is genuinely good news since it was first documented. Restricting sign-ups on your verified domain used to require raising a ticket with Zoho Partner Support on your behalf; it's now a native, self-service setting available directly to any organisation admin.

The Scenario This Solves

A common problem: once colleagues hear that Zoho is being rolled out at their organisation, some sign up for individual Zoho accounts using their work email address before the official rollout, creating stray accounts that then need to be found, exported, and deleted before proper onboarding. Restricting the domain prevents this entirely.

Prerequisite: Domain Verification

What Happens Once Restricted

Once you, as the verified domain owner, restrict external usage of your domain:

• No one can sign up for a personal Zoho account using an email address on your domain. They'll see a message explaining that the domain is restricted by its owner.
• No one can add an email address on your domain as a secondary or recovery address on an unrelated account.
• People can only join your organisation through a direct invite sent by your organisation admin.

A Related Security Enhancement

Zoho has also since extended domain verification requirements to sensitive user management actions specifically: organisation admins can now only reset MFA, disable MFA, generate backup codes, create a mailbox, or manage a user's email address for users belonging to a verified domain, further reducing the risk of unauthorised account recovery attempts.