Zoho One administration works across three distinct tiers, each controlling a different layer of your organisation. Understanding which tier handles what makes it much easier to delegate admin work safely, rather than giving one person far more access than their role actually needs.

Tier 1: Organisation Owner

The top-tier account that owns the entire Zoho One organisation tenant.

• Billing and subscriptions. The paymaster for licences, add-ons, and payment methods.
• Vendor contact. The primary point of contact for Zoho support, security escalations, and official notices.
• Ultimate authority. The only role that can transfer organisation ownership, shut down the account, or perform global security overrides.

Tier 2: Directory Admins and Admin Roles

Administrators who manage users, security, and administrative settings within the Zoho One Admin Panel and Directory.

Two Mechanisms Work Together

• Roles. Define what actions an admin can perform, such as resetting MFA, assigning licences, or editing security policies.
• Scope control ("Admins Can Manage"). Limits where those permissions apply. An admin can be scoped to All or Specific Apps (provisioning users into specific applications such as CRM or Books, without configuring others), Groups (restricting control to specific user teams), or Spaces (limiting control to specific logical environments or business units within the Zoho One Spaces interface).

Available Roles

• Organization Admin. Near-full access to manage users, applications, domains, security policies, and subscriptions, but cannot transfer account ownership.
• Application Admin. Can add or edit apps and manage user assignments for the applications they're responsible for.
• Helpdesk Admin. Manages user details, password resets, and multi-factor authentication.
• Security Admin. Manages security configurations, Conditional Access policies, identity providers, and routing rules.
• Space Admin. Controls access, user assignment, and apps scoped specifically within an assigned Space.
• Custom Roles. Fine-grained administrative roles you build yourself, such as an HR Admin role limited to editing work locations and employee profiles.

Tier 3: Service Admins

Application-level administrators responsible for the in-app setup and business logic of specific tools, such as Zoho CRM, Zoho Books, or Zoho Desk.

Typical responsibilities include setting up custom fields, layout rules, and module workflows inside CRM; configuring the chart of accounts, tax templates, and invoice layouts in Zoho Books; and managing ticket routing, SLAs, and department views in Zoho Desk.

Why Split This Role Out at All?

• Principle of least privilege. A finance manager needs full admin rights inside Zoho Books to adjust accounting settings, but has no business managing security settings in the sales CRM or provisioning new email accounts in the central portal.
• Division of expertise. This prevents a non-technical team lead from accidentally altering central security rules, while still giving them full autonomy over their own department's daily tools.