Zoho CRM 2FA Not Manageable: Check Domain Verification and SSO First

Two-Factor Authentication Not Manageable in Zoho CRM: Check Domain Verification and SSO First

If you've gone looking for a way to disable or reset a user's two-factor authentication in Zoho CRM and can't find the option, or it doesn't seem to do anything, there are two likely causes worth checking, in order.

Cause 1: Their Domain Isn't Verified in Zoho Directory

Zoho enforces domain verification specifically to protect sensitive user management actions, including Reset MFA, Disable MFA, Generate Backup Code, Create Mailbox, and Manage Email Address. These can only be performed for users whose email domain is verified within your organisation. If the affected user's domain hasn't been fully verified, the admin simply won't be able to action any of these for them, regardless of role or permission level.

The quick check: In your Zoho Directory or Zoho One Admin Panel, go to Domains and confirm the user's domain shows as Verified rather than pending. If it's still pending, complete verification (typically via a DNS TXT or CNAME record) before attempting the MFA action again.

Cause 2: Your Organisation Uses a Third-Party Identity Provider (SSO)

If your organisation signs into Zoho CRM via Google Workspace, Microsoft Entra ID (Azure AD), or Okta through SAML/SSO, two-factor authentication is managed entirely within that third-party provider's own admin console, not within Zoho Directory or Zoho One at all. The Zoho-side MFA controls exist and are documented, but simply don't apply when SSO is the actual authentication method in use.

How to confirm this is your situation: If users log in by clicking a "Sign in with Google" or "Sign in with Microsoft" style button, rather than entering a Zoho-specific password directly, your organisation is on SSO, and this is almost certainly why the Zoho-side MFA toggle isn't doing what you expect.

The Fix for SSO Organisations

Go to your actual identity provider's own admin console, not Zoho's, to manage MFA for the affected user:

  • Google Workspace. Manage 2-Step Verification for the user from the Google Admin console.
  • Microsoft Entra ID (Azure AD). Manage MFA and authentication methods from the Entra admin centre.
  • Okta. Manage MFA enrolment and factors from the Okta admin console.

Once MFA is disabled or reset on the identity provider's side, the change takes effect the next time the user authenticates through SSO into Zoho CRM.

If Neither of These Is the Cause

If your domain is verified and you're not on SSO, MFA is manageable natively via Zoho Directory or Zoho One. See our full guide on disabling or resetting a Zoho CRM user's two-factor authentication for the complete steps, including what to do if MFA is enforced organisation-wide.
Need help? 1 Cloud Consultants can help you diagnose why MFA management isn't working for a user, whether that's a domain verification gap or an SSO setup, and get it managed correctly. Book a discovery call with 1 Cloud Consultants.