Zoho Vault lets users generate a recovery key so they can reset a forgotten master password without losing their data. The feature is on by default. If your security policy does not allow users to hold their own recovery keys, an administrator can turn recovery key generation off for the whole organisation, and then exempt specific users or groups. For how the recovery key works for users, read Zoho Vault Recovery Key: Reset a Forgotten Master Password Without Losing Data.

Turn off recovery key generation for the organisation

1. Click the Settings icon in the left sidebar.
2. Under Admin Configurations, click Fine-Grained Controls.
3. In the Disable group, toggle on Recovery Key Generation.

Exempt users or groups from the restriction

1. Click Manage Exemptions next to the Recovery Key toggle.
2. Select the users or user groups to exempt.
3. Save your changes.

Administrators can also exempt their own account directly from the Recovery Key Restricted screen. That screen is what users see when an administrator has restricted the feature.

Choosing a policy

This section is our own advice, not part of Zoho's guide. There are broadly two approaches:

• Leave it on. Users can protect themselves from losing personal passwords, but each person becomes responsible for storing a key safely and separately from the vault.
• Restrict it and exempt only the people who need it. This suits organisations that do not want unmanaged copies of recovery keys, but accept that a forgotten master password then means losing personal passwords, while shared passwords are kept.