Getting user permissions right in Zoho CRM matters for two reasons: security and usability. Security — so that sensitive records and settings are only accessible to the right people. Usability — so that each team member sees the information and tools relevant to their role without being overwhelmed by records and modules they do not need. Zoho CRM’s access control model has three layers that work together: profiles define what actions a user can perform, roles define what records a user can see, and data sharing rules handle exceptions where the role hierarchy is too blunt for specific needs. For the full security and compliance context, see the Zoho CRM security guide.
Layer 1: Profiles
A profile is a permission set that controls what a user can do in Zoho CRM. Every user is assigned one profile. The profile determines:
- Which modules the user can access.
- Whether the user can create, view, edit, delete or export records in each module.
- Which settings menus and admin functions the user can access.
- Whether the user can send mass emails, run bulk updates or import records.
Zoho CRM provides three default profiles: Administrator (full access to everything), Standard (access to CRM modules with typical sales rep permissions, no admin settings access) and Read Only (view all records, no create, edit or delete permissions). Create custom profiles for any role that requires a specific combination of permissions different from the defaults.
Common Custom Profiles
| Profile Name | Typical Permissions | Who Gets This Profile |
|---|---|---|
| Inside Sales Rep | Create/edit/view leads, contacts, deals, activities. No export. No delete. | Frontline sales reps handling inbound leads |
| Field Sales Rep | Same as Inside Sales + view account financial fields | External-facing account managers |
| Sales Manager | All Sales Rep permissions + delete + view all team records + run reports | Team leads and managers |
| Marketing | Create/edit leads and campaigns. No access to deal financial fields. | Marketing team members |
| Finance | View-only access to deals. Full access to invoices and quotes modules. | Finance team members who need deal context |
Layer 2: Roles
While profiles define what a user can do, roles define which records they can see. Roles are arranged in a hierarchy — users at a higher level in the hierarchy can see the records owned by users below them.
A typical role hierarchy for a B2B sales team:
- CEO / Sales Director — sees all records across all teams.
- Sales Manager — sees all records owned by reps in their team.
- Senior Sales Representative — sees their own records and optionally those of junior reps they mentor.
- Sales Representative — sees only their own records by default.
The role hierarchy is not the same as the organisational chart. It is specifically the hierarchy of record visibility. A finance director might be senior to a sales manager in the org chart but have no role-based access to CRM deal records at all — their access is controlled by their profile (Finance), not their position.
Layer 3: Data Sharing Rules
Data sharing rules handle the access control scenarios that the role hierarchy alone cannot address. The hierarchy is top-down — managers see their team’s records and everything below. Sharing rules handle lateral and cross-team visibility.
Common data sharing rule use cases:
- Key account visibility — the enterprise accounts team needs to see all deals on accounts with revenue above a threshold, regardless of which regional team owns the account. A sharing rule grants the enterprise team read access to those specific records.
- Partner access — an external partner needs to see and update deals they have referred, but no other deals. A sharing rule grants the partner profile access only to records where the Referral Partner field matches their account.
- Temporary team coverage — a sales rep is on leave and their manager needs to temporarily reassign their records to a covering rep. Sharing rules handle this without changing the original record owner permanently.
Field-Level Security
Beyond record-level access, Zoho CRM allows field-level visibility controls — specific fields within a module can be hidden from or made read-only for specific profiles. Field-level security is most commonly used for:
- Hiding deal financial fields from marketing or support team profiles.
- Making salary, commission or pricing fields visible only to managers and finance.
- Restricting edit access on record owner, creation date or audit fields to prevent accidental changes.
Field-level security is configured in Setup → Users and Control → Security Control → Field-Level Security. Select the profile, then the module, then set each field as visible, editable or hidden for that profile.
Setting Up Permissions for a New Zoho CRM Installation
For a new CRM installation, ABR recommends this permission setup sequence: create all user profiles first, then build the role hierarchy, then set up data sharing rules, then configure field-level security for sensitive fields. Doing it in this order means each layer builds on a stable foundation rather than requiring constant revision as the structure changes.
For existing Zoho CRM implementations where permissions have grown organically and become inconsistent, a permissions audit is the starting point. ABR’s Zoho CRM security review service includes a full permissions audit as its first deliverable, followed by a recommended configuration that aligns with your team structure and compliance requirements.
Frequently Asked Questions
How does Zoho CRM’s role hierarchy work?
Roles mirror the reporting structure of your organisation. A user in a higher role can see records owned by users in lower roles beneath them. A manager role sees all their team’s records; a rep role sees only their own. Roles control record visibility, not field access.
What is the difference between a role and a profile in Zoho CRM?
Profiles control what a user can do — which modules they can access, which actions they can perform (create, edit, delete, import). Roles control which records they can see based on the org hierarchy. Both must be configured to achieve the right access model.
Can I restrict access to specific fields in Zoho CRM?
Yes — field-level security allows you to hide specific fields from specific profiles. A rep profile may not see the cost price field; only the management profile can view it. Available on Enterprise plan and above.
What is a Data Sharing Rule in Zoho CRM?
Data sharing rules extend record access beyond the role hierarchy. They allow records from one role to be shared with users in a peer role, or records from specific criteria to be shared with a specific profile — without changing the underlying role structure.
Can ABR configure user permissions for our Zoho CRM?
Yes — permissions configuration is part of every ABR implementation. Book a free consultation →
