Zoho CRM roles, profiles and sharing rules gone wrong: how to fix who sees what

Profiles control actions; roles control which records

A profile decides what a user can do: for example create, edit, delete or export records in each module, and which settings they can reach. A role decides whose records a user can see, based on position in the role hierarchy. Every user has one of each, and they answer different questions. Zoho's FAQ describes a profile as a collection of permissions for the actions a user needs to do their job, and roles as representing your organisation's hierarchy.

Many permission problems come from trying to fix a visibility problem with a profile, or an action problem with a role. Ask first: is the person unable to do something, or unable to see something?

Source: Zoho Help: FAQs on Roles and Profiles

How the role hierarchy works

Zoho's help page says users at a higher level of the hierarchy can access the records of users at a lower level, and that users in the same role cannot see each other's data by default unless the Share Data with Peers option is on. If a person sees too much, look at where their role sits in the tree; if they see too little, look at whether the people whose records they need sit in a different branch.

Source: Zoho Help: Role Management (role hierarchy, peers, Superiors Allowed)

Sharing rules are for extra access

Sharing rules are used to give extra access to records beyond what the hierarchy allows, for example sharing one team's deals with another team. Zoho's roles page notes one subtlety: managers do not automatically see data that was shared with their subordinates through a custom sharing rule unless the Superiors Allowed option is turned on. In our experience, if you need to restrict who sees something, the fix lies in the role structure, the module's default access level or the profile rather than in another sharing rule.

Source: Zoho Help: Role Management (role hierarchy, peers, Superiors Allowed)

Direct record sharing is a separate mechanism

A record can also be shared directly with a specific user, outside any rule: Zoho's help describes opening the record, choosing Share, and adding members with Read Only, Read/Write or Full Access. That is easy to forget when auditing, because it will not show up in your roles or sharing rules. If one person can see a record they should not, check whether someone shared it by hand. Zoho also states that a user's profile permission still applies on top of a share.

Source: Zoho Help: Share records

Editions and limits

Zoho's FAQ says that in the Free Edition only the Administrator profile and the CEO role are available, and that creating roles and profiles needs a paid edition (it names Professional, Enterprise and Ultimate) with more than one user in the account. We are not quoting per-edition counts: check Zoho's current help and pricing pages for your edition before planning a redesign.

Source: Zoho Help: FAQs on Roles and Profiles

A checklist when permissions look wrong (practical advice)

This section is advice from experience, not vendor documentation.

• Write down what the person should be able to do and see, in plain words, before changing anything.
• Separate the two questions: actions (profile) and visibility (role).
• Check the user's role position and the module's default access level.
• List every sharing rule and every manually shared record that touches the module.
• Change one thing at a time and test by comparing with a user who has the same profile and role.
• Avoid one custom profile per person; a small number of clear profiles is easier to maintain.
• Take a note of the old settings so a change can be reversed.

Want it designed properly?

Permission structures tend to grow by accident as teams change. Skyfall Labs can review your profiles, roles and sharing, and redesign them around how your team actually works. Because we are a Zoho Partner, treat our view with the interest we have disclosed.