A sales rep logs in on her first morning, opens the Deals module, and can see every open opportunity in the company — the CEO's included. She can edit them. She can delete them. That is not a Zoho bug; it is what happens when someone creates users and skips the two settings that govern access. When clients hand that cleanup to our Zoho CRM consultants, the fix — how to set up roles and profiles in Zoho CRM properly — is almost never complicated. It is just usually done in the wrong order, or not at all.
In Zoho CRM, roles and profiles solve two separate problems. A role controls whose records a user can see — it is the reporting hierarchy, so a manager's role sits above her reps' and inherits access to their records. A profile controls what a user is allowed to do — the permission set that decides whether they can create, edit, delete, export, or reach Setup at all. One is about data visibility; the other is about actions. Confuse them and you either lock people out of their own pipeline or leave the whole database wide open.
That distinction matters more than it sounds. In Verizon's 2024 Data Breach Investigations Report, 35% of breaches involved internal actors — up from 20% the year before (2024 DBIR). Least-privilege access isn't paranoia; it's the cheapest insurance your CRM has.
Think of it as two axes. Roles answer "up or down" — a vertical ladder of who reports to whom. Profiles answer "in or out" — a flat set of switches for each thing a person can touch. A user always has exactly one role and one profile, and the two are set independently.
Roles | Profiles | |
Governs | Whose records you can see | What actions you can take |
Model | A reporting hierarchy (tree) | A permission set (checklist) |
Example rule | "Managers see their team's deals" | "Reps can't delete or export" |
Where it lives | Setup > Security Control > Roles and Sharing | Setup > Security Control > Profiles |
Per user | Exactly one | Exactly one |
Two people can share the same profile (Standard) but sit at different levels of the role hierarchy, so they can do the same things to a different set of records. That combination is the whole point.
Roles mirror your org chart. Before you touch the screen, sketch the reporting lines — who needs to see whose numbers. Then build it top-down.
Go to Setup > Security Control > Roles and Sharing. Zoho ships a default two-level hierarchy (CEO with Manager beneath it); you'll extend it.
Hover over the parent role and click Add Role (or open a role and use New Role).
Name it — use titles, not people ("Sales Manager – West," not "Priya").
Set Reports To to the role directly above it. This one field is what grants the upstream manager visibility into everything below.
Decide whether peers at the same level share data. Leave that off unless two managers genuinely need each other's records.
Save, and repeat down the tree until every seat has a home.
Here's a worked example for a regional sales org:
The VP of Sales sees every deal under both managers. Each manager sees only their own region. Reps see only what they own. Nobody had to write a rule for that — it falls straight out of the "Reports To" chain. When you later need cross-team exceptions (say, a shared enterprise pod), that's a data-sharing or assignment rule on top, not a change to the hierarchy.
Profiles are where you stop people from doing damage. Zoho gives you Administrator and Standard out of the box; you'll usually clone Standard and tighten it rather than start from scratch.
Go to Setup > Security Control > Profiles.
Click New Profile, then choose an existing profile (usually Standard) to clone. Cloning inherits every current permission, so you only adjust the deltas.
Name it for the job, not the person — "Sales Rep," "Support," "Read-Only Exec."
Open the profile and work through the permission categories: module-level view / create / edit / delete, plus tools like Export, Import, Mass Update, and Setup access.
Turn off what the role shouldn't have. A rep rarely needs Delete or Export; a support agent might get read-only Deals. Reserve Setup and user management for admins only.
Save, then assign the profile when you invite or edit each user.
The reflex to fight is handing out Administrator "just to be safe." That single profile can rewrite fields, delete modules, and pull the full database to a spreadsheet. Keep it to one or two people. If your team is wiring these permissions alongside custom field types and layouts, tighten the profile before the data lands, not after.
Picture the same Standard profile assigned to a rep and to a manager. Both can create and edit deals — identical actions. But the manager's higher role means those actions apply to her whole team's records, while the rep's apply only to his own. The profile sets the verb; the role sets the object. A Zoho integration that pushes leads in from your website inherits the same rules, so access stays consistent no matter where a record is born.
The most common failure we see as a business systems consultant is treating these as one dial — cloning a "manager" profile with extra permissions and calling it a promotion, when the person actually needed a higher role to see more records. Separate the two questions ("what can they do?" versus "whose data can they touch?") and the setup gets obvious. Want a second set of eyes on your security model before you scale seats? Book a free Zoho consultation and we'll pressure-test it with you.
Build the role hierarchy first so visibility flows from your real org chart, then layer profiles on top to fence off the actions each seat shouldn't take. Do it in that sequence and new users land with exactly the access they need — no wide-open Deals module, no rep who can wipe the pipeline. If you'd rather not learn the edge cases the hard way, Book a free Zoho consultation and we'll map roles and profiles to your team in one session.
By the CodeStringers Team — Zoho Experts & Custom Software.
We're a custom software engineering firm with a dedicated Zoho practice, and we write from the security models, migrations, and builds we've actually shipped for clients — not from the brochure.
In a no-risk discovery we look at your CRM, finance and operations systems and who owns each part, and show what a connected system would do differently. You pay only if you proceed. Or see how we approach it.
More on the same problem:
Zoho CRM Roles and Permissions: Roles Set Reach, Profiles Set Rights (article)
Zoho CRM User Roles and Permissions: Who Sees What, Who Can Do What (article)
Your Forecast Is Wrong Because Nobody Configured A Pipeline | Zoho CRM Stage Probability (video)
No. Every user has exactly one role and one profile. When someone needs the visibility of one role and the permissions of another, the fix is a new role in the hierarchy or a data sharing rule, not a second assignment. Groups can be used to share records across teams that sit in different branches of the hierarchy without changing anyone's role or profile.
Use data sharing rules, which grant read or read-write access from one role or group to another for a module, or share individual records directly from the record. Groups are the usual tool for cross-functional teams such as a deal desk that spans regions. This keeps the hierarchy aligned to reporting lines while still opening the specific records people need.
Profile permissions decide what a user can do in a module, such as create, edit, delete or export. Field-level security, set per profile, decides which fields a user can see or edit within those records. A rep might be able to edit deals but see the margin field as read-only or not at all. Use both when confidential values sit on records everyone needs to open.
Keep it minimal. Two or three roles that mirror real reporting lines and two profiles, Administrator and a tightened Standard, cover most small teams. Resist creating a role per person, which becomes unmanageable when people change jobs. Review the setup when the team passes about ten users or when a new function such as support or finance starts using the CRM.
Yes. The audit log under Setup records changes to roles, profiles and sharing rules, along with the user who made them and when. Review it after onboarding or offboarding and whenever access questions come up. Pair it with a periodic review of the profile list so unused profiles and roles from departed staff are removed rather than left active.
"Something isn't working." "We're outgrowing our tools." "We're afraid to make the wrong move." No-Risk Discovery is a short, practical conversation that gets you clarity before you commit to anything big. We'll tell you if we're a fit. If we're not, we'll tell you that too.
Say who you are and ask. A person replies within one business day.
