A System Admin’s Guide to Securing Zoho One Using Active Directory (Part II)

In the first part of this guide, we discussed how to link Zoho One with Active Directory. We set up the AD environment and configured Zoho Directory Sync. After syncing, we built a solid base to connect your AD environment with Zoho One.

Now that integration is done, we must secure your Zoho One environment. With vital apps on a single platform, we must implement strong security measures to safeguard it. This guide will walk you through the actions to enhance the security of Zoho One post AD integration.

1. INTRODUCTION

This guide will help you secure your Zoho One setup after integrating it with Active Directory.

You will learn to:

• Set up Role Based Access Control (RBAC).
• Activate Multi-Factor Authentication (MFA).
• Configure Single Sign On (SSO).
• Apply security best practices. (These include whitelisting IP addresses and managing security policies.)

We will also cover making a security checklist. It will ensure that key security protocols are properly set up and maintained.

2. ROLE-BASED ACCESS CONTROL (RBAC)

2.1. Understanding Roles in Zoho One

Zoho One has roles to help you control access in your company. These roles set what users can or cannot do on the platform. The preset roles are: Administrator, Standard User, and app-specific roles.

It’s crucial to link AD groups to Zoho One roles according to your organization’s setup.

2.1.1. Mapping AD Groups to Zoho One Roles

Once you sync your AD groups with Zoho One, you can map them to the appropriate Zoho One roles. This mapping ensures users inherit the correct permissions based on their AD group membership. To do this:

Navigate to the Admin Panel in Zoho One, then go to Settings and select Groups. From there, choose the AD Group you wish to manage.

Locate the AD User and click on Add Application (+) under the Applications section. Select the application you want to assign to the user.

Choose the user’s Role and Profile. Then, click Done and Assign to finish.

Do the same for each user in the AD groups. Roles are accurately allocated through this process.

 

2.2. Creating Custom Roles

Zoho One allows users to design roles apart from the default ones. These roles can be customized to match the requirements of your organization. Custom roles let you define permissions. They guarantee users access only to the needed resources.

2.2.1. How to Create and Assign Custom Roles

From Zoho One’s Admin Panel, navigate to Settings then go to Admins. Select Roles and click on + Add Role.

Enter a Role Name and Description. You can choose to Quickly Set Permissions or Manually Set Permissions.

If you select Quickly Set Permissions, you can assign the role to administer applications, users, or both. After making your selections, click Create.

If you prefer to Manually Set Permissions, select a category. Then, choose the specific permissions for that custom role. Once you have selected all desired permissions, click Create.

Your custom roles will be visible under All Roles or Custom Roles. You can then assign this role to either a local user or a user from a synched AD group.

To check a role, simply left-click the role name. You can view the permissions linked to that role under Permissions. The Users section displays the users currently linked to that role.

If you need to make any alterations, click on Edit Role, modify as needed, and then save by clicking Update.

 

3. IMPLEMENTING MULTI-FACTOR AUTHENTICATION (MFA)

3.1. Importance of MFA

Multi-Factor Authentication (MFA) boosts security. It asks users to confirm their identity using more than just a password. This is vital in environments integrated with Active Directory (AD). A single compromised credential could jeopardize the organization.

3.2. Configuring MFA in Zoho One

After enabling Multi-Factor Authentication (MFA) for a user, they must verify their chosen method to access their account. You can personalize the MFA methods that users can choose from.

3.2.1. How to Enable MFA in Zoho One?

Go to Zoho One. Then, in the Directory, select Security. Next, select the Security Policies tab.

Next, choose the policy you want to configure. Proceed to the Multi-factor Authentication (MFA) section, and click on Setup.

After that, select the authentication modes that you want your users to have as options.

Now, set the MFA Lifetime as needed. If needed, enable the backup recovery codes. Finally, click Update Policy.

The MFA Lifetime setting defines how long users won’t need MFA after signing in from a trusted browser.

3.2.2. How to Disable MFA in Zoho One?

To remove an MFA policy, go to the Admin Panel. Then, select Directory, go to Security, and Security Policies.

Next, find and click on the specific policy from which you want to remove MFA. Under Multi-factor Authentication, scroll down and select Remove MFA. A confirmation prompt will appear; click Yes, Remove.

Once an MFA policy is removed, the next highest priority policy will apply to the user. If no other policies are in place, the default policy will be enforced.

4. SETTING UP SINGLE SIGN-ON (SSO)

4.1. Introduction to SSO

Single Sign-On (SSO) simplifies login. It lets users access multiple apps with one set of credentials. SSO with Zoho One streamlines user logins and boosts security by centralizing access control.

4.2. Configuring SSO

To set up SSO between Active Directory (AD) and Zoho One, access the Zoho One Admin Panel. From there, go to the Directory section. Then, to Security and click Custom Authentication.

In the Custom Authentication settings, choose an IdP, like Active Directory. Provide the SSO URL, certificate, and preferred sign-in method. After entering all the required information, click Save to finalize the configuration.

 

5. CONFIGURING ALLOWED IP ADDRESSES

5.1. How to Configure Allowed IPs?

Blocking certain IP addresses can stop unauthorized access. It is an effective way to boost your organization’s security. With this setup, only users from approved IPs can access your system.

In the Zoho One Admin Panel, navigate to Directory and select Security. Next, click on Security Policies. Then, choose the policy to configure.

Go to the Allowed IPs section. Click on Add IP Address, enter the required IP address, and then click Add.

To remove an IP address, click the “x” next to it. Then, confirm by clicking Yes, Remove.

 

6. SECURITY BEST PRACTICES AND MONITORING

6.1. Configuring and Managing Security Policies in Zoho One

Creating groups ensures security measures can be applied. So, it’s essential to set policies before onboarding employees.

Security protocols offer methods to safeguard both your company and its staff. We must create and enforce security measures for Zoho One. They are vital to its safety.

6.1.1. How to Add a Security Policy?

In Zoho One, navigate to Directory, then select Security, and go to Security Policies. Next, click on Add Security Policy.

Give the new policy a name and select the groups to which the policy will apply. If some users in those groups should be exempt from the policy, list them under Exclude Users.

Set the policy’s priority. It determines its order among other policies. The new policy will be placed above the selected policy.

After setting the priority, click Add. You can then proceed to configure the policy according to your requirements.

6.1.2. How to Configure Session Management in Zoho One?

Go to the Security tab in the Directory. Then, find the Security Policies section. Select the policy you wish to configure.

Go to Advanced Settings. Set the Session Lifetime, Idle Session Timeout, and Concurrent Sessions as needed.

6.1.3. How to Reorder Policy Priority?

With security policies in place, it’s important to prioritize them. This will help decide which ones affect a user.

To change the priority, you can easily rearrange the policies by dragging them. The policy listed at the top has the most priority.

6.1.4. How to Delete a Security Policy?

If you remove a security policy, the system will auto enforce the policies’ priorities.

To delete a policy, start by hovering over the one you want to remove. Next, click on the Options menu. Choose Delete.

6.1.5. How to Deactivate a Security Policy?

When you turn off a security rule, the system will reorder the policies and enforce them as needed.

To disable a rule, simply hover over the rule you want to disable, click on Options and choose Deactivate.

6.1.6. How to Manage Security Policies for Users?

To apply a security policy for a single user, sign in to Zoho One. Then, navigate to the Directory section in the left menu. Go to the Users tab and select the specific user you want to manage.

Next, click on Security Policies and choose either Add User to Policy or Exclude User from Policy.

To reset multi-factor authentication (MFA) for a single user, select the user from the Users tab and click on Reset MFA.

To reset MFA for all users, go to the Security section of the Directory. Then, click Quick Actions in the top-right corner. From there, select either Reset MFA or Disable MFA.

After the MFA reset, the user must set up their MFA method again the next time they sign in.

6.1.7. How to Apply an Existing Security Policy to New Groups?

When assigning a new policy to a group, consider their existing policies already in effect. If a group is subject to several security policies, they will be enforced by priority.

Navigate to the Security section within the Directory. From there, go to Security Policies. Locate and click on the policy you wish to configure.

In the policy configuration screen, click the “+” button under Applicable Groups. Choose the desired groups from the list, and then click Apply.

6.2. Creating and Managing Password Policies in Zoho One

Passwords remain the most prevalent method for user authentication. However, many people weaken their organization’s defenses. They reuse a weak password on multiple sites.

To avoid a common security trap, enforce strict password policies. Ensure users meet strong security requirements.

6.2.1. How to Configure a Password Policy?

In Zoho One, navigate to the Directory. From there, select Security and then Security Policies. Click on the policy you wish to configure.

Next, go to the Password Policy section and click Setup.

You will see three preset options for Password Strength. Select one of these presets, or opt for Custom if you prefer.

If you choose Custom, configure the Password Complexity and Password Age settings as needed. After making your selections, click Update Policy to apply the changes.

6.2.2. How to Remove a Password Policy?

Select the policy from which you want to remove the password. Navigate to the Password Policy section. Click on Remove Password Policy. Confirm the action by clicking Yes, Remove.

The password policy will be successfully removed. To enforce the newly prioritized user policy, you will need to reset all passwords.

6.3. Monitoring and Alerts in Zoho One

Regular monitoring and alerts are vital. They help detect and respond to suspicious activities. To check for security alerts, go to the Security section in the Directory menu. Then, select Notifications. Here, you will find all critical alerts related to policy issues.

To stay secure and find threats, regularly review your security logs. To access security logs, go to Directory from Zoho One’s Admin Panel, then go to Reports.

This section lets you examine various logs. These include: successful and failed sign-ins under Login; MFA status under Multi-Factor Authentication (MFA); and sign-in activities under Applications.

 

7. CREATING A SECURITY CHECKLIST

Securing Zoho One after Active Directory integration involves multiple, critical steps. Each step must be carefully reviewed and verified. A well-organized security checklist ensures that no essential task is overlooked.

7.1. How to Design a Security Checklist?

Designing an effective security checklist requires categorizing tasks based on their priority and relevance to your specific environment. Here’s how to create one:

1. Identify Core Security Areas

• Access Control: RBAC configuration, user role assignments, and permissions.
• Authentication Methods: MFA setup, backup procedures, and SSO configuration.
• Network Security: IP whitelisting and network access restrictions.
• Policy Enforcement: Security policy configuration and session management.
• Monitoring & Alerts: Setting up regular monitoring, logs, and alerts.

1. Break Down Each Task

For each core area, list out the specific tasks that need to be completed. For example:

• Access Control:
  • Verify that all AD groups are correctly mapped to Zoho One roles.
  • Ensure custom roles are properly configured and assigned.
• Authentication Methods:
• Confirm that MFA is enabled for all critical users and services.
• Test SSO functionality with all integrated applications.
• Assign Responsibility

Clearly designate team members responsible for completing each task. This helps ensure accountability and timely completion.

1. Set Deadlines

Assign deadlines for each task to ensure that your security setup is completed within an accep
timeframe.

1. Review and Revise

Periodically review the checklist to ensure all items are completed, and revise it as needed to incorporate any new security measures or changes in your environment.

7.2. Comprehensive Security Checklist

Here’s an example of a comprehensive security checklist you can use:

Role Assignments and RBAC Configurations	Map AD groups to appropriate Zoho One roles.
	Create and assign custom roles as needed.
	Review role-based permissions to ensure compliance with organizational policies.
MFA Settings and Backup Procedures	Enable MFA for all users and configure preferred authentication methods.
	Set MFA lifetime and backup recovery codes.
	Conduct a test login with MFA to ensure it’s working as expected.
SSO Setup and Testing	Configure SSO with your chosen Identity Provider (IdP).
	Test SSO across all integrated applications.
	Validate certificate and sign-in methods.
Security Policies and Monitoring Configurations	Set up and enforce security policies, including session management and password policies.
	Configure allowed IP addresses and network restrictions.
	Activate monitoring for login activities.
	Review security logs regularly to identify and mitigate potential threats.

8. CONCLUSION

Securing your Zoho One environment is vital. It protects your organization’s data and systems. This guide will help you build a strong defense against security threats. These steps are to: configure RBAC, enable MFA, set up SSO, and enforce security policies.

Remember, security is not a one-time task, but an ongoing process. Regularly review and update your security settings. Monitor for anomalies. Stay informed about the latest security practices. This will keep your Zoho One environment secure as new threats arise. Your vigilance and action are the best defenses against evolving cyber threats.