Zoho CRM portal setup: give users the right record access

Start your Zoho CRM portal setup with an access matrix. List who will sign in, which records they should see and what they may change. Test that matrix with separate users before inviting your audience.

Planning this work for your team? See our Zoho CRM implementation service.

A useful portal lets someone complete a defined task without exposing unrelated information. Decide that task before choosing a layout or polishing the welcome message.

Define who uses the portal and what they should access

Choose an initial audience, such as customers checking their related records. Do not assume that customers, partners and vendors need the same information or edit rights.

Write the proposed access rules in a worksheet:

Test user	Expected records	Allowed changes	Must remain unavailable
Customer contact A	Records related to A under your agreed rule	Approved contact details	Customer B's records and internal notes
Customer contact B	Records related to B under the same rule	The same approved field set	Customer A's records and internal fields
Internal administrator	Configuration needed for maintenance	Approved portal settings	No assumption about the external user's view

These are design requirements, not a description of automatic defaults. Zoho's portal setup guide says portal users access only the modules and associated data granted to them. Your job is to configure and verify the grants.

Create the portal and select its modules

The Manage Portal Profile permission is required to create portals and invite users. Identify the administrator who will maintain the setup and confirm their access before starting.

Map the primary person record and the related information your audience needs. Write down the relationship that should connect each external user to each visible record. Resolve ambiguous or missing CRM links before treating the portal as ready.

For a customer example, define whether the task is reviewing a customer record, checking a related service item or updating agreed contact information. Select only the modules required for that task in the current setup screens. Confirm available operations and edition requirements in Zoho's help docs.

Keep the initial configuration small enough to inspect. Name the audience and record the configuration owner. Use the record visibility review to organise internal access questions that arise alongside portal setup.

Configure record operations and field permissions

For each selected module, write the required view, create and edit behaviour. Apply only the options supported by the current portal settings, then test the result. An operation being desirable does not establish that it is enabled or available.

Classify fields by purpose. Some are necessary for the user's task, some should be visible but protected from edits, and others should remain unavailable. Portal field settings can make selected fields read-only.

Portal field permissions are module-specific rather than layout-specific. Do not assume a different layout creates a separate field-security boundary. Review the actual module permissions when the same field appears in several views.

If a new customer-facing field is needed, define its meaning and ownership before adding it. The custom field guide helps make that decision reviewable. Keep internal classifications out of the portal unless they serve a clear external task.

Preview the portal and test two users

Prepare distinct test records for two users with different related data. Include a record each should see and a record each should not. Keep a written expected result beside every check.

Sign in as each external user through the intended route. Confirm the visible record list, field values and allowed operations. Then test a denied operation: an internal field, another customer's record or an edit that should be read-only.

Repeat after switching users. An administrator's preview alone is not enough evidence that the relationship rules work correctly for each external identity. Record the test identity, record identifier and result so another maintainer can reproduce the check.

If a related service record is missing, investigate its CRM relationship first. Inspect the case’s customer lookup and compare the intended customer record ID. Do not broaden the audience’s permissions to compensate for an incorrect link.

Invite users and explain web and mobile sign-in

Use a small, approved invitation group after access tests pass. Check the destination email and explain what the recipient should do when the invitation arrives. Keep support instructions specific to your portal.

Zoho's portal URL notice introduces a zcrmportals.com domain and advises updating bookmarks. Use the actual domain in the invitation rather than guessing a URL from the organisation name.

Portal users can sign in through the Zoho CRM mobile app, and mobile sign-in requires the portal domain included in the invitation. Invitations still come from the CRM web application, according to Zoho's mobile portal announcement.

If you want automatic invitations, verify the current supported process in Zoho's help docs and test it. Do not assume that a saved record or an email address alone triggers an invitation.

Troubleshoot invitations, attachments and Canvas access

An invitation problem, a missing record and an unexpected layout are different failures. Check the destination address and invitation domain first. Then inspect the user's relationship to the expected CRM records and the granted module and field access.

Can users access attachments? Verify the current portal's attachment behaviour with an approved sample file and the intended user. The facts here do not establish universal attachment access. Check the parent record relationship before changing permissions.

For conditional fields in a Canvas portal or restrictions on changing views, check Zoho's current help docs for the exact surface. A visually hidden field should not be your access-control strategy. Test the underlying permissions independently of the design.

Use the Canvas guide for layout diagnosis and the customisation guide for wider setup decisions. Keep the access matrix current as the portal grows, and rerun both users' tests whenever you change relationships or permissions.

Get help with this CRM task

For help with a portal with tested record access, contact zsetup. Include the audience, record/field access matrix and actions each user should perform. Share redacted examples rather than live customer details or credentials.

Our Zoho CRM implementation service explains the scope we can discuss and how the work is checked.