Onboarding Guide

Zoho Mail provides secure and customizable business email hosting solution. It fosters collaboration with its intuitive interface, extensive tools, and robust security measures.

To login into your Zoho Mail account, enter the login credentials provided by your Organization Admin.

Steps for first time Login

1. Log into Zoho Mail.

2. Enter the email address and password.

   

3. You will be prompted to reset your password as the current password provided is a one-time password.

   

4. Set a new password and click on set password to confirm.

5. You will be redirected to the login page to enter the new password.

   

6. Your new password is set, and you can use this for your future sign-ins.
    

Once you login into Zoho Account using the login credentials, you will be enforced to enable MFA if your Organization Admin has mandated it.

Multi factor authentication (MFA)

Multi factor authentication (MFA) for accounts in Zoho adds an extra layer of security by requiring users to provide two or more authentication before granting access to their account. This typically involves something the user knows (like a password) combined with something they have (like a smartphone, hardware token, fingerprint or facial recognition).

Once MFA is enabled, all your future sign-ins will require authentication to avoid unauthorized access. If you are part of an organization, your organization admin will enforce you to set up a MFA mode if MFA is configured. If not you can configure any of the MFA modes from your Zoho accounts page.

MFA in Zoho

Zoho mainly provides with 4 MFA modes to enhance account security:

• Zoho OneAuth- Zoho OneAuth is a comprehensive multi factor authentication(MFA) app developed by Zoho. OneAuth provides you with multiple options such as passwordless sign-in, easy backup and recovery, generate one time password(OTP) using your phones and also biometric authentication. 
• OTP authenticator- OTP authenticator works on generating unique, temporary passwords which keeps on changing every 'n' second and different passwords will be generated everytime you login. You can also use the QR Code to authenticate.
• Security key- Security key involves usage of a physical devices such as USB device to authenticate your account. The security key inserted in the USB port must be registered with Zoho. Upon verification of the security key, access will be granted only if the user enters the password and inserts the security key.
• SMS-Based OTP- SMS-Based OTP works on providing temporary passwords through sms/ text message when you add your mobile number. The OTP comes with a time duration and are expired after a specific time.

Enabling Zoho OneAuth

Zoho OneAuth is one of the recommended mode to authenticate your Zoho account. Zoho OneAuth can be used to secure both your Zoho account and non-Zoho accounts. If you are part of a organization, your organization admin will have to configure Zoho OneAuth and you will be enforced to enable Zoho OneAuth MFA for your account. Zoho OneAuth provides 3 step verification for users to sign-in.

Requirements:

• Zoho Account
• Supported browser
• A smart Phone

Steps to enable Zoho OneAuth:

1. Download the Zoho OneAuth App from Playstore(Android) or Applestore(iOS).

2. Launch the app and Sign in with your Zoho Account credentials.

   

3. Click on either keep using Password or go Passwordless to continue.

   

4. Click on the 'Enable MFA' icon at the bottom of the authentication summary page.
5. MFA is enabled.

Once MFA is enabled, select " I've enabled MFA" in the Zoho OneAuth pop up screen in browser. 

Sign in Authentication

After enabling Zoho OneAuth MFA, whenever you login to your account you will be asked to authenticate either based on Password or Passwordless sign in.

1. Log into your Zoho account.

2. If you have enabled Password MFA, you will be asked to enter your password along with your mail address, and you will receive a notification in your mobile where you can either verify or deny the access. 

   

3. If you have enabled Passwordless MFA, whenever you enter your email, you will receive a notification where you can easily access your account using biometric authentication. 

   

Trusted Browser

It is typically recommended to proceed with caution before enabling the 'Trust this browser' option on your Zoho account. If 'Trust this browser' is turned on you need not verify everytime you login to your account from this browser. Verification through push notifications will not be sent for 180 days. However, relying solely on this option might compromise the security of your account, especially if you're using a shared or public device. 

Update MFA settings

After enabling MFA, you can modify how it works based on your requirements,

• You can update MFA by clicking on the edit icon next to your account in Zoho OneAuth app.

  

• Click on Passwordless if you want to sign in without entering a password.
• You can also choose between the various authentication methods, such as 'Push Notification', 'Scan a QR Code' or 'TOTP'.

• Extra layer of protection can be added through biometric verification by enabling Fingerprint authorization/ Face ID authorization.

  

Changing MFA mode

You can also change to a different MFA mode as per your requirements even after you have set up your account.

• Zoho OneAuth-Zoho OneAuth provides with single sign-in and Multi-Factor Authentication options. Users can authenticate themselves using biometric login, passcodes, and push notifications across various Zoho services. 
• SMS Based OTP-SMS Based OTP sends a unique code to the user's mobile number via text messages. The right code must be entered by the user to verify themself and login.
• OTP Authenticator -OTP Authenticator generates unique codes which change every 'n' seconds which can be used to authenticate sign in. 
• Security key-Security key is a physical device that must be inserted in the user's device to authenticate themselves. This acts as a extra layer of protection as a physical device is required to sign in.
• Passkey-Passkey typically involves a code or phrase that a user must enter to verify identity. The code or the phrase is stored in the mobile or any other device which has passkey enabled without the user having to manually remember it.

Steps to enable SMS Based OTP MFA:

1. Log into your Zoho account.
2. Click on your profile in the top right corner.

3. Click on 'My Account'.

   

4. Select 'Multifactor Authentication' from the left pane.

5. All the MFA modes available will be listed.

   

6. Click on the 'Set up Now' icon in the 'SMS Based OTP' mode.

   

7. Enter your mobile number to which you will receive a OTP to verify.

   

8. After verification, 'SMS Based OTP' will be enabled as your MFA.

MFA Recovery Methods for Zoho OneAuth

Zoho provides two options for MFA Recovery. You can enable any of them to avoid being locked out of your account if you lose access to your device.

Steps to enable MFA recovery method:

1. Log into your Zoho account.
2. Click on your profile in the top right corner.

3. Click on 'My Account'.

   

4. On the left pane, click on 'Multi-Factor Authentication'.

5. Scroll down to 'MFA Recovery Options'.

   

6. You can either choose between 'Backup verification codes' or 'Passphrase'.

7. If you choose 'Backup verification codes', new verification codes will be generated which you can either copy or download to recovery your Zoho OneAuth account.

   

8. To enable 'Passphrase', log into Zoho OneAuth app in your mobile, click on Account setting in settings and then recovery.

   

9. Enter the Passphrase and click on next to enable Passphrase.
10. MFA recovery is enabled.

Backup Verification Codes

In case you are unable to sign in to your account with Multi-factor authentication, you can also recover your account using the 'Backup Verification Codes'. You can generate these codes right after you enable MFA when you first login-in or in your Zoho accounts page. 5 backup verification codes will be generated for your account, which contains a 12 digit code. 

• Each code can be used only once to recover your account.
• The same codes will not be visible again due to security reasons.
• These codes should not be shared with anyone and should be kept confidential.

You can either copy the codes and keep them handy or download them on your device to continue sign in.

Password recovery

In case you forget your password, you can effortlessly reset your Zoho account password to login.

Steps to enable password reset:

1. Log into your Zoho account.
2. Click on your profile in the top right corner.

3. Click on 'My Account'.

   

4. You will be directed to the 'Profile' section in the Zoho accounts page.

5. Scroll down and click on 'My Email Addresses' to add a recovery email.

   

6. If you don't have any alternate email address, you can also add a mobile number to reset your password.

   

You can find the 'My Mobile Numbers' option at the end of the 'Profile' page.