1. Open Users in Zoho Mail Admin Console and select the correct person.
2. Open Security > Change Password. Enter and confirm a new temporary password.
3. Require a change at the next login. If the reset follows suspected compromise, use the available option to sign the user out of existing devices.
4. Complete Zoho's administrator reauthentication prompt. Do not ask the user to give you their authenticator code.
5. Deliver the temporary password through an approved secure channel and ask the user to sign in promptly, set their own password and check recovery details.

Confirm webmail access before changing settings in multiple applications. The user should send and receive a harmless test message. Review the account's authorised applications and app passwords separately where applicable; changing the main password is not a complete investigation into every form of access.

An ordinary administrator cannot use this workflow to reset the Super Admin password. The organisation owner should use Zoho's official account-recovery process with its configured recovery methods. When federated sign-in is in use, identify the controlling identity provider before making conflicting password changes.

If a mail application keeps rejecting the password while webmail works, check whether it requires OAuth or an application-specific password. Do not disable multifactor authentication simply to satisfy an obsolete client.

Inspect recent account activity, unexpected forwarding, delegates and mail rules. Remove unauthorised access, preserve relevant incident details and inform the organisation's responsible contact. Do not paste the new password into a support ticket or ordinary email.

• Recovering Zoho account access after losing an MFA device
• Securing Zoho Mail and connecting email clients
• Setting up approved forwarding in Zoho Mail
• Investigating mailbox changes with Zoho Mail audit records

• Zoho: Password Reset
• Zoho: Two Factor Authentication