# Zoho CRM roles, profiles and data sharing: what a sales manager can see

https://salesbond.app/blog/zoho-crm-roles-profiles-sales-manager-deal-visibility/
Published: 2026-10-24 · Updated: 2026-10-24

In Zoho CRM, a role sets whose records a user can see through the hierarchy, a profile sets which modules and actions the user can use, and data sharing rules widen access beyond what the hierarchy gives. A manager who cannot see a rep’s deal usually has a role problem. To confirm what a manager really sees, log in as a rep and look, rather than reading the settings pages.

## Zoho CRM roles vs profiles: whose records versus what you may do

Zoho’s help says CRM records are private by default, so that the record owner and his or her manager can oversee them ( [Zoho CRM help: Setting up Data Sharing Rules](https://help.zoho.com/portal/en/kb/crm/security-control/manage-data-sharing/articles/data-sharing-rules)). “Manager” means anyone above the owner in the role hierarchy, built under Setup > Security Control > Roles and Sharing, where each role has a Reports To field ( [Zoho CRM help: Managing Roles](https://help.zoho.com/portal/en/kb/crm/security-control/role-management/articles/role-management-introduction)). If Tom’s role reports to the sales manager’s role, the manager sees Tom’s deals. If it reports to someone else, the manager sees nothing of Tom’s.

The profile answers a different question. Zoho defines it as a collection of permissions for the actions a user needs: which modules are switched on, create, edit and delete, and admin rights such as Manage Data Sharing ( [Zoho CRM help: FAQs, Roles and Profiles](https://help.zoho.com/portal/en/kb/crm/faqs/roles-and-profiles/articles/faqs-roles-and-profiles)). A rep and a manager can share one profile and still see different deals.

So which one is it? If the Deals tab is missing for the manager altogether, the module is off in his profile. If Deals is there but Tom’s deals are not, it’s the role.

The shorthand we use is the one from our [Salesforce role hierarchy write-up](https://salesbond.app/blog/salesforce-role-hierarchy-sales-manager-deal-visibility/): roles answer *whose*, profiles answer *what*, sharing rules answer *which extra*. HubSpot mixes the two more, see [HubSpot user permissions for a sales manager](https://salesbond.app/blog/hubspot-user-permissions-sales-manager-deal-visibility/).

Two settings sit above all of this. First each module has a default organization permission under Data Sharing Settings. With Public Read/Write or Public Read/Write/Delete, everyone can access and update everyone’s data, and role hierarchy and sharing rules are not applied at all (data sharing help). A team that set Deals to Public Read/Write two years ago “to keep things simple” has a role tree that does nothing. Second, a user with the Administrator profile sees all data whatever role they hold. In the Free edition only that profile and the CEO role exist (FAQs).

## Role versus Role and Subordinates: the question everyone asks

“Roles” means the users who hold exactly that role; “Roles and Subordinates” means those users plus everyone below them in the hierarchy. The confusion has its own Zoho community thread, [Roles vs Roles & Subordinates](https://help.zoho.com/portal/en/community/topic/roles-vs-roles-subordinates).

The choice shows up twice inside one sharing rule, in Records Shared From and Records Shared To, and that is where small teams trip. Take a team of six: Head of Sales at the top, one Sales Manager under her, four reps under him. Shared From set to Roles, Sales Manager shares only the deals the manager owns himself, which is probably two. The same rule with Roles and Subordinates shares his two plus the reps’ deals. People pick the first, see almost nothing move and conclude sharing rules are broken.

![Two copies of one role tree: Roles shares only the Sales Manager's deals, Roles and Subordinates also shares all four reps' deals](https://salesbond.app/wp-content/uploads/2026/10/zoho-crm-roles-profiles-sales-manager-deal-visibility-2.png)

A second thread asks the mirror question: “I have 3 roles: A, B & C. I want role A & B to share their society & contacts. However, I don’t want role C to share its data or to see data from A & B” ( [Roles & sharing](https://help.zoho.com/portal/en/community/topic/roles-sharing)). Two rules do it: Shared From Roles A to Shared To Roles B, and the mirror image. C is in neither, and with Deals left Private, C sees only its own records. There is no “deny” rule to look for; rules only add.

Superiors Allowed is the checkbox managers miss: without it, the people above role B do not get the records shared to B.

## Data sharing rules: when to open more than the hierarchy gives

Our position for a team of three to ten: zero sharing rules is the normal state, one is common, three is a sign the role tree is wrong.

The hierarchy already covers the manager seeing the reps. A rule is for sideways access: two reps working one account, an SDR role that should keep seeing the leads it handed over, an ops person who owns no deals and reads all of them.

The form lives under Setup > Security Control > Data Sharing Settings, Sharing Rules tab: module, name, Based on Record Owner or Based on Criteria, Shared To, access level, Superiors Allowed. For the ops case we use Based on Criteria matching every deal, Read Only.

Three details from the same help page save an afternoon. A rule only extends access and cannot restrict what the module default allows, so “hide these deals from C” is never a rule. A rule can be switched off with it’s toggle instead of being deleted. And once saved, a rule can’t be edited until it has finished executing, so write it right the first time.

## A five-minute test with a rep account before you trust the setup

Settings are a claim. Zoho applies the module default, the hierarchy and every active rule together, and nobody does that intersection reliably in their head. Test it with two people and two counts.

1. The manager logs in as himself, opens Deals, filters open deals by owner and writes down the count for one rep. Call her Lena.
2. Lena logs in as herself and counts her open deals. Same number, or something is shared or hidden that nobody intended.
3. Lena tries to open a deal owned by another rep. With Deals Private and no rule covering her, it should not be there. If it opens, check the default permission for Deals first, then the Sharing Rules tab.
4. The manager opens one of Lena’s deals and changes the Closing Date. It should save. Per Zoho’s roles help, managers cannot edit subordinates’ records without Edit permission for that record type, so a failure points to his profile.
5. Keep both counts and rerun the test after the next hire or role change. If the manager’s count for Lena is zero, leave sharing rules alone: open Setup > General > Users, read Lena’s role and who it reports to. That is usually the whole fix.

## What to review when someone changes teams

A rep moves from inbound to key accounts, or starts managing three new hires. Each is a visibility change, usually made by whoever is nearest the admin login.

The role changes first, and the hierarchy comes with it. A private record is visible to its owner and the owner’s superiors, so Lena’s deals follow Lena, including last quarter’s inbound wins. If the inbound manager still needs those for quarter-end, reassign them or move Lena after the quarter closes. We would pick the second.

The profile does not change by itself. A rep promoted to manager gets the the new role’s visibility and keeps her rep profile until someone edits it. When one setting changes, read the other.

Sharing rules are written against roles and groups, not people. A rule that shares from Roles: Inbound Rep covers the records of whoever holds that role, so after a move, open the Sharing Rules tab and read every rule that names Lena’s old role or her new one.

Once the manager sees every deal, the next problem is reading them, and there we have a stake. We build SalesBond, a sales management layer on top of the CRM a team already uses; it works with Zoho CRM. It only sees what Zoho CRM lets the connected user see, so get the tree right first, then [check your CRM with SalesBond](https://salesbond.app/).