Zalo Official Account Roles and Permissions

Zalo distinguishes an advertising-only Hồ sơ quảng cáo from a verified business Official Account, often shortened to OA. The Zalo creation guide says an advertising profile is for people without a business registration document and cannot use messaging, Broadcast, posts, chatbot, or calling. The owner may later submit business documents and convert it to a verified OA. A verified OA has a verification tick, can be managed by multiple admins, and uses communication features according to its purchased service package.

If your goal is customer care, do not buy an ad-only profile and expect its role settings to enable chat. First confirm the OA category and verification result. If you are starting from scratch, Zalo’s creation flow offers a business registration document, a tax number, or a choice to add information later. The latter two require follow-up within 14 days. Zalo’s current setup guide says only a successfully verified personal Zalo account registered with a Vietnam +84 number is supported for creating and managing an OA. A foreign company planning a Vietnam support channel needs a lawful local operating setup and a responsible person with the required Zalo account; an overseas phone number alone does not meet the published creation path.

The user-facing admin tool is OA Manager on a computer, with a Mini App OA Manager for mobile work. Zalo’s management page describes both. The separate Zalo App on the developer platform supplies OpenAPI integration, while a ZBS Account manages balances for paid OA services and ZBS Template Message. Zalo’s app and authorization guide lists these as separate accounts and says their admins need not be the same personal Zalo user. Make an access inventory with OA ID, OA admins, ZBS ID and roles, App ID, and integration owner. One screenshot of OA Manager cannot prove the other two are under company control.

Zalo’s OA admin guide names six roles in Vietnamese. Keep the platform labels when assigning them: Quản trị viên, Soạn nội dung, Phân tích viên, Chăm sóc khách hàng, Nhân viên quảng cáo, and Quản lý gói và liên kết. English job descriptions help you choose, but they are not alternative role names in the permission menu. The same guide says an enterprise OA may have up to 100 admins; package entitlements can be lower. For example, Zalo’s current getting-started page says the Cơ bản package has three employee accounts. Check the active package before planning a large support roster.

Quản trị viên is the top role. It can manage other admins, send invitations to follow the OA, delete the OA, and perform the other roles’ actions. It belongs with an accountable company operator, because removing a former agency later depends on this access. Soạn nội dung can manage general OA information, menus, posts, Broadcast, reports, and customer chat. That is broad publishing access even though it cannot manage the admin roster. Give it to a communications lead whose work actually includes those surfaces.

Phân tích viên sees OA statistics and reports; use it for a reviewer who should not publish or answer customers. Chăm sóc khách hàng can answer chat and take calls and view call history, but cannot change call setup. It is a better fit for a support agent than Soạn nội dung, whose publishing authority is unnecessary for that job. Nhân viên quảng cáo is for Zalo ad functions. Quản lý gói và liên kết only reaches package and linking areas. Zalo states these boundaries in its role guide. A user who needs to pay for an OA package may additionally need a ZBS role; the OA role alone does not guarantee a working purchase button.

Zalo’s admin guide gives the exact web path. Sign in to OA Manager, select the OA, then choose Quản lý > Quản lý admin. Select Mời làm admin, enter the person’s phone number, and use Kiểm tra to inspect the Zalo account name before assigning a role. Choose the permission and Gửi lời mời. The person accepts Lời mời làm Admin in the Zalo phone app. Do not mark onboarding complete until the accepted person appears with the expected role. A mistyped phone number is especially costly if it gives a stranger Quản trị viên.

For an existing admin, the same area shows Sửa to edit information or role and Xóa to remove the person. The current getting-started guide says only Quản trị viên can set up staff access. Before removing the last company Quản trị viên, invite a replacement, have that person accept, and test the admin menu with the replacement’s own login. That is a handoff procedure inferred from Zalo’s admin controls; it avoids being dependent on an agency or former employee to invite the next operator.

Use a role change when someone’s job changes. A support agent who becomes a reporting analyst might move from Chăm sóc khách hàng to Phân tích viên rather than keeping both customer-contact and report visibility through an overly broad role. Conversely, a writer who needs to schedule a Broadcast needs Soạn nội dung, not a general promise that any OA admin can send. The Zalo role definitions make those differences concrete.

After removing a person, check their access to the ZBS Account and authorized App ID. Zalo says the admins for OA, App, and ZBS can be different people. Its OpenAPI overview makes that separation explicit. Removing the person from the OA roster does not prove a server token has stopped working or that their ZBS account role disappeared.

As of November 2026, Zalo asks for evidence that the enterprise or household business is lawfully established and operating in Vietnam. Its verification guide offers different document routes based on the OA name and industry: the legal business or storefront name, a protected brand name, or another name or regulated industry. A registered brand name needs evidence of the right to use it in Vietnam. A clinic or other conditional industry may need additional operating evidence. Choose the document route that fits the actual business instead of changing the OA name to make a form appear easier.

The admin submits under Quản lý > Quản lý tài khoản > Xác thực OA. Zalo says the initial evidence should be submitted within 14 days of creating the OA. The legal representative may need to approve the request on Zalo for certain document packages; Zalo’s guide says a refusal or failure to confirm within 48 hours rejects that submission. Zalo describes a usual review of two to three working days, with possible longer cases. Watch both the message from Zalo Official Account and the OA Manager system messages for a result.

The verified tick confirms that OA verification was approved; it does not tell a support manager whether the OA has enough package capacity for all desired users, or whether a particular App ID has API authorization. Zalo’s 2026 package notice says verified OAs without a purchased package use Cơ bản benefits. An advertising profile remains on its advertising-only path. If a new employee cannot chat, inspect account type, verification, role, and package rather than repeatedly sending an invitation.

A rejected verification is not a reason to abandon the existing OA immediately. The Zalo verification instructions direct admins to read the rejection, correct the evidence, and resubmit the complete set within the stated window. Keep the OA ID, business document owner, legal representative contact, and rejection notice in a company-controlled record. That preparation matters if the initial admin leaves during a review.

Zalo renamed Zalo Cloud Account, or ZCA, to Zalo Business Solutions Account, or ZBS Account, in January 2026. Its ZBS setup guide describes ZBS as the balance account for paid OA packages, basic messages, ZBS Template Message, and utilities. A document still saying ZCA may describe an old screen even if the billing relationship continues. Keep the OA ID and ZBS ID together in the access register, but do not confuse their roles.

To buy or change an OA package, Zalo’s current package guide says the actor needs Quản trị viên or Quản lý gói và liên kết on the OA and one of the named eligible roles on the linked ZBS Account: Quản trị viên cấp cao, Quản trị viên, or Biên tập viên. A disabled purchase button can mean one side is missing. The path is Quản lý > Quản lý tài khoản > Quản lý gói & DV. Check who can approve spending before handing an agency a package-and-link role.

The four packages introduced in June 2026 are Cơ bản, Tiêu chuẩn, Tăng trưởng, and Toàn diện. The official package notice says older Dùng thử, Nâng cao, and Premium entitlements continue to their expiry but cannot simply be renewed as the same old package. The package management guide warns that changing to a package without OpenAPI can affect an integration. Test the actual feature entitlement before downgrading an OA used for live automation.

A verified OA can be linked to a ZBS Account through Quản lý > Quản lý tài khoản > Quản lý liên kết. Zalo’s linkage guide says linking requires the proper role on both OA and ZBS. It also describes a three-dot menu action to unlink an OA from its current ZBS Account before linking another. That is a billing and asset link change; schedule it with the person who owns the payment workflow, not as a casual way to remove one former employee.

Zalo OA OpenAPI lets a business integrate an OA with its own server or a third-party system for messaging, calls, content, and management functions. Zalo’s OpenAPI overview says the OA grants a Zalo App permission, and that app then calls APIs and receives webhook events. Zalo’s extension page explicitly describes both internal and third-party integrations. A partner is therefore optional for an organization with its own technical staff, but an authorized partner app can still act on behalf of the OA within granted rights.

The Zalo For Developers authorization guide describes an OAuth authorization code, OA access token, refresh token, App ID, and secret key. Its current text says an authorization code is one-use and valid for 10 minutes; an OA access token lasts 25 hours; and a refresh token lasts three months and is single-use. A successful refresh returns a new refresh token and invalidates the old one. As of November 2026, plan refresh jobs around that 25-hour access-token lifetime and keep the replacement refresh token securely after each renewal.

Give the server owner a documented rotation and storage plan. A token can authorize software even after the human who first configured it is removed from OA Manager. Keep the App ID, OA ID, scopes, webhook endpoint, secret custodian, and refresh job in the company’s integration register. On an agency exit, inspect the OA Manager Quản lý liên kết area, which Zalo says manages connected applications. Confirm the app and ZBS links with the company admin, coordinate removal of the partner’s application authorization, and invalidate or replace credentials held by the partner according to the live developer-console controls. Confirm the removal in the account controls for that app connection, then test that the old integration can no longer call the OA.

Do not confuse an OA-to-App authorization with an OA-to-ZBS billing link. Zalo’s ZBS link guide documents the billing unlink action, while the OpenAPI guide describes granting an App access to act for the OA. One should not be used as a substitute for the other during revocation.

Older integration guides call phone-number template notifications ZNS. Zalo Business Solutions announced that from January 1, 2026, ZNS and certain UID message types were combined under ZBS Template Message. The official transition notice says templates can be sent by UID or phone number under the new service categories and are subject to Zalo Business Solutions review. Use the current name when assigning an owner to templates and spend; explain the old label only when matching a legacy integration or invoice.

The ZBS Template Message setup uses an OA identity, a Zalo App, and a ZBS Account. Zalo’s current developer introduction describes those components and the API route. A business that has only an OA admin invitation may still be unable to send a template because the app authorization, ZBS balance, approved template, or package entitlement is missing. Diagnose the missing asset by its ID rather than upgrading every staff member to Quản trị viên.

Before changing a partner, list the approved templates and which App ID uses them. Zalo’s Template Message error reference distinguishes invalid access tokens, unauthorized OA or app, unapproved templates, absent ZBS connection, and insufficient balance. Each points to a different fix. A rejected delivery is not automatically a permission problem; for example, a template can be unapproved while the OA token is valid. Test one permitted template after changing the app or ZBS link, and record the outcome without copying token values into the audit log.

The OA admin is a personal Zalo user, so protect that person’s login as well as the business asset. Zalo Help’s 2026 two-layer security guide says to add a verified email under Cá nhân > Cài đặt > Tài khoản và bảo mật > Email, then enable Bảo mật 2 lớp. A new-device login then uses a password and one-time code. Keep the recovery email current and controlled by the named employee; do not share the one-time code with a contractor. Zalo Help also describes security alerts for unfamiliar devices and options to block or sign out a suspect login.

For a planned departure, have another company Quản trị viên accept access first. Then use Quản lý > Quản lý admin to remove the former person, inspect the ZBS Account’s own roles, and check every authorized App ID and webhook. Zalo’s OA, App, and ZBS separation explains why all three checks are needed. If the person maintained a refresh job, transfer that job and rotate its secret before turning off their company access. Verify a safe chat and a permitted API request after the change.

For a suspected compromise, capture the OA ID, App ID, affected time range, and sample event IDs without sharing credentials. Check who is still in Quản lý admin, whether an unfamiliar app is listed under Quản lý liên kết, and whether a ZBS link changed. Disable the untrusted integration through the available account controls and work with Zalo support if the revocation path is unclear. The OA admin guide asks users to provide the OA ID when contacting support; that is far safer than emailing a token.

Zalo assigns admin invitations to Quản trị viên. If the only one loses access, the team may be unable to invite a replacement through OA Manager. Preserve the verification records and add a second company Quản trị viên while the first can still approve an invitation. Treat an OA deletion as a separate business decision, not an offboarding shortcut. A working fallback admin and a documented App ID are much easier to use than trying to reconstruct the business account after the only operator’s phone is gone.

Mistake: calling an ad profile a verified OA. An advertising profile cannot use the customer-care features listed in Zalo’s creation guide. If staff report that chat and Broadcast are missing, check the account type and verification before changing their role.

Mistake: using the old ZCA or ZNS name as a current permissions map. ZCA became ZBS Account and ZNS was consolidated into ZBS Template Message in 2026. The ZBS account guide and transition notice give the current labels. A legacy invoice may still say ZNS; reconcile it to the current App and ZBS owner.

Mistake: granting Quản trị viên so a colleague can buy a package. The package guide also accepts Quản lý gói và liên kết on OA, provided the person has an eligible ZBS role. Check both grants, then avoid general admin authority if a narrower role works.

Mistake: expecting a foreign phone to create the OA. Zalo’s setup guide says the creating and managing personal Zalo account must be verified and registered with a +84 number. Plan the local account and legal documents before contracting for an integration.

Mistake: cancelling billing to revoke one app. The OA-to-ZBS link controls paid-service funding, while App authorization controls OpenAPI access. Inspect both links and remove the specific untrusted app grant; Zalo’s integration overview separates their purposes.