User Groups and Privileges

What is it and what is it for?

Each User Group brings together three things: a set of privileges (which screens it can view, add to, edit, void, authorize or delete), the list of users that belong to it, and, optionally, a license type (Full Access, Read-Only, Point of Sale, Staff Portal, Commercial Access or Professional Services Access). On the Enterprise edition, each type consumes its own pool of purchased licenses; on other editions, virtually every group is either Full Access or Point of Sale.

Beyond per-module privileges, a group can also block access to specific menu links, restrict its users to seeing only the employees or transactions of their own subsidiary or location, require two-factor authentication (MFA) for its users, and — depending on your plan — control access to custom screens and custom forms.

How to use it

1. Go to the User Groups list and click New. On the Enterprise edition, this button opens a dropdown with the available license types; on other editions you can only choose between a regular group or one for Point of Sale.
2. Enter the group's Name (for example "Accounting" or "Sales Reps"). It's the only required field.
3. On the Permissions tab, mark which levels you grant for each privilege (grouped by module): View, Add, Void, Authorize, Edit and Delete. The None and View Only buttons let you clear the whole table or set it to read-only in a single click.
4. If your edition supports it, use the Menu Blocking tab to hide specific side-menu links from this group, even if it has privilege over that screen.
5. On the Users tab, add the people who will belong to this group and, if it applies, their invoicing emission point.
6. If your company has Custom Screens or Custom Forms, you'll see extra tabs to grant privileges on them with the same level-based mechanic.
7. Save the group. Users who already had a session open will see the permission changes reflected the next time the system recalculates their security.

Main capabilities

• View, add, edit, void, authorize and delete privileges, independent for every screen in the system.
• Two Privilege Management views: grouped by privilege (to see at a glance which groups and users have access to a screen) and grouped by user, both with direct buttons to grant or withdraw a permission without opening the whole group for editing.
• Group reports: Summary, Detailed with Users, Detailed with Privileges and a side-by-side Privilege Comparison between two groups.
• Two-factor authentication (MFA) that can be turned on per group, with a highlighted warning if the Admin group doesn't have it enabled.
• Blocking access to specific menu links, in addition to privilege-based control (depending on your edition).
• Disable AtIna for the group: once checked, the assistant button disappears from the sidebar, the assistant screen becomes unreachable and any question is rejected. It overrides both the plan and the user's own preference, and it applies to the Admin group too. Already-open sessions pick up the change on their next navigation.
• Duplicate an existing group as a starting point for a new one, and delete several groups at once from the list.
• Restricting employees to their own records (so an HR user only sees their own employees) and filtering transactions by subsidiary or location (depending on your edition).

Key fields

How privileges work

Every privilege belongs to a module (Accounting, Sales, Inventory, Payroll, and so on) and supports up to six independent levels, although not every privilege offers all six:

The group's Type automatically limits which levels can be checked: a Read-Only group only allows View on every screen, and AdmCloud unchecks any level that doesn't belong to a given group type when you save. The Admin group is special: it always has full access and that part can't be taken away. You can still edit the rest of its setup (users, subsidiary, location, menu blocking, forms, etc.); when you edit it, the Permissions tab shows up empty with a note explaining why. It can't be duplicated or deleted.

Some privileges don't stand for a whole screen but for a single action, so they only offer one level. One example is Sales - Change Exchange Rate, which only allows the Edit level: when it's checked, the user can change the exchange rate on the sales documents where the field is visible (credit and cash invoices, promotional invoices, sales orders, customer credit and debit notes, cash receipts, cash returns, customer prepayments, initial balances, returned checks and historic invoices), including the per-line rates of the documents applied on a cash receipt and of the payment methods on a cash invoice. When it's unchecked, the field becomes read-only with the rate the system provides, and AdmCloud rejects the save if someone tries to change the rate of a document that is already recorded. This privilege comes checked by default on every group, so nothing changes until you uncheck it.

Validations when saving

• The Name is required and can't be repeated with another existing group's name.
• The Admin group can't have privileges taken away. Its setup is editable, but the Permissions tab shows up empty: it always keeps every privilege. It can't be duplicated either (the copy would start with no privileges at all).
• If you assign a Subsidiary to the group, it can't be a consolidation subsidiary.
• The same Custom Form can't be listed twice on the group's forms list.
• Privileges that don't belong to the group's Type are automatically reset to "no access" when saving; AdmCloud warns you when this happens.
• Users added to the group must be active (not voided), and their emission point, if assigned, can't be voided either.
• If your edition doesn't include location-based transaction filtering, you can't assign a Location to the group.

Deleting a User Group

A User Group can't be deleted in these cases:

• It's the only group left in the system.
• It's the Admin group.
• It's assigned as an employee's Staff Portal group.
• It's referenced by a Client Script (as a user parameter).
• It's linked to a Point of Sale Items Group.

If none of these cases apply, deleting the group also cascades to its custom dashboards and reminders, its assigned users and privileges, its menu blocking, and its linked custom reports and forms.

Availability and permissions

• Access is controlled by the "User Groups" permission (SA_USER_GROUPS) on your own user group, with independent levels for view, add, edit and delete.
• The Menu Blocking tab only appears if your edition includes this capability.
• The Custom Forms tab only appears if your plan includes Custom Forms and this feature is enabled in Customization Tools.
• Assigning a Subsidiary to a group only applies if your edition has multiple subsidiaries enabled; assigning a Location only applies if your edition includes location-based transaction filtering.
• Choosing the license Type when creating a group (Commercial Access, Professional Services, etc.) and changing it later from the Details screen is only available on the Enterprise edition; other editions only have regular and Point of Sale groups.

Tips and common mistakes