# How to Give an Integration or AI Tool Read-Only Access to QuickBooks Desktop

> Control what an integration or AI tool can do in QuickBooks Desktop: the access prompt, a limited user, Integrated Applications preferences, and removal.

- URL: https://logistify.ai/guides/quickbooks-desktop/give-integration-read-only-access-quickbooks-desktop/
- Section: QuickBooks Desktop Guides, AI + QuickBooks Desktop
- Applies to: QuickBooks Desktop Enterprise, Premier, Pro
- Steps checked against: Intuit's QuickBooks Desktop help articles and the QuickBooks SDK programmer's guide, checked October 2026
- Updated: 2026-10-18

**Short answer:** QuickBooks Desktop's access prompt has no read-only choice: every Yes option lets the app read and modify company data. What limits an app is the QuickBooks user it works as. In Enterprise, create a dedicated user with a view-only or narrow role, and set the app to log in as that user. Manage or remove the app under Edit > Preferences > Integrated Applications > Company Preferences.

## Before you start

- Sign in as the QuickBooks admin. Only the admin can authorize an app, set up users and roles, and change an app's access rights.
- Back up the company file before you change users or app access.
- Ask the vendor how the app connects: through the Web Connector or directly through Intuit's SDK. Also ask whether it writes data and whether it must run when nobody is signed in.
- If the company file holds credit card data, Intuit recommends not letting other applications access it at all.
- List what's already connected first. The audit section below shows where to look.

## What the access prompt means

The first time an app asks to connect, QuickBooks shows an Application Permission screen. It shows who signed the app's certificate and offers four choices:

- No: the app is refused. The admin can change this later in Integrated Applications preferences.
- Yes, but ask me every time: the app can read and change company data, but QuickBooks asks you at each connection.
- Yes, whenever my QuickBooks company file is open: the app can read and change data any time the file is open. Intuit calls this attended mode.
- Yes, always allow access; even when my QuickBooks isn't running: the app can read and modify data even when the file isn't open. This is unattended mode. If the file has users other than the admin, you also choose which user the app logs in as.

A separate checkbox lets the app see personal data, such as Social Security numbers and customer credit card numbers. Leave it clear unless the app truly needs it.

None of the Yes options is read-only, and none goes beyond the rights of the QuickBooks user the app works as. An app can state in the prompt that it only needs read access. To be sure, also limit that user.

### Check the certificate status

- Valid: the certificate is current.
- Expiring or Expired: the app can still connect. Select Details to find the owner and ask for a renewal. The admin gets a one-time notice about certificates that expire within 60 days.
- None: the app has no certificate. You can still connect it, but Intuit says you accept the risk if your data is compromised.
- Revoked: QuickBooks blocks the app.

To check later, go to Edit > Preferences > Integrated Applications > Company Preferences, select the app, then Properties and Details.

## Step 1: Create a dedicated user with a limited role (Enterprise)

An app that connects while someone works in QuickBooks gets that person's rights. If the admin is signed in, the app has admin rights. So give the app its own user with only what it needs. Intuit says Enterprise is the only version that can create a view-only user.

1. Go to Company > Users > Set Up Users and Roles, and enter the admin password.
2. On the Role List tab, select New. Give the role a name that shows its purpose, such as Integration read only, and a description.
3. In Area and Activities, go through each area and choose None, Full or Partial. Use Partial to allow only some activities in an area, and keep every area the tool doesn't need at None.
4. Select OK to save the role.
5. On the User List tab, select New. Enter a user name, such as integration-reporting, and a password.
6. Under Available Roles, select the new role, select Add, then OK.
7. Check the result. On the Role List tab, select View Permissions, choose the role, and select Display to see the Permission Access by Roles report.

A change to a role applies to every user who has it. To adjust one user only, duplicate the role, give that user the copy, and edit the copy.

### On QuickBooks Desktop Pro or Premier

Pro and Premier don't have roles. Go to Company > Set Up Users and Passwords > Set Up Users, select Add User, and choose Selected areas of QuickBooks. For each area, choose No Access, Full Access or Selective Access. Because only Enterprise can create a view-only user, on Pro or Premier you can narrow the areas but can't make the user view-only.

## Step 2: Set the app to work as that user

Attended access gives the app the rights of whoever is signed in, so it's hard to limit. For a tool that should be restricted, authorize unattended access and pick the dedicated user. When you choose Yes, always allow access in the prompt, select that user from the login list. To change it later:

1. Sign in to the company file as the admin.
2. Go to Edit > Preferences > Integrated Applications, then Company Preferences.
3. Select the app, then Properties.
4. On the Access Rights tab, allow the app to log in automatically and choose the dedicated user as the user it logs in as.
5. Leave the personal data checkbox clear unless the app needs it, then select OK.

One catch: if one app starts QuickBooks in unattended mode, any other unattended app in that session runs as the first app's user. Give each app its own user, and test them one at a time. If you later try to delete a user that an app logs in as, QuickBooks warns you.

## Step 3: Test before you trust it

1. Make a copy of the company file and test against the copy first.
2. Run the app's sync or a sample request, and confirm it can read what it needs.
3. Try something the role shouldn't allow, such as creating a test invoice in the copy, and confirm QuickBooks refuses.
4. Check the app's log, or the Web Connector's Status column, after each run.

## See which apps already have access

Older company files often have add-ons connected through the SDK or the Web Connector that nobody at the company remembers. Before you change anything, check these places:

- Edit > Preferences > Integrated Applications > Company Preferences lists the applications authorized for this company file. Select one, then Properties, to see its access rights and the user it logs in as.
- The Web Connector's list of applications, opened from File > App Management > Update Web Services.
- File > App Management > Manage Web Apps, then Connected apps.
- Company > Users > Set Up Users and Roles, to find users created for integrations. The Permission Access by Roles report shows what every role allows in one place.
- On Enterprise, the ODBC driver used for custom reporting has its own ODBC users, separate from QuickBooks users. Its setup is under File > Utilities.

Note each app's name, its access level, the user it logs in as, and who at your company owns it. Ask the vendor before you remove anything you don't recognize, because removing an app stops its data exchange. For the Web Connector side, see our [QuickBooks Web Connector guide](https://logistify.ai/guides/quickbooks-desktop/quickbooks-web-connector-explained/).

## How to remove an app's access

1. Sign in to the company file as the admin.
2. If the app uses the Web Connector, remove it there first. Go to File > App Management > Manage Web Apps, select the app, then Remove. Intuit warns that apps can get stuck in the Web Connector if you remove them from preferences first.
3. Go to Edit > Preferences > Integrated Applications > Company Preferences. Select the app, select Remove, then OK.
4. Open the Web Connector and remove the app there if it's still listed.
5. Once nothing uses the app's dedicated user, delete it or change its password.
6. Ask the vendor to delete any copy of your data they hold.

To block every app at once, select Don't allow any applications access to this company file on the same Company Preferences tab, then OK twice. That blocks Intuit's own apps too.

## Where QuickBooks Desktop leaves the work to you

- The access prompt has no read-only option. Limiting an app means setting up and maintaining a user and role for it.
- On Pro and Premier, you can narrow a user's areas but can't make the user view-only.
- QuickBooks lists the apps you've authorized, but it doesn't tell you which ones are still used. Someone has to review the list.
- Certificates expire. Someone has to follow up with the vendor when QuickBooks warns you.

## How Logistify helps

Logistify is a managed service, not a connector, MCP server or plugin. The [Sales Order Service](https://logistify.ai/agents/sales-order/) enters customer orders into QuickBooks Desktop as sales orders, with a person reviewing exceptions. The [Accounts Receivable Service](https://logistify.ai/agents/accounts-receivable/) matches payments in your bank file to the invoices they pay and records them. The [Procurement Service](https://logistify.ai/agents/procurement/) follows up with suppliers on open purchase orders.

Still deciding how to use an AI assistant with QuickBooks Desktop at all? Start with our guide to the [options for AI assistants and QuickBooks Desktop](https://logistify.ai/guides/quickbooks-desktop/ai-assistant-options-quickbooks-desktop/).

## Frequently Asked Questions

### Can I give an app read-only access in QuickBooks Desktop?

Not through the access prompt, which offers no read-only option. In Enterprise, set the app to log in as a dedicated view-only user; Intuit says only Enterprise can create one.

### Which QuickBooks user does an integrated app use?

If it connects while someone is signed in, it gets that person's rights. If it runs unattended, it logs in as the user the admin chose for it in Integrated Applications preferences.

### How do I remove an app's access to my QuickBooks Desktop file?

Remove it in File > App Management > Manage Web Apps or the Web Connector first. Then remove it in Edit > Preferences > Integrated Applications > Company Preferences.

### Should I let an AI tool write to QuickBooks Desktop?

Start with read-only access. If it must write, limit its user to the areas it needs and test on a copy of the file first.

## Sources

- [Intuit: Manage permissions for apps to access a QuickBooks company file](https://quickbooks.intuit.com/learn-support/en-us/help-article/security-access/block-applications-accessing-quickbooks-company/L7JM4Ms8o_US_en_US)
- [Intuit: Create and manage users and roles in QuickBooks Desktop Enterprise](https://quickbooks.intuit.com/learn-support/en-us/help-article/manage-users/create-manage-roles-quickbooks-desktop-enterprise/L9z3XdBcQ_US_en_US)
- [Intuit: QuickBooks Desktop users and restrictions](https://quickbooks.intuit.com/learn-support/en-us/help-article/manage-users/quickbooks-desktop-users-restrictions/L7bbEXsl2_US_en_US)
- [Intuit: QuickBooks SDK Programmer's Guide (PDF)](https://static.developer.intuit.com/qbSDK-current/doc/pdf/QBSDK_ProGuide.pdf)
- [Intuit: Set up QuickBooks Web Connector](https://quickbooks.intuit.com/learn-support/en-us/help-article/install-products/set-quickbooks-web-connector/L4Vp7VI44_US_en_US)
- [Intuit: Connect QuickBooks Time to QuickBooks Desktop for Windows](https://quickbooks.intuit.com/learn-support/en-us/help-article/manage-integrations/setup-use-quickbooks-desktop-windows-quickbooks/L0Hz2WoyB_US_en_US)
- [Intuit: Set up Open Database Connectivity (ODBC) Driver for QuickBooks Desktop](https://quickbooks.intuit.com/learn-support/en-us/help-article/data-systems/open-database-connectivity-odbc-driver-faqs/L1C6l99Fq_US_en_US)