How to Give an Integration or AI Tool Read-Only Access to QuickBooks Desktop

Before you start

• Sign in as the QuickBooks admin. Only the admin can authorize an app, set up users and roles, and change an app's access rights.
• Back up the company file before you change users or app access.
• Ask the vendor how the app connects: through the Web Connector or directly through Intuit's SDK. Also ask whether it writes data and whether it must run when nobody is signed in.
• If the company file holds credit card data, Intuit recommends not letting other applications access it at all.
• List what's already connected first. The audit section below shows where to look.

What the access prompt means

The first time an app asks to connect, QuickBooks shows an Application Permission screen. It shows who signed the app's certificate and offers four choices:

• No: the app is refused. The admin can change this later in Integrated Applications preferences.
• Yes, but ask me every time: the app can read and change company data, but QuickBooks asks you at each connection.
• Yes, whenever my QuickBooks company file is open: the app can read and change data any time the file is open. Intuit calls this attended mode.
• Yes, always allow access; even when my QuickBooks isn't running: the app can read and modify data even when the file isn't open. This is unattended mode. If the file has users other than the admin, you also choose which user the app logs in as.

A separate checkbox lets the app see personal data, such as Social Security numbers and customer credit card numbers. Leave it clear unless the app truly needs it.

None of the Yes options is read-only, and none goes beyond the rights of the QuickBooks user the app works as. An app can state in the prompt that it only needs read access. To be sure, also limit that user.

Check the certificate status

• Valid: the certificate is current.
• Expiring or Expired: the app can still connect. Select Details to find the owner and ask for a renewal. The admin gets a one-time notice about certificates that expire within 60 days.
• None: the app has no certificate. You can still connect it, but Intuit says you accept the risk if your data is compromised.
• Revoked: QuickBooks blocks the app.

To check later, go to Edit > Preferences > Integrated Applications > Company Preferences, select the app, then Properties and Details.

Step 1: Create a dedicated user with a limited role (Enterprise)

An app that connects while someone works in QuickBooks gets that person's rights. If the admin is signed in, the app has admin rights. So give the app its own user with only what it needs. Intuit says Enterprise is the only version that can create a view-only user.

1. 1Go to Company > Users > Set Up Users and Roles, and enter the admin password.
2. 2On the Role List tab, select New. Give the role a name that shows its purpose, such as Integration read only, and a description.
3. 3In Area and Activities, go through each area and choose None, Full or Partial. Use Partial to allow only some activities in an area, and keep every area the tool doesn't need at None.
4. 4Select OK to save the role.
5. 5On the User List tab, select New. Enter a user name, such as integration-reporting, and a password.
6. 6Under Available Roles, select the new role, select Add, then OK.
7. 7Check the result. On the Role List tab, select View Permissions, choose the role, and select Display to see the Permission Access by Roles report.

A change to a role applies to every user who has it. To adjust one user only, duplicate the role, give that user the copy, and edit the copy.

On QuickBooks Desktop Pro or Premier

Pro and Premier don't have roles. Go to Company > Set Up Users and Passwords > Set Up Users, select Add User, and choose Selected areas of QuickBooks. For each area, choose No Access, Full Access or Selective Access. Because only Enterprise can create a view-only user, on Pro or Premier you can narrow the areas but can't make the user view-only.

Step 2: Set the app to work as that user

Attended access gives the app the rights of whoever is signed in, so it's hard to limit. For a tool that should be restricted, authorize unattended access and pick the dedicated user. When you choose Yes, always allow access in the prompt, select that user from the login list. To change it later:

1. 1Sign in to the company file as the admin.
2. 2Go to Edit > Preferences > Integrated Applications, then Company Preferences.
3. 3Select the app, then Properties.
4. 4On the Access Rights tab, allow the app to log in automatically and choose the dedicated user as the user it logs in as.
5. 5Leave the personal data checkbox clear unless the app needs it, then select OK.

One catch: if one app starts QuickBooks in unattended mode, any other unattended app in that session runs as the first app's user. Give each app its own user, and test them one at a time. If you later try to delete a user that an app logs in as, QuickBooks warns you.

Step 3: Test before you trust it

1. 1Make a copy of the company file and test against the copy first.
2. 2Run the app's sync or a sample request, and confirm it can read what it needs.
3. 3Try something the role shouldn't allow, such as creating a test invoice in the copy, and confirm QuickBooks refuses.
4. 4Check the app's log, or the Web Connector's Status column, after each run.

See which apps already have access

Older company files often have add-ons connected through the SDK or the Web Connector that nobody at the company remembers. Before you change anything, check these places:

• Edit > Preferences > Integrated Applications > Company Preferences lists the applications authorized for this company file. Select one, then Properties, to see its access rights and the user it logs in as.
• The Web Connector's list of applications, opened from File > App Management > Update Web Services.
• File > App Management > Manage Web Apps, then Connected apps.
• Company > Users > Set Up Users and Roles, to find users created for integrations. The Permission Access by Roles report shows what every role allows in one place.
• On Enterprise, the ODBC driver used for custom reporting has its own ODBC users, separate from QuickBooks users. Its setup is under File > Utilities.

Note each app's name, its access level, the user it logs in as, and who at your company owns it. Ask the vendor before you remove anything you don't recognize, because removing an app stops its data exchange. For the Web Connector side, see our QuickBooks Web Connector guide.

How to remove an app's access

1. 1Sign in to the company file as the admin.
2. 2If the app uses the Web Connector, remove it there first. Go to File > App Management > Manage Web Apps, select the app, then Remove. Intuit warns that apps can get stuck in the Web Connector if you remove them from preferences first.
3. 3Go to Edit > Preferences > Integrated Applications > Company Preferences. Select the app, select Remove, then OK.
4. 4Open the Web Connector and remove the app there if it's still listed.
5. 5Once nothing uses the app's dedicated user, delete it or change its password.
6. 6Ask the vendor to delete any copy of your data they hold.

To block every app at once, select Don't allow any applications access to this company file on the same Company Preferences tab, then OK twice. That blocks Intuit's own apps too.

Where QuickBooks Desktop leaves the work to you

• The access prompt has no read-only option. Limiting an app means setting up and maintaining a user and role for it.
• On Pro and Premier, you can narrow a user's areas but can't make the user view-only.
• QuickBooks lists the apps you've authorized, but it doesn't tell you which ones are still used. Someone has to review the list.
• Certificates expire. Someone has to follow up with the vendor when QuickBooks warns you.

How Logistify helps

Logistify is a managed service, not a connector, MCP server or plugin. The Sales Order Service enters customer orders into QuickBooks Desktop as sales orders, with a person reviewing exceptions. The Accounts Receivable Service matches payments in your bank file to the invoices they pay and records them. The Procurement Service follows up with suppliers on open purchase orders.

Still deciding how to use an AI assistant with QuickBooks Desktop at all? Start with our guide to the options for AI assistants and QuickBooks Desktop.