How to Set Up Users, Roles and Permissions in QuickBooks Desktop Enterprise

Before you start

• Sign in to the company file as the admin. Intuit says only admins can create and manage users.
• List the jobs people do, such as order entry, receiving, purchasing and receivables. We suggest matching each role to a job, which keeps roles easier to manage.
• A change to a role applies to every user who has it. To change one person only, Intuit says to duplicate the role, assign the copy, and edit the copy.
• For data-level permissions, create the customer, vendor or employee groups first.
• This guide is for Enterprise. For Pro and Premier, Intuit's steps set access for each user under Company > Set Up Users and Passwords > Set Up Users.

Setting up a login for an integration or AI tool? See how to give an integration read-only access in QuickBooks Desktop. To review what users change, see how to track changes with the audit trail.

Step 1: Review the predefined roles

1. 1Go to Company > Users > Set Up Users and Roles and enter the admin password.
2. 2Open the Role List tab.
3. 3Select a role, then Edit, to review its permissions.
4. 4In Area and Activities, pick an area and set None, Full or Partial.
5. 5Select OK to save.

Intuit says Enterprise has 14 predefined roles covering common jobs. Roles marked with an asterisk can view every transaction in the file. Editing a predefined role lets you start from existing permissions, but any change applies to everyone who has it.

Step 2: Create a custom role

1. 1On the Role List tab, select New.
2. 2Give the role a name that shows its permission level, as Intuit suggests, and add a description.
3. 3In Area and Activities, go through each area and set None, Full or Partial.
4. 4Select OK to save the role.

How areas, activities and access levels work

• An area is a group of related tasks, such as Accounting, Banking, Customers & Receivables, Lists or Reports.
• Activities are tasks inside an area. In Banking, they include Checks, Credit Card Charges and Reconcile.
• Full allows view, create, modify, delete and print. Partial is a mix of those. None blocks the area or activity.
• Other levels include View Balance, for balances in the Chart of Accounts and the Customer and Vendor Centers, and View Payroll Info.
• Areas and activities marked with two asterisks give unrestricted access unless you change their level. Intuit says unrestricted access lets a user see payroll transactions in reports and searches, even without payroll permission.

Step 3: Add users and assign roles

1. 1On the User List tab, select New.
2. 2Enter a user name and a password. Intuit lists the password as optional; we suggest always setting one.
3. 3Under Available Roles, select a role, then Add. Repeat for any other roles.
4. 4Select OK.

A user can have more than one role. Where the roles differ, Intuit says the user gets the fuller permission. So if only one of the roles allows creating invoices, the user can create invoices. To change a user later, highlight them and select Edit User. To see a summary of what one user can reach, select View User.

Step 4: Limit a role to certain customers or vendors

Data-level permissions limit a role to records in groups you choose. Intuit's example is a sales rep who works only with the customer group for their region. Its article covers Enterprise Platinum, Diamond and Accountant 21.0.

First, create the groups

1. 1Go to Lists > Manage groups.
2. 2Select Create customer group, add a Name and Description, then select Next.
3. 3Set the Fields, Operator and Values that define the group, then select Add and Next. Or leave them blank to add customers by hand.
4. 4Review the customers in the group. To stop QuickBooks adding and removing customers on its own, clear Automatically add or remove based on fields selected in this group.
5. 5Select Finish.

Intuit says customer groups need Enterprise 2021 or newer, which can also create vendor groups. The admin and anyone with full permission to the Customer Center can create customer groups.

Then restrict the role

1. 1Go to Company > Users > Set Up Users and Roles.
2. 2On the Role List tab, select New, or select a role and Edit.
3. 3In Area and Activities, open Centers and choose Customer Center or Vendor Center.
4. 4Select Custom, then Define.
5. 5Choose the customer, vendor or employee groups the role may work with.
6. 6Set the view, modify, delete, print and view balance levels you need, then select OK.
7. 7Assign the role to users on the User List tab.

Users with a restricted role see and create transactions only for their groups, and their reports follow the same groups. The permission to create new records stays global for the role.

• Data-level permissions don't apply to third-party apps. An app depends on the permissions of the user it works as.
• Setting the Customer or Vendor Center back to Partial or Full removes the restriction and its data-level permissions.
• Only the admin can edit a group that a restricted role uses. To delete it, unlink it from the role first.
• In another Enterprise version, the same login still sees only restricted data. The admin can change restricted roles only in the most recent version.

Step 5: Review who can do what

1. 1Go to Company > Users > Set Up Users and Roles and enter the admin password.
2. 2On the Role List tab, select View Permissions.
3. 3Choose the roles to review, then select Display.

That runs the Permission Access by Roles report, which shows what each role allows in one place.

Change the admin

QuickBooks Desktop has more than one kind of admin, and Intuit handles each one differently:

• The Admin login inside the company file creates and manages users and roles. Intuit's Enterprise update steps check it at Company > Users > Edit the Admin user and say it must have a password.
• The company primary admin manages users and billing for your account in the Customer Account Management Portal (CAMPs).
• The Intuit Account primary admin manages add-on services such as payroll and payments. It can be a different person from the company primary admin.

Transfer the company primary admin

1. 1Sign in as the current primary admin. Go to Company > My Company and select Manage Your Account.
2. 2Sign in with your Intuit Account details. Intuit notes these differ from your company file login.
3. 3In the Primary Contact section, select Change and choose the new primary contact.
4. 4Select Save and Close.

If the new person isn't listed, the admin has to invite them, and they must accept first. If the primary admin isn't available or can't make the change, Intuit says you can send a request to its account protection team.

Transfer the Intuit Account primary admin

1. 1Go to Company > Users > Intuit Account User Management.
2. 2Find the secondary admin who will take over, select Edit, then Change Primary admin.
3. 3Enter the verification code sent to the admin's phone.
4. 4Intuit emails both admins. Once the secondary admin accepts, they become primary admin, and the old primary admin becomes a secondary admin.

Only a secondary admin can become primary admin, and there's only one primary admin at a time.

Forgot the Admin password?

In QuickBooks 2020 and later, select I forgot my password on the sign-in screen, choose an email, and enter the token Intuit sends. For other users, the admin signs in, edits the user and enters a new password.

Common problems

• There is already a user with that name: Intuit's first fixes are to update QuickBooks, then create or restore a portable company file. If that fails, fix data damage.
• A user with full access can't open Payroll Setup: that's by design. Only the Admin or an External Accountant can.
• Users without payroll permission see payroll on reports: check whether their role has unrestricted access, which Intuit says shows payroll transactions in reports. Intuit's Pro and Premier article adds that access to the Balance Sheet or Profit and Loss still shows paycheck names and amounts.
• Your outside accountant: Intuit recommends an External Accountant user. It reaches every area except customer credit card numbers, and the audit trail tracks its changes.
• People who only need payroll, time tracking or other connected services can be invited under Company > Users > Intuit Account User Management instead.

For data damage, see how to verify and rebuild data in QuickBooks Desktop.

Where QuickBooks Desktop leaves the work to you

• QuickBooks doesn't know when someone changes jobs or leaves. The admin edits each user's roles by hand.
• A change to a shared role affects everyone who has it.
• Groups you fill by hand need updating as customers change, and data-level permissions don't limit third-party apps.
• Intuit's upgrade article mentions up to 30 simultaneous users in Enterprise. Tracking who still needs a login is up to you.
• Reviewing the Permission Access by Roles report is a periodic, manual job.