How to manage Odoo users, access rights, and portal access

1. Choose the right type of account

An employee processing orders and a customer viewing an invoice need different kinds of access. Start with the person’s task.

On small screens, scroll the table sideways to see every column.

The Odoo 20 access-rights guide also describes internal User, Administrator, and Light roles. Light has a reduced set of capabilities; granting access beyond them can upgrade the role. Confirm current subscription implications before changing paid users.

Portal users do not receive the normal app-permission selector used for internal staff. Giving a customer an internal administrator account is not a portal setup.

2. Write down the tasks each person needs

Create a short access plan before opening the user form. The following is an example to discuss with the business owner, rather than a claim that these are the exact role names in every database.

• Salesperson: prepare quotations and work with the customer records their job requires.
• Warehouse operator: process assigned stock operations without unnecessary accounting administration.
• Accountant: manage the invoicing and financial functions approved by the organization.
• Customer: use the portal for the documents shared with that customer.

For each person, note the allowed companies, whether they should see only assigned records or a wider set, and whether export or configuration access is needed. Use separate named accounts so changes can be traced to a person.

3. Create or update an internal staff account

Your account needs the Administration permission that allows managing users and access rights. Administrator access in a business app alone should not be treated as permission to manage the whole database.

1. Sign in as an administrator and open Settings → Manage Users.
2. Choose New for a new person, or open the existing account.
3. Enter the person’s name and their own email address.
4. In Access Rights, select the appropriate role and app access for their tasks. Available applications depend on what is installed.
5. Check company access where your database uses multiple companies.
6. Save the user. For a new account, Odoo sends an invitation to the configured email address.

Choose the narrowest standard option that supports the person’s work. Administrator access should be a deliberate responsibility, rather than a default way to make every menu appear.

Expected: the intended person can accept the invitation and sign in with their own account. If an invitation does not arrive, check the email address and delivery configuration before creating duplicate users.

4. Grant portal access to a customer or vendor

1. Open Contacts and select the intended contact, or create it if it does not exist.
2. Open Actions → Grant portal access.
3. Review the contacts listed in Portal Access Management and verify their email addresses.
4. Click Grant Access for each person who should receive access.
5. Have the recipient use the invitation to access the portal, then verify the documents available to them.

Odoo notes that granting access to a company can involve its affiliated contacts. Review the list instead of assuming only one address will be affected.

Expected: the contact uses the portal with its predefined access. They do not gain the staff backend menus. Which documents appear depends on the apps and the relationship between the contact and those documents.

5. Test permissions as the actual user

Use a separate browser profile or private window signed in as an ordinary test account. Keep the administrator’s session separate.

1. Open the apps and menus the person is supposed to use.
2. Find a representative record they should be allowed to read.
3. Perform an approved test action, such as saving a draft quotation in the test database.
4. Check a record they should not see, including another company’s records when applicable.
5. For a portal account, verify the intended contact’s documents and confirm that unrelated documents are not exposed.

Seeing an app icon does not prove that every record is accessible. Test reading, creating, editing, and deleting separately when those actions are relevant to the job. Avoid destructive test actions in a live database.

6. Investigate Access Error messages

First check the account and context

Confirm the affected user, active company, record, and exact action. Copy the error text and note when it occurred. An error opening one company’s record may have a different cause from an error creating any quotation.

Then check standard permissions

Compare the user’s app permissions with the agreed access plan. Check whether the record is assigned to the user and whether the relevant app or customization is installed.

Escalate technical rules carefully

Groups define permissions, and record rules can further restrict which records are available. The Odoo 20 guide exposes detailed groups through the Technical Access Rights tab in developer mode. These permissions can be inherited from other groups.

Have a knowledgeable administrator inspect those relationships on a test copy. Do not delete record rules or grant every group as a general fix. Keep the original error and a record of the change so the result can be reviewed.

7. Review and remove access when work changes

Review permissions when a person changes roles, a contractor’s work ends, or a new app is introduced. Remove capabilities that are no longer part of the job and retest the remaining workflow.

Deactivate an internal user

In Settings → Manage Users, select the account and choose Actions → Archive, then confirm. Check record ownership and any integration using that account before offboarding. Keep business records rather than deleting them to remove a person’s access.

Revoke portal access

Open the contact and choose Actions → Grant portal access, then Revoke Access for the intended person. Review affiliated contacts as well.

8. Complete the access checklist

• The account type fits the person’s work.
• Every staff member has their own account.
• App and company permissions match an approved task list.
• Administrator access remains available to a trusted owner.
• Allowed and disallowed record access was tested separately.
• Portal recipients and their visible documents were checked.
• An owner will review access when people change roles or leave.

9. Frequently asked questions

10. Related articles and next steps

Menu labels and available actions can vary with your Odoo version, installed apps, and permissions.

Continue learning

• Understand editions, plans, and user counts
• Prepare a test copy before security changes
• Import and update business data
• Odoo implementation and migration services