QuickBooks User Permissions: Roles, Access & Troubleshooting

Published by Andrew Cohen, CFA, CPA on August 30, 2026

Key Takeaways

QuickBooks user permissions control who can view financial data, move money, run payroll, and modify vendor banking details across QuickBooks Online, Advanced, and Desktop.
Each QuickBooks version uses a different permission model: Online relies on named roles tied to email addresses, Desktop Pro/Premier uses nine broad permission areas, and Enterprise uses named, stackable roles with data-level restrictions.
Three roles do not count toward the billable user limit: Reports Only, Time Tracking, and external Accountant users. All other roles are billable and subject to plan-specific caps ranging from 1 user on Simple Start to 25 on Advanced.
Common mistakes include over-granting admin access, leaving departed employees active, giving bookkeepers both banking and payroll access, and using shared logins that break the audit trail.
Condesa Financial helps SMEs design, govern, and periodically audit QuickBooks user permissions as part of outsourced accounting and fractional CFO engagements.

Talk With Condesa About Your QuickBooks Access

Before You Begin: What To Confirm First

Start by confirming four baseline facts before changing any permission. Identify which QuickBooks version is in use (Online, Online Advanced, or Desktop), how many billable user seats the current plan allows, who currently holds the Primary Admin role, and whether an external accountant or bookkeeping firm needs access.

QuickBooks Online and QuickBooks Desktop use fundamentally different permission models. QuickBooks Online assigns each user a named role tied to their email address, and the role defines what they can see and do. QuickBooks Desktop Pro and Premier use nine broad permission areas set to Full, Selective, or None. QuickBooks Desktop Enterprise replaces that with named roles that can be stacked on a single user. A solution that works in one version may be unavailable in another.

Common variables that affect the decision include company size, whether finance is handled internally or outsourced, whether payroll and banking are in scope, and whether the access is for an employee or an outside accountant. These variables determine who should manage permissions. An in-house admin can handle most role assignments and user invitations. However, when the permission structure must reflect a formal segregation of duties policy, or when no one internally has the time or expertise to audit who currently has access, an outsourced accounting or fractional CFO partner should own that structure and its audit trail.

For related setup decisions that fall outside this guide, see QuickBooks Setup Assistance: A Decision-And-Scope Guide.

Get Help Setting Up Roles Correctly

With those baseline facts confirmed, you can move into the step-by-step process for managing user roles in QuickBooks Online.

How Do I Manage User Roles And Permissions In QuickBooks?

The following five steps apply to QuickBooks Online. Step five matters because after a role or permission change, the affected user must sign out and sign back in before the updated access takes effect.

Select the Settings gear icon in the upper right corner of QuickBooks Online.
Select Manage Users under Your Company.
Find the user in the list and select Edit in the Action column.
Change the role using the Roles dropdown, then select Save Changes.
Have the affected user sign out and sign back in to QuickBooks Online so the updated access loads.

Intuit’s documentation confirms this sign-out requirement as the standard remedy when a role change appears not to apply. If the change still does not appear after a fresh sign-in, confirm the change was saved and that the user is opening the correct company, not a different QuickBooks organization associated with the same Intuit account.

How To Add, Edit, And Remove A User In QuickBooks Online

To add a new user, go to Settings > Manage Users > Add User, enter the user’s name and email, select a role from the Roles dropdown, review the permissions that role grants, configure Account management settings if applicable, and select Send Invitation. Be aware that invitations expire after 48 hours. If a user does not accept in time, do not resend the expired invitation. Delete the user and add them again to generate a fresh one.

To edit an existing user’s role, go to Settings > Manage Users, find the user, select Edit in the Action column, change the role, and select Save Changes. To remove a user, select Delete. Deletion is permanent, but the user’s activity history remains viewable in the audit log. For this reason, deactivating a user is preferable to deleting one when the goal is simply to revoke access. Deactivation preserves attribution on historical transactions while preventing further sign-in.

One edge case deserves attention. Track time only users cannot be edited in place. To change their role, delete the user and recreate them with the correct role.

For broader QuickBooks support questions beyond user management, see QuickBooks Support: How To Find The Right Help Fast.

What Are QuickBooks User Roles?

QuickBooks Online roles define what each person can see and do with company data. Each email address on the plan is assigned exactly one role. The following matrix covers the core roles available on standard QuickBooks Online plans.

Company Admin (Primary Admin / Company Admin): Full access to everything in the account, including changing other users’ permissions and roles, managing the subscription, and editing company details. Only the Primary Admin can grant the Company Admin role to others. A Company Admin cannot change or reassign the Primary Admin role. This role is billable.
Standard User (Standard All Access): Comprehensive bookkeeping and financial access without administrative privileges. Can manage customers, sales, suppliers, purchases, employees, accounts, budgets, banking, reconciliations, journal entries, all reports, sales tax, multicurrency, and payroll if QuickBooks Online Payroll is active. Cannot manage other users’ roles. Billable.
In-House Accountant: All accounting tools and financial reports except payroll reports. Can undo completed reconciliations. Cannot run payroll, manage other roles, or perform admin tasks. Billable. This role is the correct choice for a bookkeeper who should not touch payroll.
Reports Only (View Company Reports): Can see most reports, create custom reports, and add report groups. Cannot view underlying transactions, access payroll or contact information in reports, or access the audit log. Non-billable and excluded from the user limit.
Time Tracking (Track Time Only): Can complete timesheets and time reports for themselves only. Has no other accounting access. Non-billable and excluded from the user limit.
Accountant (External Accountant User): Granted through the Accountants tab, not the standard user workflow. Has broad access to the company file. Does not count toward the regular user limit. Up to 2 free on standard plans, 3 on Advanced.

To grant the Company Admin role to another user, the Primary Admin must complete the change. Navigate to Settings > Manage Users, edit the user, and select Company Admin from the Roles dropdown. A Company Admin can manage all other users but cannot change or reassign the Primary Admin.

Choosing the right role is a governance decision. A simple decision tree helps: first decide whether the user needs admin functions (Company Admin). Next decide whether they need payroll access (Standard All Access versus In-House Accountant). Finally decide whether they need to write transactions or only read reports (In-House Accountant versus Reports Only).

Get Help Choosing The Right Roles

Which Three User Roles Are Not Counted Towards The QBO User Limit?

Three role types do not count toward the QuickBooks Online billable user limit. As noted in the Key Takeaways, these are the Reports Only, Time Tracking, and external Accountant roles. All other roles are billable and count against the plan’s user cap.

User limits by plan tier:

To check current usage, sign in as an admin and go to Settings > Account And Settings > Usage Tab. When the limit is reached, you can either upgrade the subscription or reduce usage by deactivating or deleting a user.

QuickBooks Online Advanced Custom Roles

Custom roles are available only in QuickBooks Online Advanced. On all lower-tier plans, administrators are limited to the fixed standard roles described above.

A custom role is a named bundle of permissions built area by area. To create one, go to Settings > Manage Users > Roles Tab > Add Role, enter a role name and description, select the areas and permission levels the role should cover, and save. Name the role for the job function, not the person. For example, use “AP Clerk” rather than “Maria” so the role survives staff changes.

Permission levels within each area follow a graduated structure:

View: See transactions without modifying or deleting them.
Create: View and create new transactions, and modify only records the user created.
Edit: View, create, and edit without delete rights.
Delete: View and delete.
Full Access: Perform all actions on accessible transactions.

A practical use case illustrates the structure. A controller scoping a bookkeeper to AP and reports only would grant Full access to Expenses, View access to Reports, and No access to Banking, Payroll, and Sales.

One critical watch-out affects custom roles. Custom role permissions cascade through dependencies. Granting banking transaction access, for example, automatically pulls in sales, expenses, vendors, customers, currencies, transfers, rules, tags, and deposits. A role intended to stay narrow can end up considerably broader. Always review the full permission summary before saving, including the modules selected.

Users assigned custom roles count as billable users. A simple access-audit checklist for custom roles includes naming the role for the job function, setting the narrowest permission level that still lets the person do their work, reviewing the full permission summary for dependency cascade, testing the role using the user’s actual account, and scheduling a review after the first week of real use.

QuickBooks Online Accountant User Permissions

Accountant access is managed separately from employee roles. To grant an outside accountant access, go to Settings > Manage Users > Accountants Tab and invite the accountant by email. To revoke access, select Delete in the Action column of the Accountants tab.

Accountant access is broad by design and does not count toward the regular billable user limit. Standard plans allow up to 2 free accountant users. Advanced allows up to 3. Accountant access should never be granted via a shared admin login because that approach eliminates the audit trail accountability that individual logins provide.

While Online and Advanced share a similar permission model, QuickBooks Desktop operates differently. The next section explains how Desktop handles user permissions.

QuickBooks Desktop User Permissions

QuickBooks Desktop uses a different permission model from QuickBooks Online. The version determines which model applies.

In QuickBooks Desktop Pro And Premier, user accounts are created via Company > Set Up Users And Passwords > Set Up Users. When creating a user, three paths are available: access to all areas (effectively a second administrator), access to selected areas configured across nine broad permission categories (Sales, Purchases, Banking, Payroll, and Sensitive Reports, each set to Full, Selective, or None), or the External Accountant designation. The External Accountant designation grants full access to the company file except for a few administrative functions and is the correct choice for an outside accounting firm.

In QuickBooks Desktop Enterprise, the path is Company > Users > Set Up Users And Roles. Enterprise replaces the area-by-area questionnaire with a role-based system: named roles bundle permissions by functional area, and a user can hold several roles at once. Enterprise ships with predefined roles including Accountant, Bookkeeper, Accounts Receivable, Accounts Payable, Inventory, and Time Tracking. Administrators can duplicate a predefined role and adjust the copy rather than building from scratch. Enterprise also supports data-level restrictions absent from Pro and Premier, allowing a role to be limited to selected bank accounts, customers, or vendors.

Online Vs. Advanced Vs. Desktop: How The Permission Models Compare

QuickBooks Online standard plans (Simple Start, Essentials, Plus) offer a fixed set of predefined roles with no customization beyond selecting which role to assign. Billable user limits range from 1 on Simple Start to 5 on Plus, with non-billable seats for Reports Only and Time Tracking users on Plus. The audit log is cloud-based, automatic, and retained for two years.

QuickBooks Online Advanced adds custom roles with action-level granularity (view, create, edit, delete, full access) across functional areas, location-based sales restrictions, and three non-billable accountant seats instead of two. The billable user cap rises to 25, and list-item limits (chart of accounts, classes, locations) are removed entirely. Advanced is the only QuickBooks Online tier that supports custom roles.

QuickBooks Desktop Pro and Premier offer nine broad permission areas per user with no role reuse because each user is configured individually. Pro Plus supports three users and Premier Plus supports five, while Enterprise supports up to 30. Desktop Enterprise introduces named, reusable roles and data-level restrictions, making it the most granular Desktop option. The audit log in Desktop is not cloud-based and does not carry the automatic retention guarantees of QuickBooks Online Advanced.

Common Mistakes, Watch Outs, And Troubleshooting

Common Mistakes

Over-Granting Admin Access. The Company Admin role should be reserved for owners and one trusted backup. Administrator-level access should not be used as a convenient way to avoid permission questions.
Leaving Departed Employees Active. A former employee with an active login retains full access to the books. Deactivate or delete the user on the employee’s last day.
Granting A Bookkeeper Access To Banking And Payroll. The three functions of entering transactions, approving them, and reconciling accounts should sit with three different people. A bookkeeper who can enter a vendor bill, approve the payment, and reconcile the bank account leaves no independent check.
Shared Logins. Shared usernames and passwords make it impossible to identify who was responsible for a particular action, which undermines the audit trail entirely.

Watch Outs

Dependency Cascade In Custom Roles. Granting access to one area can automatically widen the role to include related lists and areas. Review the full permission summary before saving any custom role.
The 48-Hour Invitation Expiry. Do not resend an expired invitation. Delete the user and add them again.
Four High-Risk Permissions that warrant restricted access and periodic review include adding or changing vendor banking details, exporting the full vendor or customer list, deleting transactions, and modifying user roles.

Troubleshooting

Permission Change Did Not Take Effect. As noted earlier, the affected user must sign out and sign back in before the updated access takes effect. If the issue persists, confirm the change was saved and that the user is in the correct company file.
User Locked Out After A Role Change. Verify the role was saved correctly under Settings > Manage Users. If the user forgot their password, Intuit’s account recovery process begins at the Intuit sign-in page. Account recovery addresses authentication only. The administrator must separately verify the user’s role under Manage Users.
Accountant Cannot Access The Books. Accountant access is managed through the Accountants tab, not the standard user list. Verify the invitation was sent to the accountant’s correct email, that the accountant accepted it using the intended Intuit account, and that they are opening the correct client company.
No One Knows Who Currently Has Access. This situation represents a control gap. Run an access audit using the checklist in the next section and review the QuickBooks Online audit log via Settings > Audit log.

Get Help Fixing Permission Issues

How To Evaluate Progress: The Access-Audit Checklist

An access audit verifies that the permission structure reflects current responsibilities and that restricted users cannot reach banking or payroll. It also confirms that no former employee or unused external accountant retains active access. The QuickBooks Online audit log retains events for two years and records user sign-ins, settings changes, and edits to customers, vendors, employees, and payroll. This log is the primary tool for investigating unexpected activity.

Access-audit checklist:

Review every active user under Settings > Manage Users and confirm each role matches current job responsibilities.
Remove or deactivate access that is no longer needed.
Scrutinize every user holding Company Admin or Primary Admin access and confirm each person genuinely requires that level of control.
Confirm all former employees are inactive or deleted.
Review the Accountants tab and confirm every external accountant or consultant listed is still actively engaged.
For Advanced users, review each custom role for dependency cascade and confirm the effective permissions match the intended scope.
Check Settings > Audit log for the four high-risk events: vendor banking detail changes, full list exports, deleted transactions, and user role modifications.
Document significant permission changes and assign review responsibility to a role, not a person.

Several indicators show that the permission structure is working. Restricted users cannot access banking or payroll, the audit log shows no unexpected activity, onboarding new staff or outside accountants follows a repeatable process, and access-related support tickets decline. Permissions that made sense at five employees may no longer be appropriate at fifty, so periodic reviews are especially important for growing companies.

Schedule A QuickBooks Access Audit

Advanced Considerations And Next Steps

A well-structured permission setup creates a strong starting point and requires ongoing attention. Periodic access reviews, at minimum quarterly for most small firms, catch the drift that occurs as staff take on new duties or leave. Onboarding and offboarding checklists that include a permissions step prevent the two most common control gaps: a new hire with excess access and a departed employee who remains active.

Segregation of duties means the three functions of entering transactions, approving them, and reconciling accounts sit with three different people. In a small team, that often requires coordinating permissions across an internal staff member, an outsourced bookkeeper, and a fractional CFO. Each party should have a clearly scoped role and no overlap in the highest-risk functions.

When the internal team cannot own that structure, Condesa Financial Group sets up and governs QuickBooks user permissions for SMEs as part of a broader outsourced accounting and fractional CFO engagement. The delivery model is nearshore, with ex-Big 4 talent from Panama and Mexico City, time zone aligned and English-fluent, at price points well below US market rates. The fractional CFO layer answers the harder questions a bookkeeper cannot, such as tax structuring, forecasting, and the internal-control decisions that sit above the settings menu. Clients typically recognize the quality-to-price difference within weeks of onboarding. The firm is industry and geographically agnostic, serving multinational founders and SMEs across the United States and internationally.

Explore Outsourced Accounting With Condesa

Frequently Asked Questions

How Do I Give Admin Access On QuickBooks?

Only the Primary Admin can grant the Company Admin role to another user. Go to Settings > Manage Users, find the user, select Edit, and choose Company Admin from the Roles dropdown. A Company Admin can manage all other users and access everything in the account but cannot change or reassign the Primary Admin role. That role can only be transferred by the Primary Admin through a separate process in Account and settings.

Can Multiple People Use The Same QuickBooks Account?

Each user should have their own email-based login and an individually assigned role. Shared logins undermine the audit log because QuickBooks records activity by user. If three people share one login, there is no way to identify who made a specific change. Individual accounts also allow access to be revoked precisely when someone leaves, without affecting other users.

Which Roles Count Toward The User Limit?

Most roles are billable and count toward the plan’s user cap. As covered earlier, Reports Only, Time Tracking, and external Accountant users do not count toward the limit. Reports Only is available on Plus and Advanced. Time Tracking is available on Essentials, Plus, and Advanced. Accountant users are capped at 2 on standard plans and 3 on Advanced, and are free regardless of plan tier.

How Do I Remove An Accountant’s Access?

Go to Settings > Manage Users > Accountants Tab. Find the accountant in the list and select Delete in the Action column, then confirm in the pop-up. Accountant access is managed separately from the standard user list. Deleting a user from the Users tab does not affect accountant access, and the reverse is also true.

What Is The Difference Between Deactivating And Deleting A User?

Deactivating a user revokes their ability to sign in while preserving attribution on historical transactions, so their name remains attached to records they created. Deleting a user is permanent and cannot be undone, but the deleted user’s activity history remains viewable in the audit log. For departing employees, deactivation is generally preferable because it maintains a clean historical record without leaving an active login.

Can I Restrict A User’s Access To Specific Reports?

Yes. You can assign the Reports Only role or, in QuickBooks Online Advanced, create a custom role that limits which reports and underlying data the user can access. This approach lets managers see the information they need without exposing payroll, banking details, or sensitive contact information.

Conclusion

The process becomes straightforward when you follow a clear order. Identify the QuickBooks version, assign the role that matches the user’s actual responsibilities, verify the change with a sign-out and sign-in as previously described, and audit access on a regular schedule. The role-by-role matrix, the user limit breakdown, and the troubleshooting steps above cover the most common points of failure.

Well-structured permissions represent an internal-control decision. The settings menu provides the mechanism, but the harder part is the governance question: who should have access to what, and who is responsible for verifying it. An outsourced accounting or fractional CFO partner can own that structure, maintain the audit trail, and answer the questions that sit above the settings menu.

Partner With Condesa On QuickBooks Governance