CRM access permissions: roles and pre-launch checks

Decide who can view, change and export CRM data. Build a role matrix, check overlapping permissions in Bitrix24 and verify the setup before launch.

Download the matrix and checks How to verify roles

Define actions and access boundaries

Before launching a CRM, agree four things for each role: visible records, permitted changes, export scope and responsibility for settings. Test allowed and denied actions using ordinary user accounts. A setup passes the agreed scenarios when actual results match the role matrix.

Start with the workflow: receive an enquiry, hand over a deal, issue an invoice and arrange fulfilment. Name the person, information and action needed at each step. Sales and delivery staff may need different parts of the same deal. Restrictions still need to allow the work to be completed.

What belongs in the role matrix

Records and scope: Contacts, companies, deals, invoices or other objects. Define access to owned records, a department, a pipeline or an agreed shared set for each.
Working actions: View, create, edit and move between stages. Record ownership transfers and work with related records separately.
Deletion and export: Who may delete records, import data or export the database. Agree the purpose, dataset and process for exceptions.
Settings and connections: Who may change roles, fields, automation and integrations. Review an external connection’s account separately from an employee role.
Assignments and cover: Which employees, departments or groups receive each role. Specify cover for leave, department changes and a departing owner.
Verification: For each row: starting record, action, expected and actual result, date, tester and unresolved issue.

For example, a supervisor may need a department overview, a representative their own deals, and delivery staff assigned orders. These are options to discuss, not universal presets. Check whether the chosen system supports the exact boundary before promising restrictions on financial fields or individual files.

Bitrix24 permissions to check

Bitrix24 roles define actions on CRM items and the scope of access. Read, edit, delete, import and export are separate permissions. Role-based access depends on the plan. The official guide describes CRM > More > Settings > CRM access permissions; check the current interface and your plan before configuration.

Overlapping roles need particular attention: when they grant different permissions for the same action, the employee receives the more permissive option. A restriction in one role may therefore leave a permission granted by another unchanged. Review all assignments, including departments and groups.

Bitrix24: official role-based permissions guide

Hypothetical example: export is still available

A representative has an individual Own deals role without export permission. A second role assigned through the department allows export of all deals. In Bitrix24, checking only the first role would give an incomplete picture. Find the second assignment, agree the access required for work, and repeat the check as that employee after the change.

Record the expected and actual behaviour, the source of the extra permission and the result after correction. This example is illustrative; it is not a reported fault in a BYstudio client’s system.

Test each role with safe scenarios

Prepare approved test records for owned deals, other owners, another department and related contacts. Exclude customer data. Agree which actions belong in a test environment.
Use a separate ordinary account for the role. An administrator session does not prove a representative’s access. Record active roles and assignments at the time of testing.
Check permitted work: find a record, open it, edit an agreed field and continue the next step. Verify access to necessary related objects.
Check denied scenarios: another owner’s record through a direct link, an out-of-scope edit, export and settings. Perform potentially destructive actions only on approved test data in the agreed environment.
Test overlapping roles, ownership changes and cover arrangements. Check applications, files and connections separately within the agreed scope.
Compare results with the matrix. Retest corrections and retain outstanding issues with owners. Mark an untested scenario as untested rather than passed.

What to receive at handover

The handover should contain an approved matrix, assignments, a test log and exceptions. Name an access owner who approves new permissions, reviews job changes and removes temporary access. Retain the version date and the process for verification after changes.

BYstudio refined an existing Bitrix24 setup for Krest-NN. The verified activity and deadline work is documented separately; that case is not presented as an access-permissions audit. For your CRM, agree objects, roles and acceptance within the project scope. The initial workflow review is free.

Before configuring access

Is hiding a menu section enough?

Verify access to the record and action, including a direct link. Menu visibility helps navigation, but does not replace permission checks.

Does a sales representative need administrator access?

List the representative’s working actions first. Separate changes to roles, automation and integrations. If an action requires an administrator, agree who handles the request and how.

Why did a restriction in a Bitrix24 role not work?

Check the employee’s other roles and assignments through departments or groups. For overlapping permissions, Bitrix24 applies the more permissive option. Repeat the scenario using that employee’s account.

Can we test on the live database?

Agree the test with the system owner. Use approved test records without customer data. Test deletion, export and other consequential actions in a suitable test environment first.

Is access configuration part of CRM implementation?

Include roles, objects, checks and deliverables in the agreed scope. External applications, email, files and API permissions may require separate work. BYstudio’s initial workflow review is free.