QuickBooks Online Advanced custom user roles: what they do & how to set them up well.
Custom user roles are an Advanced-tier capability in QuickBooks Online: instead of the limited preset roles the lower tiers offer, you define granular permissions so each user sees and does only what their role actually needs. The point is control — least-privilege access, especially around banking, payroll, and vendor payments, and segregation of duties so the person who enters bills isn’t the one who pays them. Below: what the feature does, how to design roles and permissions well, and when a ProAdvisor should build the roles for you. Requires the Advanced tier.
QuickBooks Online Advanced custom user roles let you define your own roles with fine-grained permissions, so each user can view and do only what their job requires — rather than the fixed preset roles.
Intuit’s help article Add and manage custom roles in QuickBooks Online Advanced and Intuit Enterprise Suite (read October 15, 2026) says: “Create your own roles and customize permissions by upgrading to QuickBooks Online Advanced,” and that a role sets “What actions they can perform within those features, like view only, create, edit, delete, approve, and all access.” You build a role as a named bundle of permissions across areas like banking, expenses, sales, payroll, and reports, then assign it to one or more users. Done well, roles enforce two internal controls: least-privilege, where each user gets the minimum access their work needs (especially for banking, payroll, and vendor payments), and segregation of duties, where the person who enters bills isn’t the same person who pays them. Custom roles require the Advanced tier, and they control who can do what — they don’t replace the reconciliation and review that confirm the books are actually correct.
What Intuit’s help articles say about custom roles.
We read Intuit’s custom-roles article and its User roles and access rights article on October 15, 2026 (Intuit dates both October 9, 2026). The rules that matter for your controls:
- Plan. “Create your own roles and customize permissions by upgrading to QuickBooks Online Advanced.”
- Actions per area. A role sets “view only, create, edit, delete, approve, and all access” across areas such as sales, expenses, lists, accounting, payroll, and reports.
- Locations. “You can then restrict a user’s sales access to specific locations in the Manage users display,” once locations are turned on.
- Saving a role. “Custom roles can’t be saved with account management access only.”
- Retiring a role. “Before you can make a role inactive, you have to assign any associated users to a different role.”
- Reports. “If QuickBooks adds any new reporting options, your custom role users won’t have access unless you give it to them,” and custom roles cover “standard reports and not custom reports created by other users.”
- User count. “Your plan decides how many people can be assigned to these ‘billable’ roles,” while “People with ‘non-billable’ roles don’t count toward your QuickBooks plan limit.”
The steps, as Intuit gives them
- Select Settings, then Manage users, then the Roles tab.
- Select Add role and enter a Role name and Role description.
- For each area, choose the access the role gets, then save the role.
- Assign the role to users from Manage users. Only “administrators and custom users with Manage users permissions can manage users.”
Menu names change as Intuit updates the product, so check the article itself before you follow a step. TechBrot is not Intuit: a plan, login, or software problem goes to Intuit.
What QuickBooks Online Advanced custom user roles do.
The moving parts of the capability, in the order you meet them — from the tier requirement through the controls that make roles worth designing carefully.
Part 01 · Custom roles are an Advanced-tier capability
Defining your own roles with granular permissions is a feature of QuickBooks Online Advanced. Lower tiers give you a limited set of fixed preset roles you can assign but not reshape. If you need access tailored to specific jobs — rather than the broad buckets a preset offers — that tailoring lives in Advanced. We describe what the tier actually does and don’t claim it for plans that don’t have it.
Part 02 · A role is a named bundle of permissions
A custom role is a named set of permissions — what a user holding that role can view, create, edit, or delete across areas like banking, expenses, sales, payroll, inventory, and reports. You build the role once, then assign it to one or more users. Because the permissions live on the role, you can change access for a whole class of users by editing the role instead of every person individually.
Part 03 · Permissions are granular, area by area
Custom roles let you grant access at the level of specific functions — for instance, allowing someone to enter and view expenses without giving them the ability to send payments, or to run reports without editing the transactions behind them. That granularity is the whole value: access fits the job. The trade-off is that a role built carelessly can grant far more than intended, which is why deliberate design matters.
Part 04 · Least-privilege keeps access tight
The principle that makes roles safe is least-privilege: give each user the minimum access their work requires and nothing more, especially around banking, payroll, and vendor payments. Broad access is easier to hand out and harder to undo — and every extra permission is something that can be misused or mistakenly changed. A least-privilege role grants narrowly on purpose.
Part 05 · Segregation of duties is a built-in control
Roles let you separate sensitive duties so no one person controls a whole process. The classic example: the person who enters bills should not be the person who pays them. Building that split into the roles makes the internal control structural — it doesn’t depend on people remembering to behave — and it reduces both accidental error and the opportunity for fraud.
The limit · What roles do not do: replace review
Custom roles control who can do what; they don’t, on their own, prove the books are right or catch a problem after it happens. Access controls reduce risk, but you still review the books, reconcile, and watch for anomalies. Treat roles as one internal control among several — powerful for limiting access, not a substitute for the oversight that confirms the work is accurate.
How to set up roles & permissions well.
Six steps, in order. The first three are design; the rest are the habits that keep access tight instead of letting it quietly drift.
- 1
Map who does what before you build
Before creating a single role, list each person and the tasks their job actually involves — entering bills, paying vendors, invoicing customers, running payroll, viewing reports. Roles should follow real responsibilities, not the org chart or convenience. This map is what turns role design from guesswork into a deliberate match between access and job.
- 2
Build roles to least-privilege
For each role, grant only the permissions the job requires and leave the rest off — particularly for banking, payroll, and vendor payments. It’s tempting to grant broadly so no one is ever blocked, but every extra permission is risk. Start narrow; you can always add a permission when a real need appears, which is far safer than clawing access back later.
- 3
Separate duties for sensitive processes
Design roles so the person who enters bills is not the one who pays them, and similar splits for any process where one person controlling the whole chain is a risk. This segregation of duties is a core internal control. Where your team is too small to split every duty, document the compensating review that fills the gap rather than ignoring it.
- 4
Assign roles to users and verify access
Assign each user the role that matches their job, then verify what they can actually see and do — ideally by checking from their perspective — rather than assuming the permissions landed as intended. A role that grants more than you meant is silent until something goes wrong; confirming access at assignment time is the cheapest place to catch it.
- 5
Review access on a schedule
Access drifts: people change jobs, take on new duties, or leave, and roles that fit a year ago may now grant too much. Review who has which role on a regular schedule — quarterly is reasonable for most firms — and remove access promptly when someone’s role changes or they depart. Stale access is one of the most common control weaknesses.
- 6
Treat roles as one control, not the only one
Roles limit who can do what, but they don’t confirm the work is correct. Keep reconciling, keep reviewing the books, and keep watching for anomalies. Well-designed roles make the other controls more effective by narrowing who can affect the numbers — they don’t replace the oversight that proves the books are true.
What the file must show when one person enters bills and another pays them.
An example: a company builds a custom “AP entry” role that can create and edit bills but has no access to banking or bill payments, and keeps payments with the owner. A role on paper proves nothing; these records prove the split holds each month.
| Record | What it must show |
|---|---|
| Access map | A one-page list kept outside QuickBooks: each person, the tasks their job involves, and the role that matches. It is the reference every other check is read against. |
| Manage users list | Every user holds the role the access map says, nobody who left still has access, and admin rights are limited to the people who need them. |
| Audit log | For the month’s paid bills, the user who entered each bill is not the user who recorded its payment. |
| Bank reconciliation | Every vendor payment that cleared the bank traces to a bill entered by someone else. A payment with no bill behind it is investigated, not just matched. |
On a team too small to split the duty, the compensating control is a monthly review of the audit log by the owner, signed and kept with the bank reconciliation.
When a ProAdvisor should help.
Several users with mixed responsibilities
Once more than a couple of people touch the books — some entering transactions, some paying, some only viewing — designing roles that fit each job without granting too much takes judgment. Getting the roles right from the start is far cheaper than discovering, after the fact, that the bookkeeper could also send payments. It’s exactly what a ProAdvisor sets up cleanly.
Sensitive functions: payroll and vendor payments
Payroll and vendor payments are where loose access does the most damage. A ProAdvisor builds roles that keep those functions tight — least-privilege on the sensitive areas — and separates who can initiate a payment from who can approve or record it, so a single person can’t run a sensitive process end to end. That’s the heart of designing roles that enforce segregation of duties.
When you need to prove segregation of duties
If a lender, an auditor, an investor, or your own risk posture requires demonstrable internal controls, ad-hoc permissions won’t cut it. A ProAdvisor designs a role structure that enforces segregation of duties deliberately and documents it — so the control is real and defensible. If access has already drifted and the books show the strain, that’s a file review and a fixed-fee scope to reset both the roles and the books.
A QuickBooks ProAdvisor designs the roles inside your own books.
Creating a role takes a minute; designing roles that actually enforce your controls is the real work. A QuickBooks ProAdvisor maps who does what, builds each role to least-privilege, and separates sensitive duties — so the person entering bills isn’t the one paying them — then assigns roles and sets a review cadence so access doesn’t drift. Where access has already grown loose and the books show the strain, we reset both the roles and the file — against a written scope, inside your own QuickBooks Online file.
What TechBrot does with user roles, and what it does not.
- We do: map who does what, build the roles, run the records check above, and set the review cadence, as part of a QuickBooks setup or on its own. If we keep the books afterward, they are prepared by a senior bookkeeper who works in your software, or by a signed specialist practice when your books need one, with every close reviewed by a Certified QuickBooks ProAdvisor before it reaches you.
- We do not: reset passwords, recover a locked login, transfer the primary admin, or change your plan or user limit. Those sit with you and Intuit; TechBrot is not Intuit and is not Intuit’s support. You are the primary admin of your own QuickBooks file and can see every user and the audit log.
- What the plan adds: the QuickBooks Online Advanced overview covers the rest of the top plan and when it is worth it.
What people ask about QuickBooks Online Advanced custom user roles.
Do I need QuickBooks Online Advanced for custom user roles?
Yes. Defining your own roles with granular permissions is a capability of the Advanced tier. Lower QuickBooks Online tiers give you only a limited set of fixed preset roles, which you can assign but not reshape. If you need access tailored to specific jobs — rather than the broad buckets a preset offers — that tailoring lives in Advanced. For exactly which plan includes what, confirm current details with Intuit.
What is the difference between a preset role and a custom role?
A preset role is a fixed bundle of permissions QuickBooks provides — Intuit lists roles such as Standard all access, Bookkeeper, Accounts payable manager, and View reports — that you can assign but not change. A custom role, available in Advanced, lets you choose specific permissions across areas like banking, expenses, sales, payroll, and reports, then assign that role to a user. Custom roles let access fit the actual job instead of forcing it into a preset.
What is least-privilege, and why does it matter for access?
Least-privilege means giving each user the minimum access their role actually needs and nothing more — especially for banking, payroll, and vendor payments. It matters because every extra permission is something that can be misused or changed by mistake. Broad access is easy to hand out and hard to undo; a role built to least-privilege grants narrowly on purpose, which limits both error and the damage if an account is compromised.
How do custom roles help with segregation of duties?
Segregation of duties is an internal control where no single person runs a whole sensitive process — classically, the person who enters bills isn’t the one who pays them. Custom roles let you build that split into who-can-do-what, so the control is structural rather than depending on everyone behaving. It reduces both accidental error and the opportunity for fraud. On a very small team, document a compensating review where you can’t fully split a duty.
Can I delete or deactivate a custom role?
You can make a role inactive, but not while people hold it. Intuit’s custom-roles article says “Before you can make a role inactive, you have to assign any associated users to a different role” (read October 15, 2026). Move each user to the role that matches their job first, check the Manage users list, then retire the old role. When QuickBooks adds new reports, custom-role users don’t get them until you add them to the role.
How often should I review who has access?
On a regular schedule — quarterly is reasonable for most firms — and immediately whenever someone’s role changes or they leave. Access drifts as people take on new duties, and a role that fit a year ago may now grant too much. Stale access is one of the most common control weaknesses, and it’s cheap to fix if you catch it on a cadence rather than after something goes wrong.
Can you set up custom user roles in my QuickBooks Online file?
Yes — that’s operational work we do inside your own books: mapping who does what, designing roles to least-privilege, separating sensitive duties so the person entering bills isn’t the one paying them, assigning roles, and setting a review cadence. We start with a free file review, then a focused role design is one fixed fee, scoped in writing, or a bookkeeping cleanup ($1,200–$15,000+) if the books are already behind. An Intuit account or login issue stays with Intuit.
Will custom roles on their own keep my books accurate?
No — they control who can do what, not whether the work is right. Access controls reduce risk, but you still reconcile, review the books, and watch for anomalies. Well-designed roles make those other controls more effective by narrowing who can affect the numbers; they don’t replace the oversight that confirms the books are true. Treat roles as one internal control among several, not the whole answer.