# User Management Issue

**URL:** <https://forum.inductiveautomation.com/t/user-management-issue/70926>\
**Category:** Ignition\
**Tags:** ignition81, ignition79, ignition80\
**Created:** [March 10, 2023, 8:40pm UTC](https://forum.inductiveautomation.com/t/user-management-issue/70926 "2023-03-10T20:40:59Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Randolph\_Sewell](https://avatars.discourse-cdn.com/v4/letter/r/cdc98d/32.png) [@Randolph\_Sewell](https://forum.inductiveautomation.com/u/Randolph_Sewell)\
**Post date:** [March 10, 2023, 8:40pm UTC](https://forum.inductiveautomation.com/t/user-management-issue/70926/1 "2023-03-10T20:40:59Z")

</div>

I want certain people to be able to assign operator permissions to operations personnel; however, I do not want them to be able to assign themselves administrator-like access. Is there a way to either make certain roles not selectable, or segregate the user sources?

---

<div class="post-metadata">

**Author:** ![justinedwards.jle](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/justinedwards.jle/32/37854_2.png) [@justinedwards.jle](https://forum.inductiveautomation.com/u/justinedwards.jle)\
**Post date:** [March 11, 2023, 3:12pm UTC](https://forum.inductiveautomation.com/t/user-management-issue/70926/2 "2023-03-11T15:12:56Z")

</div>

To allow users to manage users, in the web interface, go to 'Config, ' and click on the 'General' link in the security section of the sidebar. Then, mark the checkbox for 'Allow User Admin,' and save the settings

To limit who can access user management, In the designer click on 'Project' and select 'Project Properties.' Then, in the Vision section click 'Permissions':

Under user management, select the minimum role required:  
 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/b/9/b9647967ac160edc5efc32e2c15e00ea72924f6a.png)

Finally, you can filter what roles are an option in the user management tool using the filterRole extension function.  
**Example:**

```auto
#def filterRole(self, role):
	currentUserRolls = system.security.getRoles()
	if 'Administrator' in currentUserRolls:
		return True
	elif 'Lead' in currentUserRolls and role == 'Operator':
		return True
	else:
		return False

```

**Result when logged in as admin:**  
 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/f/3/f3ebb7c8a0d4c77c624b470c5446e6abfc0b6f34.png)  
**Result when logged in as lead:**  
 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/3/a/3ab01221f40f074ba690ee532f530470c81ff3bd.png)

With this script, the result when logged in as anybody else would be that no roll was available to select, but due to the fact that the other roles are excluded from the permissions set above, the entire user management tool will be disabled and inaccessible to the other roles, so that doesn't really matter in this case.

---

<div class="post-metadata">

**Author:** ![Ricardo\_javier\_reyes](https://avatars.discourse-cdn.com/v4/letter/r/e9bcb4/32.png) [@Ricardo\_javier\_reyes](https://forum.inductiveautomation.com/u/Ricardo_javier_reyes)\
**Post date:** [March 13, 2023, 11:28pm UTC](https://forum.inductiveautomation.com/t/user-management-issue/70926/3 "2023-03-13T23:28:37Z")

</div>

What can I do so that certain users only have permission to add users and cannot delete any?

---

<div class="post-metadata">

**Author:** ![Matrix\_Engineering](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/matrix_engineering/32/19781_2.png) [@Matrix\_Engineering](https://forum.inductiveautomation.com/u/Matrix_Engineering)\
**Post date:** [March 13, 2023, 11:30pm UTC](https://forum.inductiveautomation.com/t/user-management-issue/70926/4 "2023-03-13T23:30:28Z")

</div>

Configure the security so that the role you want can add, but on the delete button that role cannot.