# User without "Create project permission" can create projects

**URL:** <https://forum.inductiveautomation.com/t/user-without-create-project-permission-can-create-projects/112088>\
**Category:** Ignition\
**Created:** [November 11, 2025, 1:38am UTC](https://forum.inductiveautomation.com/t/user-without-create-project-permission-can-create-projects/112088 "2025-11-11T01:38:18Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![dcri](https://avatars.discourse-cdn.com/v4/letter/d/e99b99/32.png) [@dcri](https://forum.inductiveautomation.com/u/dcri)\
**Post date:** [November 11, 2025, 1:38am UTC](https://forum.inductiveautomation.com/t/user-without-create-project-permission-can-create-projects/112088/1 "2025-11-11T01:38:18Z")

</div>

Trying to get a better understanding of roles & levels as a new to Ignition sysadmin on a fresh install of 8.3

Roles based on AD group membership associated with users as expected, using Classic auth in designer, system user source is AD.

Testing with 2 roles from AD groups: “Ignition Designer Login” and “Ignition Project Creator”

“Ignition Designer Login” is added to the “Designer Role(s)” list in Roles & Permissions

A new level “Ignition Project Creator” is added under Authenticated \> Roles

That level is the only option selected in “Create Project Permission”

A user who does not have the “Ignition Designer Login” role assigned gets “Login failed” attempting to log in to Designer as expected.

The problem is a user who has “Ignition Designer Login” but not “Ignition Project Creator” is able to log in to Designer and create projects.

---

<div class="post-metadata">

**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\
**Post date:** [November 11, 2025, 1:16pm UTC](https://forum.inductiveautomation.com/t/user-without-create-project-permission-can-create-projects/112088/2 "2025-11-11T13:16:29Z")

</div>

The project creator role is only for operations at the gateway web UI, IIUC. Any actual designer login is effectively full authority for everything in the gateway.

If you don't trust people with full access to a gateway, don't give them access through a designer.

---

<div class="post-metadata">

**Author:** ![dcri](https://avatars.discourse-cdn.com/v4/letter/d/e99b99/32.png) [@dcri](https://forum.inductiveautomation.com/u/dcri)\
**Post date:** [November 11, 2025, 9:23pm UTC](https://forum.inductiveautomation.com/t/user-without-create-project-permission-can-create-projects/112088/3 "2025-11-11T21:23:02Z")

</div>

Documentation for the “Create Project Permission” role states “Check the security levels required to create a new project in the Designer. Users must belong to at least one of these roles in order to create a new Designer project.”

---

<div class="post-metadata">

**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\
**Post date:** [November 11, 2025, 9:57pm UTC](https://forum.inductiveautomation.com/t/user-without-create-project-permission-can-create-projects/112088/4 "2025-11-11T21:57:26Z")

</div>

I suggest you open a support ticket. Don't be surprised if it is resolved by changing the docs to match reality.