Migrating to the role-based access control model

Shopify Plus

Organization Settings are only available for organizations on the Shopify Plus plan.

Early access

Role-based access control model is in early access and only available to certain merchants.

User management with Organization Settings supports a role-based access control model.

With the role-based access control model, you can assign roles to users. You can assign roles to user groups, and then assign the user group to a user. A user group is a collection of users that share certain organization attributes, such as North American Customer Support or B2B Sales Team.

The user role represents the user's job in the organization and contains all the granular permissions for the user to do their job. When a role is assigned to a user, the associated permissions are granted to the user. When a role is removed from the user, the permissions are also removed. One or multiple roles can be assigned to either a user or a user group. These roles grant the user or user group the accumulative permissions from all the roles. This means that you can accurately and uniformly change user permissions through their role and reduce instances where a user is accidentally given permissions that aren't part of their job.

Roles are grouped into different categories: organization or stores. Each category represents a unique business context and permissions specific to that context.

When your store or organization is migrated to the roles-based access control model, all of your existing user access remains unchanged with some exceptions to user management permissions.

Role categories

Roles are grouped into different categories. Each category represents a unique business context and permissions specific to that context. The following role categories are available:

• Organization - Roles and their permissions in this category grant access to features under Organization settings. These features work at the organization level across all stores in the organization. System roles in this category have the highest permisssions in the organization.
• Store - Roles and their permissions in this category grant access to features and resources to a store. System roles in this category are limited to the store context.

System roles

System roles are pre-defined and can't be edited. The following table describes the different system roles that you can assign to your users.

System roles that are available for your organization users.

Role name	Permissions	Limitations
Organization administrator	View, create, edit, and delete all resources within the organization. View, create, edit, and delete users, roles, and groups. Assign and remove all roles. Assign and remove all groups. Access to all stores and all POS locations within the organization.	Can't modify system roles designed and maintained by Shopify. Can't perform ownership transfers. Assigned only by Organization owner and Organization administrator roles. Can't have access conditions attached to its assignment.
Store user administrator	Manage all users in assigned stores. Add users to assigned stores. Assign or remove any store category roles to users in assigned stores. Suspend and delete users in assigned stores.	Can't create or edit roles. Can't view, create, edit, or delete non-user resources, such as products or orders. Can't create, edit, delete, assign, or remove users from groups.

Exceptions

Review the following exceptions about your existing user management permissions:

• Users with organization-level user management permissions: These users are automatically assigned an Organization administrator role. This role grants users view, create, edit, and delete permissions on all resources across all stores in your organization, with the exception of transferring organization ownership. These users can fully manage users and user permissions without any disruption.
• Users with store-level management permissions, including Store owners: These users can still remove or suspend user access, but they can't modify user access or invite new users. In order for these users to continue modifying users or inviting new users, you can assign them either an Organization administrator or a Store user administrator role. The Store user administrator is only available after all the users in your organization have been migrated.

Migrating users to the roles-based access control model

If the pre-defined roles don't meet your requirements, then you can create a role with the permissions you require for your users.

You can create user groups. In the Organization section, click Users > Groups. After you create a group, you can assign a user group to a user.

After the user is assigned a role, the permissions in the role replace the previous permissions and migrate the user to roles.

If you haven't migrated all of your users to roles before September 30, 2024, then your permissions are automatically converted to roles and assigned to a user or a user group. This conversion doesn't change your users' access, but it does add a list of per-user or per-store roles to your roles index that you might want to customize.

Migrating from legacy roles

If you were using legacy roles as part of your Shopify Plus plan, then your legacy roles are converted to groups with the same name.

To migrate to roles-based access, you can complete any of the following actions:

• create new roles and assign new roles to users
• create a new user group and assign a user group to a user
• create new roles, and then assign the group from your legacy roles to the new role

Users with permissions assigned

If your users had permissions assigned without a role, then you can assign a role to your users.

You can also create a user group and assign a user group to a user.

User management with roles-based access control model

You can create roles with the permissions you need for their job. You can assign new roles to your users.

Create a role

You can create a role with permissions that you need.

Steps:

1. From your Shopify admin, click Settings.
2. In the Organization section, click Users > Roles.
3. Click Add role.
4. In the Name section, enter a name for the role.
5. In the Description section, enter a description for the role.
6. In the Permissions section, select the role category, and then select the permissions.
7. Optional: Depending on the role category, you can also select Apps access. In the App access section, select any apps the role can access.
8. Click Save.

Assign a role to a user

You can assign roles to a user.

Steps:

1. From your Shopify admin, click Settings.
2. In the Organization section, click Users.
3. In the Users list, select the appropriate staff.
4. In the Roles section, click Assign.
5. Select the appropriate role.
6. Next to the role that you added, click … > Edit store access, and then select the stores that you want the user to access.
7. Click Save.