CRM user permissions: how to add an employee and set access rights

When the whole team signs in to the account with one password and CRM user permissions aren't separated, any manager sees the entire client base and can export it. An employee who has left still knows the password. And in a dispute over “whose client is this”, you can't tell who actually handled the deal.

The “Users” section solves this. Access rights are an employee's set of permissions: which sections of the account they see, whose leads they work with and what they can do with them. Each employee has their own login and password, each lead has its own assignee, and the login log and activity history show who signed in to the account and who was on the line. Rights are set up exactly for the task: a manager sees only their own leads and only at their funnel stages, the head of sales sees everyone, and a marketer sees analytics and advertising. A client's number can be hidden — everywhere at once: in the CRM, in exports, in call details and in notifications. The employee sees only the last four digits and can still call, but can't take the base with the numbers. When a person leaves, you delete their user — the others don't need to change their passwords. The database itself is stored on the platform's own servers.

Watch the five-minute video, and below you'll find a detailed setup of all the rights.

Why give each employee their own CRM login

• Sales department. A manager works only with their own leads, without the right to delete or export the database. Clients don't leave together with the employee, and there are fewer “whose client” disputes.
• Head of sales. Sees the leads of all managers, passes them between employees and listens to call recordings in the lead feed. Can add new managers on their own — without the business owner.
• A funnel split between people. A first-line manager sees leads only at the first stages, and a contracts specialist only at theirs. Everyone works with their own part of the funnel and doesn't get lost in other people's cards.
• Call center and operators. They take calls on the computer via SIP — it's free, while forwarding to a mobile costs $0.0165 per minute. The client's number is hidden, and CRM settings are unavailable.
• Marketer. Sees analytics, widgets, call tracking and autofunnels, but doesn't touch leads and deals.

Where to manage users and permissions

Open the “Leads” → “Users” menu (or “Settings” → “Users”). The list shows everyone who signs in to the account: name and login, SIP status, position, when the person last signed in (the “Last seen” column), groups and the “In calls” toggle. The main account — the one who registered the account — is always first and marked with a green stripe. Its rights can't be restricted.

The “Project / All” switch shows the users of the current project or of the whole account. A project is a separate business line or website in the account with its own sales funnel. Search looks up users by name and login, and the filter by groups.

Clicking a row or the ⚙ gear opens the user card on the right. It has two tabs: “Profile” (sign-in, call reception, general settings) and “Access rights” (rights in each project).

How to add a user to your CRM: step by step

1. 1
   Open a new card

   In “Users”, click “+ Add user”.
2. 2
   Fill in the profile

   “Name”, the ending of the “Login”, “Password”, “Mobile phone” and “Email”. The account number at the start of the login is already filled in, for example “12345_anna”.
3. 3
   Choose call reception

   In the “Call reception” block, click the “Reception type” you need.
4. 4
   Check the general settings

   Almost everything is on for a new user. Turn off what they don't need.
5. 5
   Grant access rights

   On the “Access rights” tab, choose a project and tick the sections and rights. Without at least one right, the account won't create the user: you'll see the hint “Select at least one access right”.
6. 6
   Save

   Click “Save” and confirm that the paid period will be shortened if the account asks. Don't close the card before that: the “Discard changes?” question only covers groups and access rights, and changes to the name without “Save” will be lost.
7. 7
   Hand over the login

   Give the employee the full login with the account number and the password. Or open their card and click “Send access by email”.

Employee profile: login, password and notifications

• “Login” — for an employee, it starts with the account number and an underscore. This part can't be erased; you type only the ending. The employee signs in with the full login.
• “Password” — required for a new user. For an existing one, leave the field empty to keep the current password, or enter a new one and save.
• “Mobile phone” — required for everyone. The number mask adapts to the country. Calls with “mobile” reception and SMS task reminders go to this number.
• “Email” — required. Below it is the “Send access by email” button: the account creates a new password and sends the login and password to the saved email. The old password stops working.
• “Telegram” and “MAX for notifications” — where the autofunnel sends the employee alerts about leads. Without them, the alerts won't reach the employee. The bot from the link above the field will tell you the user id in MAX.
• “Position” — shown in the user list.
• “Teams” — telephony teams that the inbound call scheme distributes calls to. Choose “— add team —” in the list; you can add several.
• “Timezone” — the employee sees and sets task dates in it. If it isn't set, Moscow time (MSK) is used.
• “Groups” — departments for the list filter. Start typing a name: suggestions appear, and a new group is created on save.
• “Start date” — when the user was created, read-only.
• “Change photo” — the photo is adjusted in the “User photo” window and saved right away, without the “Save” button.

Call reception: SIP, mobile, SIM or your own PBX

“Reception type” decides where the employee's calls go:

• “SIP” — to a softphone on the computer or an app on the smartphone, over the internet. Click “Generate password”: the SIP login, SIP password and SIP server appear with copy buttons. “Download SIP client” opens the page of a free app — create an account in it with these details.
• “Mobile” — forwarding to the cell phone from the “Mobile phone” field. Convenient for those who work on the road.
• “SIM” — to the service's SIM card, if one is connected for the employee. Without it, the button is gray.
• “External SIP” — the call goes to your own PBX, to the employee's number or login in it. You need your own telephony connected: “Settings” → “Own telephony” (see the article PBX CRM integration for details).

SIP is cheaper. An incoming call to SIP is free, while reception on a mobile is forwarding, and it costs $0.0165 per minute within Russia.

The “In calls” toggle in the list turns the employee on or off for taking calls right away, without “Save” — for a lunch break or a vacation. The “SIP” column shows whether the app is online: “Disconnected (!)” means calls won't reach the employee. On a plan without telephony, the block is gray: “Your plan does not allow calls, so call reception and SIP are unavailable.”

General settings: what an employee can do across the account

The toggles in the “Profile” apply to the whole account, not to a single project:

• “Can edit own settings” — open their own card and change the photo.
• “Can see other users” — without it, the employee sees only themselves in the list.
• “Can create/edit other users” — the “+ Add user” and “Groups” buttons, other people's cards and the “In calls” toggles. Give it to the head of sales if they add managers themselves.
• “Can create projects” and “Can edit/delete projects”.
• “Access to the balance section” — balance, payments and plans.
• “Access to the referral program” — the partner program.
• “Access to the settings section” — account settings: the inbound call scheme, website markup, email, SMS.
• “Raise the contact card on incoming calls” — when a call comes in, the client card opens by itself.
• “Access to user activity” — the “Employee activity history” page: who was on the line and when.
• “Hide the client number from the user” — the number is hidden everywhere: in the CRM, in exports, in call details and in notifications. The employee sees only the last four digits but can still call.

A new user has everything on except editing projects and hiding the number. The main account's rights can't be turned off: “The main account has all rights — they cannot be turned off.”

Project access rights: sections and actions

The “Access rights” tab sets rights in each project separately. At the top is the “Project” list: choose the project you're setting up. Projects with unsaved changes are marked with a “•” dot. Each block header has a counter of enabled rights, for example “5/14”, and the “Select all” button.

The “Access to sections” block sets which sections the employee sees in this project: “Users”, “Analytics”, “Telephony”, “Leads”, “Deals”, “Contacts”, “Autofunnel”, “Calendar / tasks”, “Funnel”, “Funnel settings”, “CRM settings”, “Widgets”, “Call tracking”, “Visitor identification”. Without the right, the “Access denied” screen appears instead of the section.

The “Permissions” block sets what the employee can do:

• “Sees leads/deals/chats of other users” — turn it off, and the manager will see only their own clients.
• “Can pass leads/deals/tasks to other users” — change the assignee.
• “Sees call recordings in the lead feed” — listen to calls in the card.
• “Sees hidden tasks of other users”.
• “May skip the reason when changing a stage date” — without it, a comment is required when moving a date.
• Deletion: “Can delete leads / deals”, “Can delete contacts”, “Can delete missed calls”, “Can clear statistics”.
• Import and export: “Can import leads”, “Can import deals”, “Can export leads / deals”.
• “Forbid sending SMS” — works the other way round: when the toggle is on, the employee can't send SMS.

How to show a sales rep leads only at their funnel stages

A funnel stage is a step in working with a client, for example “New lead”, “Meeting”, “Contract”. The stages themselves are created separately — see CRM pipeline stages. You can show an employee leads only at their stages and allow them to move leads only where they're supposed to go.

1. 1
   Open the setting

   On the “Access rights” tab, in the “Permissions” block, click the last row, “Can see leads on all stages” → “Configure”. The “Funnel stage” window opens with the project name.
2. 2
   Choose where the employee sees leads

   In the first “— add stage —” list, under the hint “Select the funnel stages on which the user’s leads will be shown”, choose stages one by one. Each one appears as a tag, and the × on a tag removes the stage. If the list is empty, leads are visible at all stages.
3. 3
   Choose where they can move leads

   In the second list, under the hint “Select the funnel stages the user can move leads to”, add stages the same way.
4. 4
   Click “Done”

   The row will show a summary, for example “Sees leads on 3 stages · can move to 2 stages”.
5. 5
   Save the card

   With the “Save” button at the bottom. Without it, the selection won't be recorded.

Each project has its own stages. For another project, choose it in the “Project” list and set up the window again: the “Apply these rights to all projects” checkbox doesn't carry stages over. If there's no “Can see leads on all stages” row, the stage settings for this project didn't come through. A new user always has this row.

Example: at a car dealership, a loan specialist sees leads only at the “Loan approval” stage and can move them to “Car handover” or “Bank refusal”. Other leads don't distract them.

Copy permissions from a colleague and apply them to all projects

• “Copy rights from a user” — choose a colleague in the “— choose a user —” list and click “Copy”. The rights are filled into the form: check them and click “Save”. Funnel stages are carried over only within the same projects. If the colleague isn't in the list, switch to “All” at the top.
• “Apply these rights to all projects” — a checkbox, if you have several projects. On save, the rights of the current project are written to all projects.

It's convenient to set up one employee for a role and copy their rights to every newcomer.

Groups, teams and deleting an employee

• Groups — the “Groups” button above the list. Create departments, for example “Sales” and “Service”, and filter the list by them. Deleting a group doesn't delete users.
• Teams — the “Teams” field in the profile. A team is chosen in the inbound call scheme instead of individual employees — that's how automatic call distribution between managers works.
• Deleting — the “Delete” button at the bottom of the card. The employee loses access to the account; deletion takes up to a minute.
• Your own settings — click your avatar in the left menu and choose “User settings”.
• Main account — its card opens with the gear. It has no “Access rights” tab, and the login is an email.
• Sign-in and control — you can allow sign-in only from the office and view the login log on the “Login history” and “Activity history” pages — see the article how to protect customer data from employees.

Read also: How to protect customer data from employees and unauthorized logins, Automatic call distribution between managers: queue and bot, CRM pricing plans: which one to choose and how to switch