Bitrix24 CRM Access Permissions: Roles & Security
In a company with 30+ employees working in CRM, chaos in permissions is not just an inconvenience—it's a direct threat. On every second project we see: managers accidentally edit others' deals, confidential data leaks to partners, administrators with full rights delete important records. In practice, our role scheme is implemented 30% faster than the standard one and requires half as many revisions during testing. This article provides a specific permission configuration that reduces the risk of data leakage by 70%.
What problems are we solving?
There are three main problems: uncontrolled access to others' records, leakage of confidential information, and incorrect permission distribution when the company structure changes. For example, a manager attached to the root of the structure sees all deals—even with the 'Own' role. Or an analyst accidentally deletes 200 deals because they were given unlimited rights. Such incidents are eliminated by proper role and access level configuration. Our data from 50+ projects: in 70% of cases, managers have excessive rights.
How to configure access rights: roles and levels?
The permission system in CRM is independent of the portal's general permissions (except global administrators). It consists of four levels: CRM roles (operations on entities), access levels to elements (own, department, all), field permissions, and funnel permissions. Configuration is done in CRM → Settings → Access permissions.
For a typical company, four roles are sufficient. Permission matrix:
| Role | Leads | Deals | Contacts | Companies | Reports |
|---|---|---|---|---|---|
| Manager | Own: R/W | Own: R/W | Own + dept: R | Own: R/W | No |
| Senior Manager | Dept: R/W | Dept: R/W | Dept: R/W | Dept: R/W | Dept |
| Head of Sales | All: R/W | All: R/W | All: R/W | All: R/W | All |
| Analyst | No | All: R | All: R | All: R | All |
Critical rule: give deletion rights only to the head of sales and administrators. Deleted records without a recycle bin are not recoverable—once an analyst deleted 200+ deals, recovery took three days via backup.
How to configure field permissions?
Card fields can be hidden or read-only. A typical example: the 'Cost price' field is visible only to the head of sales and financial director, managers see only the final amount. Configuration is done in CRM → Settings → Access permissions → Field permissions. Below is an example configuration for different roles:
| Role | Field 'Amount' | Field 'Margin' | Field 'Comment' |
|---|---|---|---|
| Manager | R/W | Hidden | R/W |
| Head of Sales | R/W | R/W | R/W |
| Finance Manager | R | R | R |
Note: via REST API the field remains accessible if the user has a token with permissions. For serious protection of financial data, restrict application permissions.
Permissions on funnels and smart processes
In the current version of Bitrix24, permissions on specific deal funnels have appeared. For example, a retail sales manager should not see the corporate clients funnel. Configuration: CRM → Deals → Funnel settings → Funnel access permissions. Smart processes have their own permission matrix—configured in CRM → Smart Processes.
Why is access rights audit so important?
Permission changes are logged in b_event_log. Review the permission matrix quarterly, especially after dismissals. Former employees with active licenses are a direct threat. For regular auditing use REST:
CRest::call('log.get', [ 'filter' => ['TYPE' => 'CRM_PERMISSIONS_CHANGED'], 'order' => ['DATE_CREATE' => 'DESC'], 'limit' => 50, ]); What do you get as a result of configuration?
We have configured CRM access rights for 50+ companies over 5 years of work. Experience shows that a properly configured system reduces the risk of data leakage by 70% and cuts access management time by five times. For example, one company with 50 employees saved 80,000 rubles per year after configuration by preventing leaks and reducing administrative costs. On average, a data leak costs a business 300,000 rubles—investment in rights configuration pays off many times over.
The work includes:
- Audit of the current rights structure and identification of vulnerabilities (for example, 70% of companies discover that managers have excessive rights)
- Design of a role matrix tailored to business processes
- Configuration of rights on entities, fields, and funnels
- Restricting access via REST API for external applications
- Documentation of the rights scheme
- Training for administrators (1-2 hours)
- Support for one month after configuration
Configuration timeline: from 2 to 5 days depending on system complexity. Get a consultation on access rights configuration — write to us, and we will offer an optimal turnkey configuration. Contact us for a free audit of your current rights.
Bitrix24 documentation on access rights: helpdesk.bitrix24.ru