Multi Company Access Control doesn't work

I am using ERPNext V15.37 on Kubernetes.

Steps to Reproduce:
Step 1: Create Companies
Log in to ERPNext as an admin.

Navigate to Company Creation:

Go to Settings > Companies.
Click on the New button.
Create Company A:

Fill in the Company Name (e.g., “Company A”).
Set the Abbreviation (e.g., “C_A”).
Configure other settings as needed (currency, time zone, etc.).
Click on Save.
Create Company B:

Click on the New button again.
Fill in the Company Name (e.g., “Company B”).
Set the Abbreviation (e.g., “C_B”).
Configure other settings as needed.
Click on Save.

Step 2: Create Admin Users
Navigate to User Creation:

Go to Settings > Users and Permissions > Users.
Click on the New button.
Create Admin for Company A:

Fill in the Email (e.g., “admin_a@example.com”).
Set the First Name (e.g., “Admin A”).
Configure a Password and ensure Enabled is checked.
Under Roles, select System Manager (or any role that grants admin privileges).
Scroll down to Permissions and set:
Company: Select “Company A” from the dropdown.
Click Save.
Create Admin for Company B:

Click on the New button again.
Fill in the Email (e.g., “admin_b@example.com”).
Set the First Name (e.g., “Admin B”).
Configure a Password and ensure Enabled is checked.
Under Roles, select System Manager (or any role that grants admin privileges).
Scroll down to Permissions and set:
Company: Select “Company B” from the dropdown.
Click Save.

Step 3: Allow Admins to Invite Users
Assign User Permissions:
Go back to the User List (Settings > Users and Permissions > Users).

For Admin A:

Click on Admin A’s User entry.
Scroll to Permissions and ensure Manufacturing is checked for “Company A.”
Click Save.
For Admin B:

Click on Admin B’s User entry.
Scroll to Permissions and ensure Manufacturing is checked for “Company B.”
Click Save.

Step 4: Admin Inviting Users
Admin A Inviting Users:

Log in as Admin A.

Go to Settings > Users and Permissions > Users.

Click on New to invite a new user.

Create User 1:

Fill in the Email (e.g., “user1@example.com”).
Set the First Name (e.g., “User One”).
Set the User Type as Manufacturing.
Configure a Password and ensure Enabled is checked.
Under Roles, select the appropriate roles for the user (e.g., Manufacturing User).
Scroll down to Permissions and set:
Company: Select “Company A” from the dropdown.
Click Save.
Create User 2:

Repeat the same steps to create another user (e.g., “user2@example.com”).
Set the First Name (e.g., “User Two”).
Click Save.
Admin B Inviting Users:

Log in as Admin B.
Repeat the same process as Admin A to invite two users of type Manufacturing for “Company B”:
Create User 3 (e.g., “user3@example.com”).
Create User 4 (e.g., “user4@example.com”).

Step 5: Verify Users and Permissions
Check Users:

As Admin A, verify that User One and User Two are visible and have the correct roles and permissions.
As Admin B, verify that User Three and User Four are visible and have the correct roles and permissions.
Test Access:

Have each invited user log in to ensure they can access only their respective company information and functions based on the assigned permissions.

Actual:

  1. Admin A can see all the users of Company A and Company B and vice versa.

Expected:
Admin A can see and invite user related to Company A only and same for Admin B

@revant_one Can you pls help here

Hi,

You didn’t mentioned what exactly not working?

Please let us know what is your expectation after setting up company wise user permission and what you are getting which is not as per your expectation.

Thanks,

Divyesh Mangroliya

@mangroliya
So, I have created User A with user permissions restricted to Company A, but he can see all the users for other Sister companies i.e. Company B. And even when User A tries to invite any other user( User Y) considering User A has Admin access of Company A, User Y is not mapped to Company A.

Hi,

Whenever User is created by Admin, it will not automatically mapped to any company. It is administrator’s duty to set correct User Permissions for the newly created users. In ERPNext, multi company enviornment certain data are global irrespective of Companies like Item, Customers, Suppliers, User’s etc.

Thanks,

Divyesh Mangroliya

Then it defeats the purpose of having a multi-company setup if users data is exposed.

Create User Types and apply user permissions on same

It seems that you are looking for multi-tenant installation. That way each company will have completely different databases so different users, items, invoices, etc.