Users & Permissions

It would be very helpful for a user to be limited to only the data assigned to them but also data that isn't assigned to anyone. That way as user can focus on their clients, leads, or whatever, but also see new clients or leads who have not been assigned.

I bet you didn't know... When you connect Gmail Sync in your user profile from within your Subaccount ... it actually is integrating your Gmail Sync into your USER PROFILE, which is applied to ALL of your Subaccounts. This means that if Subaccount-A and Subaccount-B both have bob@example in CRM Contacts, and your cliff@domainA emails him, Subaccount-B will also display your email to him in the conversation history. Yikes for security! Available Workaround: create one user account for each Gmail you want to connect Your primary/day-to-day user account cannot have any email sync attached Create a new user for each Gmail you want to connect Gmail but will never actually log in to Example: cliff@agency is the day-to-day user (do NOT connect ANY Gmail), create GHL user info@agency and create GHL user cliff@realestate Assign info@agency user to Subaccount-A (Agency's subaccount) and assign cliff@realestate user to Subaccount-B (Realtor subaccount) switch login to those users, connect your Gmail at their subaccount > My Profile, then switch back to your day-to-day/actual agency user account. You may still assign yourself to a subaccount if desired, just don't connect your Gmail. Why this is NOT viable: now you have clutter in your users list (assign Contact to user, schedule calendar event with user) and another potential attack vector (that account gets hacked/exposed) and another set of credentials to remember/store... just eww The suggested solution: Gmail should work just like connecting Google Calendar: allow multiple Gmail connections per user + per subaccount. This means that I consider part of this request to be a UX bug because I expected that when I connected my Gmail within Subaccount settings, that connection was scoped to that Subaccount. Ticket# 6488663 Related: https://ideas.gohighlevel.com/users-permissions/p/user-level-permissions-for-email-2-way-sync-access

Any user with access to Settings > My Profile can connect their personal Gmail or Outlook to the CRM through Email (2-way sync). There is no way for an admin or agency to restrict who can do this. This is a problem for teams that need to enforce how email flows through the CRM. EXAMPLES: Agencies managing client sub-accounts where personal inbox syncing is off-policy Teams that route all email through a shared or compliant sending setup Accounts with compliance or data-handling rules that do not allow personal inboxes connected to client data CURRENT WORKAROUND: Only workaround is hiding the card with custom CSS or JS, which does not actually disable the feature. It is cosmetic, breaks across updates, and does not survive the settings iframe. It is not a real control. REQUEST: Add a permission toggle that controls access to Email (2-way sync), similar to existing user permission settings.

Currently for a user to be able to add tags to contacts they must be given permission to "View & manage tags" which allows them to also create and delete tags. We need users to only be able to "view tags" and add them to contacts but not create or delete tags.

Whilst the recent enforcement of 2FA (via email) is a welcome addition to the security of High-Level, email based 2FA is unfortunately one of the least secure 2FA methods. So, please add more 2FA options. Including at a minimum TOTP codes (a global standard) that people can use through whatever TOTP App they use. (E.g. Authy, Duo, Google Authenticator, Microsoft Authenticator etc). And at the same time, please: Allow an agency to select what 2FA options they will allow to be used across their clients. Allow Admins of a sub-account to also have this level of functionality to select what 2FA options users in their Sub-Account can use IF the Agency gives it to them.

When a user is a "User" and not an "Admin", he can't delete a contact. That's fine. Is it possible that he can't delete an opportunity? We don't have that level of granularity in permissions. The usercase is: when a salesperson loses too many opportunities, he deletes them instead of indicating them as lost.

Add the ability to have permission to export customer or opportunity information in the user profile, not just in the administrator profile

We would like to request a feature that allows admins to mark users as Active or Inactive specifically for lead assignment. Problem: Currently, leads can still get assigned to users who are inactive (on leave, logged out, or not handling leads), especially when using split logic or round-robin workflows. This results in delayed responses and missed follow-ups. Requested Solution: Add a simple Active / Inactive toggle at the user level When a user is marked Inactive, they should be automatically excluded from all lead assignment actions (round robin, split, workflows, etc.) Once marked Active, they should re-enter the assignment pool automatically Impact: This will help businesses manage shifts, leaves, and availability more effectively, reduce lead leakage, and improve response time without relying on complex workarounds or manual reassignment. This feature would be extremely valuable for sales and calling teams.

It would be better if we can customize the templates for the new user email, change password, download the lead connector app email, etc.

I’m referring specifically to the granular user permissions under Settings → My Staff → Roles & Permissions, not the existing SaaS plan feature restrictions. When a new customer signs up through a SaaS plan, their initial user is created as an Admin. For any modules that are enabled, that Admin can receive granular permissions that the agency may not want them to have. These permissions can currently be changed manually or copied between users, but there does not appear to be a way to automatically apply a predefined permission setup when the account is created. Please add the ability to create reusable Roles & Permissions templates and assign a default template to each SaaS plan. When a new SaaS account and Admin user are provisioned, the selected permission template should automatically be applied to that user. This would allow SaaS accounts to be created with the correct granular permissions from the start, without agencies having to manually edit every new user after signup.