I want to restrict the User Roles with respect to Customer Grouping For instance, User A when Logging in to the back end is only able to view retail customer groups, Whereas User B can access data for Wholesale Groups and Administrator by default can view and access anything.

  • Magento Open source or Magento Adobe commerce? Aug 16, 2021 at 14:20
  • Hi Alan, Its Magento Open Source... V 2.4.2
    – Jagrit
    Aug 16, 2021 at 14:36

1 Answer 1


Magento 2 Admin ACL panel uses an authentication system and a robust system for creating Access Control List Rules (ACL) which allows a store owner to create fine-grained roles for every user in their system. so here, we will find how it works and how to add ACL for our custom module.

Magento 2 Access Control List Rules The Magento 2 Admin ACL resources are visible under the Magento 2 admin System > Permissions > User Roles area. When we click on the Add New Role button or access a role. In this resources tab, you can see a tree list of all the available resources in your system. You can choose all Resource or some of them for this role and select the user for this role in the Role Users tab. All of the users who belong to this role will be limited access to the resource which you choose. They cannot see and access another one. To Create Admin Admin ACL

Step 1: Create ACL rule

Step 2: Flush Magento cache

Step 3: Check ACL rule

Step 1: Create ACL rule Now, we will see how to add our module to the ACL role. We will use a previous simple module HelloWorld to do this. As in the Admin Menu and System Configuration article, you saw that we always have a resource attribute when creating it. Now we will register those resources to the system, so Magento can realize and let us set a role for them. To register the resource, we use the acl.xml file which is located in app/code/{namespace}/{module}/etc/acl.xml. Let’s create this file for our simple Module:

File: app/code/Ced/HelloWorld/etc/acl.xml

<?xml version="1.0"?> 
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:Acl/etc/acl.xsd">
        <resource id="Magento_Backend::admin">
            <resource id="Ced_HelloWorld::helloworld" title="Hello World" sortOrder="51">
                <resource id="Ced_HelloWorld::post" title="Posts" sortOrder="10"/>
                <resource id="Ced_HelloWorld::helloworld_configuration" title="Configuration" sortOrder="99" />
            <resource id="Magento_Backend::stores">
                <resource id="Magento_Backend::stores_settings">
                    <resource id="Magento_Config::config">
                        <resource id="Ced_HelloWorld::helloworld_config" title="Hello World"/>

Our resource will be placed as a child of Magento_Backend::admin. Each resource will have an Id, title, and sortOrder attribute:

The id attribute is the identity of this resource. You can use this when defining resources in the Admin menu, configuration, and limit access to your module controller. This is a unique string and should be in this format: Vendor_ModuleName::resource_name. The title attribute is the label of this resource when showing in the resource tree. sortOrder attribute defines the position of this resource in the tree. After this is done, please refresh the cache and see the result on the resource tree.

Step 2: Flush Magento cache Make sure it admin menu items are displayed on Magento 2 admin, you should try to flush Magento 2 cache.

Step 3: Check ACL rule There is someplace where we put the ACL resource to make it limit the access:

Admin menu: Put the ACL resource to hide the menu if it’s not allowed by the store owner.

File: app/code/Ced/HelloWorld/etc/adminhtml/menu.xml

<add id="Ced_HelloWorld::helloworld" title="Hello World" module="Ced_HelloWorld" sortOrder="51" resource="Ced_HelloWorld::helloworld"/>

System configuration: Put the ACL resource to limit access to this section page.

File: app/code/Ced/HelloWorld/etc/adminhtml/system.xml

<section id="helloworld" translate="label" sortOrder="130" showInDefault="1" showInWebsite="1" showInStore="1">

We will use Ced_HelloWorld::helloworld_configuration in Magento 2 How to Create System.xml Configuration

With resources, it also uses on a controller.

In admin controllers: Magento provides an abstract type Magento\Framework\AuthorizationInterface which you can use to validate the currently logged-in user against a specific ACL. You can call that object by using the variable: $this->_authorization. In the controller, you have to write a protected function to check the resource:

Example: File: vendor/magento/module-customer/Controller/Adminhtml/Index.php

protected function _isAllowed()

{ return $this->_authorization->isAllowed('Magento_Customer::manage'); }


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.