REVSET LABS · EXPERT GUIDE·Settings & Admin

Mastering Admin vs User Roles and Permission Scopes in GoHighLevel

766 words·3 min read·Updated 27 April 2026·beginner·

Arsalan ZaffarLinkedIn

👉 Start your 30-day GoHighLevel free trial.

Quick Answer

To change a user's role in GoHighLevel, go to Settings → My Staff. Click the Edit icon next to the user, then scroll to and expand User Roles to select the new role. This process takes about 1-2 minutes per user.

Key Takeaways

✓Always apply the 'least privilege' principle: grant only the necessary access for a role.
✓Agency Admins possess global authority that overrides any conflicting sub-account settings.
✓Sub-Account Admins have complete control exclusively within their assigned sub-account.
✓For granular control over features, always assign a 'User' role and customize individual permissions.
✓Remember to click 'Save' after making any adjustments to user roles or permission settings.

What Are Admin and User Roles in GoHighLevel?

Understanding the difference between Admin and User roles, along with their permission scopes, is crucial for effective team management in GoHighLevel. Proper role assignment ensures your staff has the right access without compromising security or system integrity. GoHighLevel operates on two primary access levels: Agency and Sub-Account. Each level allows for specific role assignments and permission configurations.

How Do You Change a User's Role in GoHighLevel?

Modifying a user's role is a straightforward process within GoHighLevel's staff settings. You might need to change a role when a team member's responsibilities shift, or when you onboard a new staff member with different access requirements. This guide focuses on adjusting an existing staff member's role.

Access Staff Settings — From your GoHighLevel dashboard, click on Settings in the left-hand menu. Then, select My Staff to view all current team members.

Select User to Edit — Locate the staff member whose role you want to change. Click the Edit icon (a small pencil) next to their name to open their user profile.

Locate User Roles Section — Scroll down within the user's profile settings. Find and expand the section labeled User Roles to reveal the role options.

Choose New Role — Select either Admin or User based on the access level required. Remember that an 'Admin' role grants full access within its scope (Agency or Sub-Account).

Save Changes — After selecting the desired role, scroll to the bottom of the page. Click the Save button to apply your changes immediately.

✅ If you are assigning an 'Admin' role at the Sub-Account level, be aware that Sub-Account Admins automatically inherit full access within their assigned sub-account and cannot have their permissions individually restricted.

Try GoHighLevel Free

Start your 30-day GoHighLevel free trial

Everything in this guide is in your free trial. 30 days, no credit card — the platform behind 78+ revenue systems.

Start 30-Day Free Trial →

Some links are affiliate links — if you sign up we may earn a commission, at no extra cost to you. We only recommend GoHighLevel because we build on it every day.

How to Customize Permissions for a GoHighLevel User Role?

The 'User' role in GoHighLevel offers granular control over specific features and functions. This is ideal for team members who need access to certain tools without having full administrative privileges. You can customize permissions at both the Agency and individual Sub-Account levels.

Access Staff Settings — Navigate to Settings from your GoHighLevel dashboard. Then, click My Staff to manage your team members.

Select User to Edit — Find the staff member you wish to configure. Click the Edit icon (pencil) next to their name to open their profile settings.

Locate Permission Scopes — Ensure the user's role is set to 'User' under the User Roles section. Then, scroll down to the Permission Scopes section.

Adjust Agency Permissions — Toggle the specific features you want the user to access at the Agency level. This controls their access to global settings and features across all sub-accounts.

Adjust Sub-Account Permissions — Below the Agency permissions, you will see options to manage access for specific sub-accounts. Select the relevant sub-accounts and toggle the permissions for each one individually.

Save Changes — After setting all desired permissions, scroll to the bottom of the page. Click the Save button to confirm and apply your new settings.

⚠️ Be cautious when granting Agency-level permissions, as these can affect all sub-accounts under your agency. Always double-check your selections before saving.

🔥 Pro Tip

Always start with the minimum required permissions and add more only if necessary. This 'least privilege' approach minimizes security risks and prevents accidental changes.

Troubleshooting Common Issues

⚠️ I cannot find the 'User Roles' or 'Permission Scopes' sections.

Ensure you are editing an existing staff member's profile. These sections appear within the individual user's settings, not in a general staff list view.

⚠️ I cannot restrict a Sub-Account Admin's access to certain features.

Sub-Account Admins automatically gain full access within their assigned sub-account. To limit feature access, you must assign a 'User' role instead of an 'Admin' role in that sub-account.

⚠️ My Agency Admin's global permissions are not applying as expected.

Verify that the Agency Admin role has the necessary global permissions explicitly enabled within their profile. Agency Admin actions apply across all sub-accounts, but specific features might still need enabling.

⚠️ The 'Login As' option is missing for an Agency Admin.

The 'Login As' feature is controlled by a specific permission. Check if the 'Enable Login As' permission is active for that particular admin at the agency level in their user settings.

Common Mistakes to Avoid

→Assigning an 'Admin' role when a 'User' role with specific permissions would be more appropriate and secure.
→Forgetting that Agency Admin permissions always take precedence over and can override Sub-Account Admin settings.
→Not clicking the 'Save' button after making changes to roles or individual permission toggles, leading to unapplied updates.
→Confusing Agency-level permissions (global) with Sub-Account-level permissions (specific to one sub-account).
→Overlooking the specific 'Enable Login As' permission, assuming all Agency Admins automatically have this capability.

Frequently Asked Questions

QCan an Agency Admin restrict a Sub-Account Admin from accessing certain features?

No, an Agency Admin cannot directly customize or restrict the permissions of a Sub-Account Admin. Sub-Account Admins are designed to have full access within their assigned sub-account by default. If you need to limit feature access for someone operating within a sub-account, you should assign them a 'User' role within that sub-account and then carefully customize their specific permissions.

QIf a permission is available at both Agency and Sub-Account levels, does the Agency Admin override Sub-Account Admins?

Yes, Agency Admins always hold global authority within the GoHighLevel system. For permissions that exist at both the Agency and Sub-Account levels, the actions and settings configured by an Agency Admin will take precedence. This means Agency Admin decisions for areas like user management, reporting, or the media library will apply universally across all sub-accounts, superseding any conflicting Sub-Account Admin settings.

QWhat happens if a user is added at the Agency level and then also given access to a Sub-Account?

If a user is assigned a role at the Agency level and then also granted access to a specific Sub-Account, their permissions will stack. They will inherit agency-wide access from their Agency role, in addition to any sub-account-specific access from their Sub-Account role. Permissions do not cancel each other out; instead, they combine, with the broader Agency-level permissions always maintaining precedence over sub-account-specific settings.

QDo all Agency Admins automatically have the 'Login As' capability?

No, not all Agency Admins automatically have the 'Login As' capability. The 'Login As' feature, which allows an Agency Admin to log into a sub-account as if they were a user of that sub-account, is controlled by a specific permission. This 'Enable Login As' permission must be actively enabled at the agency level for a particular admin. If it is disabled, the 'Login As' option will remain hidden for that user.

QWhat is the key difference between an Admin role and a User role in GoHighLevel?

The key difference lies in their scope of control. An Admin role (either Agency or Sub-Account) grants full, unrestricted access within its respective scope. For example, a Sub-Account Admin has complete control over all features and settings within their specific sub-account. A User role, however, provides granular control, allowing you to selectively enable or disable access to individual features and tools. This makes the User role ideal for precise permission management and adhering to the principle of least privilege.

Try GoHighLevel Free

Start your 30-day GoHighLevel free trial

Everything in this guide is in your free trial. 30 days, no credit card — the platform behind 78+ revenue systems.

Start 30-Day Free Trial →

Some links are affiliate links — if you sign up we may earn a commission, at no extra cost to you. We only recommend GoHighLevel because we build on it every day.

Arsalan Zaffar

Revset Labs · Revenue Systems · 78+ GHL Builds

Arsalan writes GHL guides from real build experience — 78+ systems, $9.2M in client pipeline. Wharton, CXL & Google certified.

Connect on LinkedIn

Tags:GoHighLevelstaff rolesuser managementpermissionsagency settingssub-account access