Sub-Account User Roles and Permissions in GoHighLevel: Complete Setup

You add a client’s new sales rep to a sub-account, and ten minutes later they’re poking through snapshot workflows or dumping your entire contact database into a CSV. Let’s lock this down. HighLevel gives you granular permission controls, but because the switches are split across agency-level profiles, location assignments, and individual asset settings, it’s easy to miss one and leave sensitive data wide open.

If you leave the defaults alone, an “Account User” can still see unassigned leads, fiddle with pipelines, or view revenue stats. Here is how I set up tight, leak-proof sub-account roles.

Account User vs. Account Admin: The Core Distinction

Before flipping switches, you have to understand how HighLevel divides roles. Every team member lives at the agency level first, then gets mapped to specific sub-accounts with one of two base roles:

• Account Admin: Full operational run of the sub-account. They can tweak location settings, mess with integrations, manage custom fields, build calendars, and view every single contact regardless of assignment.
• Account User: A restricted operator. Their access is dictated strictly by the individual permission switches you configure on their profile.

Here’s the trap: Account Admin overrides your granular restrictions. If you set someone as an Account Admin and uncheck “Export Contacts” or “Contacts”, HighLevel ignores the uncheck. If you want a sales rep or VA locked down to only their own leads, their role must be Account User.

Step 1: Create or Edit the User Profile at the Agency Level

Even if an employee only ever works inside a single client location, you still create them from the Agency view. If you run a whitelabel domain for your GoHighLevel web app, they’ll log into your custom domain with these credentials.

1. From the agency dashboard, go to Settings > Team (or My Staff).
2. Click Add Employee (or hit Edit on an existing member).
3. Under User Info, fill in their name, email, and password.
4. Scroll to User Roles. Set User Type to Account and Role to User.
5. Under Account Roles, click Select Sub-Accounts and check only the specific location they need.

Whatever you do, don’t check “All Sub-Accounts” unless you intend to give them access across your entire client roster.

Step 2: Configure the User Permissions Switches

Open the User Permissions accordion in their profile. This is where you strip out access to menus they have no business touching.

Here’s what each switch actually impacts inside the sub-account:

• Dashboard Stats: Controls access to revenue charts, conversion rates, and total pipeline values on the home dashboard. Turn this OFF for reps if you don’t want them seeing total account financials.
• Campaigns & Workflows: Controls the Automation tab. Keep this OFF unless they actively build automations. It prevents reps from breaking triggers or altering webhook actions like the ones we set up in our GoHighLevel custom values guide.
• Contacts: Toggles the Contacts directory. If off, the entire Contacts tab vanishes from their sidebar.
• Bulk Actions: Allows bulk SMS blasts, batch emails, and mass tagging. Turn this OFF to prevent accidental spam blasts or unapproved mass outreach.
• Export Contacts: Controls the CSV export button. Turn this OFF for contractors, VAs, and sales reps to protect your client’s lead list from being walked out the door.
• Funnels & Websites: Hides the Sites tab completely so staff can’t accidentally break landing pages, tracking scripts, or forms.
• Settings: Hides the bottom-left gear icon. This is the single most important switch to flip—it stops users from touching phone numbers, calendars, integrations, and company billing.

Step 3: Enforce “Only Assigned Data” for Sales Reps

If you’re running a sales team, you almost always want lead isolation: Rep A should only see Rep A’s leads, and Rep B shouldn’t even know Rep A’s pipeline exists. HighLevel handles this with two toggles:

• Only Assigned Data: When turned on, the user only sees contacts, conversations, tasks, appointments, and opportunity cards assigned directly to them.
• Read Only: Stops the user from editing contact info, moving pipeline stages, or deleting notes.

For a standard, locked-down sales rep setup:

1. Set Role to Account User.
2. Toggle ON Only Assigned Data.
3. Toggle OFF Export Contacts and Bulk Actions.
4. Toggle OFF Settings.

Once saved, their Conversations tab will only show threads assigned to their name, and their Opportunities board will only render their own assigned cards.

What I Ran: Auditing and Updating Permissions via API v2

When you’re onboarding dozens of client team members across multiple accounts, toggling checkboxes in the UI gets tedious and invites mistakes. I automate user creation with the GoHighLevel API v2 during client provisioning.

You’ll need the sub-account’s Location ID. If you don’t have it, check our quick guide on how to find and use your GoHighLevel Location ID.

Here is the Node.js script I use to provision an Account User with locked-down permissions:

import axios from 'axios';
const GHL_API_KEY = process.env.GHL_ACCESS_TOKEN;
const LOCATION_ID = 'loc_abc123XYZ';
async function createScopedSubAccountUser() { const payload = { companyId: 'company_789456', firstName: 'Marcus', lastName: 'Vance', email: 'marcus.vance@clientdomain.com', password: 'SecureTemporaryPassword123!', type: 'account', role: 'user', locationIds: [LOCATION_ID], permissions: { campaignsEnabled: false, contactsEnabled: true, workflowsEnabled: false, triggersEnabled: false, funnelsEnabled: false, websitesEnabled: false, opportunitiesEnabled: true, dashboardStatsEnabled: false, bulkActionsEnabled: false, settingsEnabled: false, assignedDataOnly: true, exportContactsEnabled: false } }; try { const response = await axios.post( 'https://services.leadconnectorhq.com/users/', payload,
{ headers: { 'Authorization': `Bearer ${GHL_API_KEY}`, 'Version': '2021-07-28', 'Content-Type': 'application/json' } } ); console.log('User created successfully:', response.data.id); } catch (error) { console.error('Failed to create user:', error.response ? error.response.data : error.message); }
}
createScopedSubAccountUser();

The call runs in about 400ms and guarantees that nobody forgets to uncheck the export box when onboarding a new hire.

Configuring Calendar and Phone Number Routing for Sub-Account Users

Locking down visibility is only half the job. You also need inbound calls and bookings landing with the right person. In the user profile, head to Call & Voicemail Settings and User Availability.

Call & Voicemail Settings

Assign a dedicated inbound LC Phone / Twilio number directly to the user, set their outbound caller ID, and upload their custom voicemail greeting. If they work remote or on the road, drop in their mobile number as a forwarding destination.

User Availability

Set their weekly working blocks here. If this user is part of a team booking flow, HighLevel checks these hours before offering slots in GoHighLevel round robin calendars with Google sync.

Gotchas I Fixed: 4 Permission Traps in HighLevel

I’ve lost hours debugging weird visibility bugs for agency clients. Here are four traps that will trip you up if you aren’t looking for them:

1. The “Unassigned Lead Blind Spot”

If you turn on Only Assigned Data, but your opt-in workflow doesn’t have an Assign to User step, incoming leads land as unassigned. The result? None of your reps will see the new leads in their Conversations or Opportunities tabs. Always assign incoming leads immediately inside your workflows.

2. The Opportunity Visibility Bug

Restricting a user to “Only Assigned Data” applies to both contacts and opportunities. But if a workflow creates an Opportunity card without explicitly setting the card’s assigned user, that card disappears from the rep’s pipeline—even if they own the underlying contact record. Make sure your workflow assigns both the Contact Owner and the Opportunity Owner.

3. Custom Menu Links Bypassing Permissions

If you add Custom Menu Links in the agency view (for external reporting dashboards, Google Sheets, or internal portals), HighLevel shows them to all users by default. You need to open Agency Settings > Custom Menu Links and restrict link visibility by sub-account or role.

4. Account Admin Overriding Contact Export Restrictions

If you uncheck “Export Contacts” under User Permissions, but the user is an Account Admin, HighLevel still gives them the export button. Role hierarchy always trumps the granular switches. The user role must be Account User for export restrictions to work.

How to Verify User Permissions (Impersonation Testing)

Don’t wait for a client or rep to complain that their dashboard looks wrong. Verify it immediately using HighLevel’s user impersonation tool:

1. Log in as an Agency Admin and switch into the sub-account.
2. Go to Settings > My Staff.
3. Find the user you just created or edited.
4. Click the three dots on the right and select Login as User (or sign in with their credentials in an incognito window).
5. Verify that restricted sidebar tabs (Workflows, Sites, Settings) are completely gone.
6. Open Contacts and Opportunities to confirm they only see records explicitly assigned to them.

For the complete role schema breakdown, check the HighLevel Help Center user management docs.

Frequently Asked Questions

Can a sub-account user see billing information or payment methods?

No. Standard Account Users cannot see billing details or subscription plans. Account Admins can only see sub-account re-billing if enabled. Agency-level billing is completely hidden from anyone who isn’t an Agency Admin.

Can I restrict a user to only see one specific pipeline?

Not natively in the UI yet. If a user has the Opportunities permission, they can switch between pipelines. However, if Only Assigned Data is turned on, they’ll only see the specific cards assigned to them inside those pipelines.

What happens to assigned contacts when I delete a user?

HighLevel will prompt you to reassign their contacts, opportunities, and tasks to another team member. If you delete the user without reassigning, those contacts become unassigned and turn invisible to any reps with “Only Assigned Data” active.

Can an Account User edit email templates?

If the Marketing toggle is ON, yes—they can create, edit, and delete templates. If you want them sending emails using existing templates without modifying the source files, turn Marketing OFF and let them send templates directly from the Conversations tab.

Next Steps for Securing Your HighLevel Setups

Once your sub-account roles are locked down, make sure your inbound lead workflows assign incoming records to the right team members automatically. If you haven’t automated lead distribution yet, check out our guide on configuring GoHighLevel round robin calendars and team user assignments.