Overview

Accountants and bookkeepers handle sensitive data every day and sometimes you only want certain users to be able to view/edit/delete certain aspects of that data. User permissions can be used to restrict access to specific clients, groups, and tools as well as the ability to view/modify, or delete.

This section also outlines what happens when you invite an external 3rd party to AccountKit, say a client or a bookkeeper, to use the tools within and how their access permissions work.

To make the new user permissions available in AccountKit you will need to be using the new user interface (The legacy UI will be disabled). You will also need to be on the latest AccountKit pricing structure at the Practice Tier, please see our website for details about our current pricing.

User Management

List View

The user management list view is the page that allows you to see a summary of all your users and provides a high-level overview of the access levels for each user.

1. Create New User

Click this icon to create a new user or a Guest in AccountKit.

2. Views

Refer to the View Details section in Shared Elements.

3. List Headers

Name - User's Name
Role - Role within AccountKit
Email - Also user's Username
Mobile - User's Mobile number
Last Login - User's last login

4. Xero Practice Manager Logo

Where this icon is showing, it's letting you know that this user is mapped to a user in XPM.

5. Access Level

Here is where you can see the access level a user has been given:

This icon when in AK green determines whether a user has been nominated as an AccountKit champion. Users who have this icon illuminated in the user management section are your go-to for all things AccountKit.
This icon has two access levels
- When the icon is purple this indicates a "super admin" who has the same capabilities as a practice administrator, however, is not restricted by any restricted client groups. A super admin automatically receives access to user management as part of this status.
- When this icon is green this indicates that the user is a practice admin who will not be able to see certain client details if not part of a restricted access group.
Users who have this icon highlighted in AK green will be able to modify user details and access levels within AccountKit.

6. Client Permissions

Client access level determines the amount of access a user has full, view or edit rights to client details. (The client details page for each client within AccoutnKit).

View access can view only.
Edit access can view and edit.
Full access to view, edit and delete client details.

7. Status

denotes the user is Active, Denotes the User is Not Active.

Click to Disable, Archive or Unblock the user. Unblock is used when a user has locked themselves out by inputting the wrong password too many times.

8. Multifactor Authentication Status

Now that MFA is always turned on in AccountKit this icon is simply used for resetting a user's MFA/2FA. This can be useful if a user loses access to their 2fa software or device.

Users

1. Employee Details

Name - The user's first and last name.
Email / User Name - This is the user's email address, as well as their login user name.
Mobile Phone Number - Add the user's mobile phone number. (Optional)
Phone Number - Add the user's landline phone number (optional)
Birthday - When the user's birthday is added, it will show on the birthday dashboard to let everyone know and that way the practice can celebrate together. (Optional)

2. User Roles

User roles are available to identify different team members.

Employee is the base role in AccountKit and gives access to the system to edit, modify and work on the various tools and systems included in your subscription. Employees can also see all data for clients, including TFN's, contact information, relationships and notes unless restricted via Restricted Client Access. An employee can not see the "Your Financials" dashboard.

Manager has all the same privileges as an employee user, however we use the manager level to designate whether a staff member displays as a manager in certain areas of the software.

Partner has the same privileges as managers and employees, however they are able to view the content in the "Your Financials" dashboard.

Practice Admin is the highest base role in AccountKit. A Practice Admin can also see the "Your Financials" dashboard.

3. Profile Picture

Add the user's profile picture which will be displayed when they're logged in and across shared screens such as the Workflow tool.

4. Time Zone

This enables correct date stamping of any work completed within AccountKit.

5. Reports To

Identify who the user reports to (Optional)

6. AccountKit Champion

The AccountKit Champion toggle allows you to identify a user(s) internally as the go-to for your AccountKit needs. This also helps us identify who best to reach out to for updates and support.

7. Practice Settings

Selecting the following options on a user will provide that user with more granular controls over the system. We recommend allocating at least 1 user in the practice as a Super Admin.

Champion is the role designated by the practice for the person who knows the ins and outs of AccountKit and handles the liaison and engagement with AccountKit training, support and account teams. This role is designated by the medal icon.

Practice Administrator is provided to those with ultimate control over the software for the practice. There are 2 designations for these roles. Practice Admin (Green) and Super Admin (Purple)

Practice Admin - gives the user access to all practice settings including the ability to delete schedules and client/contact data.
Super Admin - The user has unrestricted access to practice settings, user management, deletion of data & is not restricted by restricted access groups.

User Management is designated by the name badge icon and signifies that this user has user permission access. This can be clicked in a user profile to switch it on. As Super Admin's have access to all areas of the software, they will always have the name badge icon allocated if they have been allocated this role.

8. User Management

This toggle allows the user to access the User Management Page with the ability to - Add, edit, and block users as well as reset other user's 2FA.

9. Restricted Access Groups

From here you can select whether a user has access to a restricted access group. See Restricted Client Access in Practice Settings for more info.

10. Client Access Level

Client access level determines the amount of access a user has to the client details area within AccountKit.

Full - Allows the user to view, edit & delete providing they have the appropriate permissions applied above to do so.
Modify - Allows the user to view & edit schedules and information, however they cannot delete information or records.
View only - The user can only view information in the system that they have access to on a read only basis.

11. Shared Tool Bar

Refer to the Shared Tool Bar for more information.

12. Send Invite/Save/Cancel

This will email the user their sign-in details, save any updates or cancel the current action.

Practice Settings - Restricted Access Groups

As part of the upgrades to user permissions in AccountKit, there is now the ability to restrict access to certain clients or groups. To create a restricted access group you will need to head to your practice settings. You can read more in Practice Settings under Restricted Client Access.

The ability to restrict users from seeing a client's details can be toggled at the individual user level (refer to item 10 in the above section).

This toggle provides the following options; to see all or nothing in regards to client details.

Where the user can access client details you can tailor this further with the following levels: "View ONLY", "edit" or "full access" (allows for deletion).

Use Cases

Scenario 1 - Partner entities

In this example, we are going to look at when a Partner of an accounting firm wants to restrict their client group from the rest of the practice so only they can access the records from within AccountKit.

Group Name - This section identifies the client group and the purpose of the restricted access group.
Description - This can provide further context to the purpose of the restricted access group.
Restricted Clients - Here I can select the client group(s) or the individual client(s) I want to restrict.
- IMPORTANT! - If you are attempting to apply restrictions to the client map tool you will need to select a client group for this to take effect. The client map is unique in that it is based on the client group, rather than individual clients.
Restricted Tools - At this point, you can detail which tools you want to restrict.
- In this case, I want to restrict all tools for anyone outside this group within AccountKit which is why I have turned on the toggle option
- If you don't toggle all tools you can select the various tools you want to lock down.
Access Level - Further to selecting the tools you can then provide various levels of access to those users within the group: Full, edit and view only. See table under Users.
- In this instance, we are selecting full access to ensure I can perform all the necessary updates to client details and schedules.
Users assigned to this group - At this point, you can identify the users you want to add to the group.
- Because Ben is the partner, he is the only member of the restricted group.
- IMPORTANT! - You can add users at this point or when you are managing restricted client groups from within the user management page. The functionality is the same.

Scenario 2 - Partner entities with admin team access

This example can work side-by-side with the example detailed in Scenario 1 and adds an extra layer to the partner's permissions.

This scenario is useful where the Partner already has locked down their client group for themselves but still needs say the admin team to record correspondence against their entities using the correspondence register.

Group Name - This section identifies the client group and the purpose of the restricted access group.
Description - This can provide further context to the purpose of the restricted access group.
Restricted Clients - Here I can select the client group(s) or the individual client(s) I want to restrict.
- IMPORTANT! - If you are attempting to apply restrictions to the client map tool you will need to select a client group for this to take effect. The client map is unique in that it is based on the client group, rather than individual clients.
Restricted Tools - At this point, you can detail which tools you want to restrict.
- In this case, I have isolated the correspondence register as the tool being restricted to those outside the group. However, those within the group, will be able to access the correspondence register.
Access Level - Further to selecting the tools you can then provide various levels of access to those users within the group: Full, edit and view only. See table under Users.
- In this instance, we are selecting full access to ensure I can perform all the necessary updates to the correspondence register.
Users assigned to this group - At this point, you can identify the users you want to add to the group.
- Matt Taylor in this instance is part of the admin team, which is why he is a part of the restricted group.
- IMPORTANT! - You can add users at this point or when you are managing restricted client groups from within the user management page. The functionality is the same.

Guest Access

Sometimes you may want to provide a user with limited access to just a certain tool(s) or clients/client groups in the software. For these instances, you can use Guest Access. Guests are charged at a reduced fee to a regular user, and should only be used for very limited access circumstances. Examples: External consultant/bookkeeper, offshore team member, an affiliate to a client or even a client themselves if you would like them to review their own information.

Adding a Guest

From the User Management page in AccountKit, select the '+' icon at the top of the screen as you would normally to add an employee.

A drop down option to 'Add new guest' will appear. Click this option.

The following screen will appear allowing you to add in the various details for your Guest. Note that you cannot add an already existing user as a Guest. If you wish to switch an employee to a Guest, please reach out to AccountKit support for assistance.

In order for a Guest to receive access to any information in AccountKit, they will need to be designated the tools and clients that they need to see. Without this information allocated to them, they will see nothing when logging in.
From the Guest Permissions area, select the tool or multiple tools that the Guest will have access to and the relevant level of access they will have within that tool.
Full - Allows the user to view, edit & delete information for this tool (only for the client(s) they have been provided access to).
Modify - Allows the user to view & edit schedules and information, however they cannot delete information or records (only for the client(s) they have been provided access to).
View only - The user can only view information in the system that they have access to on a read only basis. (only for the client(s) they have been provided access to).
Then select the Client Groups or individual entities that they will be able to view. In the below example, this Guest will have access to the Equipment Finance and Inter-entity Loan tools for the Bull Family Group and the RJ & AJ Bull Family Group Only.

Important things to know about Guest access

Unless at least 1 tool and 1 client are both allocated to a Guest, they will not be able to see any information in AccountKit.
A Guest cannot be allocated to any tools in the software that are considered 'Practice Access Systems' such as areas like the Correspondence Register, Document Management System, and Workflow. Below is a list of tools that a Guest can be assigned to.

Account Reconciler
Amortisation Scheduler
Client Maps
Compounding Calculator
Division 7a Tool
Equipment Finance
Extra Loan Repayments
Flexible Loan Calculator
Franking Account Register
Fuel Tax Credit Caclulator
Important Items Register
Inter-entity Loan
Loan Calculators
Professional Development Register
Retirement Calculator
Simple Loan Calculator

If you wish to move an employee to a Guest, you will need to contact AccountKit support as the email will already be designated certain permissions. We will need to make a change to their profile in order to switch them from one security profile to another.

User Permissions & Guest Users