Restricting User Access to Specific Sites in Sage X3

When multiple sites operate under a single Sage X3 environment, giving every user access to all sites can lead to unnecessary complexity and security risks. With row-level permissions, administrators can precisely restrict users’ access to one or a few sites based on their roles. This blog demonstrates how to implement these restrictions efficiently and maintain operational control.

In multi-site Sage X3 environments, administrators often need to confine certain users to specific operational sites. This is primarily managed through Row-Level Permissions or Functional Authorizations. This guide explains how to implement such restrictions effectively while maintaining data integrity.

Method 1: Restrict via Row-Level Permissions

If an individual user should be confined to one or a small number of sites, you can utilize Row-Level Permissions. These permissions are configured in two key areas of the system:

under Setup → Users → Row Level Permissions (to define permission codes) and within Setup → Users → Users → Organization tab (where you assign restrictions per user).

New stuff: Validation on Non Existing PO field in Supplier BP Invoice Screen

Fig 1. Row level permissions Fig 2. User wise row level permissions

For instance, to limit a user to a specific site:

1. Access Setup → Users → Row Level Permissions.
2. Search for the code linked to site-specific controls. Typically, this is ‘FCY’ used across multiple functions (e.g., POH, SOH).
3. Assign ‘FCY’ as the permission code for the selected user.
4. Under the Organization tab, specify the Key value (for example, NA10) corresponding to the desired site and save your changes.

Once configured, logging in as this user will display only the assigned site (e.g., NA10) when performing actions such as creating purchase or sales orders. Note that Row-Level Permissions take precedence over any functional authorization settings.

If I log in as the user and go to Purchasing, Orders, Orders and click on New, I will see that the only site available to the user is NA011.

Fig 3. PO filtered for site NA011

Method 2: Limiting Access via Functional Authorizations

When dealing with multiple users sharing the same function profile, using Functional Authorizations is more efficient. You can manage this from Setup → Users → Function Profile.

Fig 4. Functional profile

1. Open the Function Profile screen and select the profile (for example, SABY).
2. Choose Authorizations → Addition → Recall to load all current authorizations.
3. Under the Type dropdown, choose either ‘Site’ (to restrict to specific sites) or ‘Site grouping’ (to restrict by site groups like company-level access).

Fig 5. Site grouping type

4. Input the relevant site or site grouping code (e.g., NA10 for all sites under that group).

Fig 6. Grouping by site

5. Check ‘Forced Cancel and Replace’ to clear pre-existing settings when creating a fresh rule, and save your updates.

If additional sites (such as NA20 or FR011) need to be added later, repeat the process but leave the ‘Forced Cancel and Replace’ unchecked. This way, the user retains their previous site permissions while gaining access to new ones.

Example: Granting Access to Multiple Sites and Companies

Consider a user who needs access to all sites within companies NA10 and NA20, plus one standalone site FR011. You would create authorizations for the profile to include NA10 as a Site Grouping, then NA20 without replacing existing rights, and finally FR011 as an individual Site. This ensures the user can manage operations only within these designated areas.

Fig 7. Example of functional authorization

Best Practices and Precautions

• Always test permissions using a copy of a function profile instead of modifying production ones directly.
• Verify that restrictions are applied correctly by performing sample transactions.
• Maintain backups of user settings before deploying changes.
• Avoid overlapping configurations between Row-Level Permissions and Functional Authorizations to prevent ambiguity.
• Regularly audit user access rights, especially after major version updates or role changes.

By properly configuring Row-Level Permissions and Functional Authorizations, Sage X3 administrators can create a secure and well-regulated environment, ensuring users work only within authorized operational scopes.