Xero user permissions: new roles and what changes

Want a new hire to raise purchase orders without handing over the whole ledger? Xero is making that possible. It is splitting its broad user roles into smaller permissions, so each person gets the access their job needs and no more.

Xero explained the changes on 31 October. Some went live in July, more arrive in November, and others are still being explored.

Why it’s changing

Xero says access has worked “a bit like a house key”. You either handed it over or you didn’t. Letting someone raise a purchase order also opened up supplier bills. Letting someone count stock exposed financial data they had no reason to see.

Better permissions have been near the top of Xero’s Product Ideas board, where customers vote on features.

What’s already changed

The first release, in July 2026, broke the big roles into pieces:

Inventory: view, create and edit, or stock adjustment access.
Banking: bank balances, statement lines and feeds can be hidden from Standard users.
Reporting: sales or purchases reports can be shared without opening the whole Reporting Centre.
Payroll: timesheet and leave approvers for Xero Me can be set from the Users page in Australia, New Zealand and the UK.

Several roles got new names. Advisor is now Administrator, with the same access. Read Only is now Viewer. Invoice Only became four roles: Sales and purchases, Sales, Purchases, and Draft sales and purchases. Standard hasn’t changed. Payroll Admin and Employee also got their own high-level roles.

If you can’t find “Advisor” or “Read Only” on the Users page any more, that’s why.

What’s arriving in November

Purchase orders: view, edit and approve are separate. View and edit can cover just someone’s own purchase orders, or all of them. A new Purchase Orders only role suits people who raise them.
Inventory reports: they become their own report group, so a stock worker can run the reports they need.
Document uploads: staff can upload documents without seeing everything else that’s been uploaded.
Timesheet approval: in Australia, view, edit and approve become separate permissions, so someone can approve timesheets and do nothing else. Xero says it’s coming to New Zealand and the UK soon. It needs Xero’s new timesheet experience and doesn’t work with classic Timesheets.

Permissions build on each other. Edit includes view, and approve includes edit. It’s designed so nobody can change something they can’t see.

Your current set-up stays put

Xero says existing users keep the access they have today. Changes only happen when someone with the edit users permission makes them.

The changes cover Business Edition plans worldwide. Practices on Partner Edition keep their permissions exactly as they are, with nothing to reset. Only the look of their Users page changes.

What Xero is still working on

Next, Xero is regrouping its reports around the jobs people do. The reports themselves stay the same, and Xero says it will tell users before the change reaches them.

It is also exploring three ideas, with no dates:

custom roles you can name and reuse
permissions for individual bank accounts
payroll access for managers limited to selected employees.

Keeping each login to what its owner needs is part of keeping the books safe. Our guide to two-factor authentication for business accounts covers another part of protecting those logins.

Checklist

Open the Users page in Xero. See the role and permissions each person has, and what you can now set for them.
Hide bank balances and feeds from Standard users who don’t need them. This setting has been available since July 2026.
Give staff who only raise purchase orders the Purchase Orders only role. It arrives in November 2026, so check back if it isn’t there yet.
Set up Australian timesheet approvers with the approve permission once it arrives in November. It needs Xero’s new timesheet experience, not classic Timesheets.
Tell your bookkeeper about the renamed roles. Advisor is now Administrator and Read Only is now Viewer, so old instructions may use names that no longer appear.