---
title: "Setting up user group permissions"
manual: "TYPO3 Explained"
version: "main"
permalink: "https://docs.typo3.org/permalink/t3coreapi:setting-up-user-permissions@main"
source: "Administration/UserManagement/Groups/GroupPermissions.rst"
rendered: "2026-09-18T15:39:49+00:00"
---

# Setting up user group permissions {#setting-up-user-permissions}

We will look into managing user permissions by editing the
"Advanced editors" user group.

![Screenshot of the Module "Backend Users", submodule "Backend User Groups" in the TYPO3 Backend](../../../Images/ManualScreenshots/UserManagement/Module/BackendUserGroupsModule.png)

**Table of contents**

-   ["General" tab - backend user groups](https://docs.typo3.org/permalink/t3coreapi:general-tab-backend-user-groups@main)
-   ["Record Permissions" tab - backend user groups](https://docs.typo3.org/permalink/t3coreapi:record-permissions-tab-backend-user-groups@main)
-   ["Module Permissions" tab - backend user groups](https://docs.typo3.org/permalink/t3coreapi:module-permissions-tab-backend-user-groups@main)
-   ["Mounts and Workspaces" tab - backend user groups](https://docs.typo3.org/permalink/t3coreapi:mounts-and-workspaces-tab-backend-user-groups@main)

## "General" tab - backend user groups {#general}

On the "General" tab you can edit the group's title and write a
short description. As mentioned before, permissions from sub-groups
will be inherited by the current group.

![Tab General with the backend user group title and Group inheritance](../../../Images/ManualScreenshots/UserManagement/Groups/TabGeneral.png)

> [!NOTE]
> Setting permissions is not just about access rights.
>
> It can also help to declutter the backend, ensuring that
> backend users only see and have access to the modules they require.

### "Inherit settings from groups" section of tab "General" in backend user groups {#backend-group-inheritance}

If you chose groups in the "Inherit settings from groups" section of tab
"General", the current group inherits all the permissions of the parent group and
can add additional permissions. It is not possible to revoke permissions granted
by the parent group.

User TSconfig of the parent group gets overridden by TSconfig of the child group
and then, in turn, by the specific TSconfig of the backend user.
See also [Setting user TSconfig](https://docs.typo3.org/m/typo3/reference-typoscript/main/en-us/UsingSettingTSconfig/UserTSconfig.html#setting-user-tsconfig).

## "Record Permissions" tab - backend user groups {#include-access-lists}

### "Allowed page types" section in record permissions of user group {#access-lists-page-types}

You should allow at least the "Standard" page type if you want your
editors to be able to create new pages.

See also [Editors Guide, page types](https://docs.typo3.org/m/typo3/tutorial-editors/main/en-us/Pages/PageTypes/Index.html#pages-types).

### "Table permissions" section in record permissions of user group {#access-lists-tables}

This section allows you to grant "read" or "read and write" permissions for
different database tables.

If your user should be able to upload and reference images, for example
use the content element "Text & Images", it is important that they also be able to
read and write the tables "File Reference" and "File" beside also having
permissions to actually write saved files.

![Screenshot of Tab "Record Permissions", field "Table Permissions" in a user group record](../../../Images/ManualScreenshots/UserManagement/Groups/TablePermission.png)

### "Allowed fields" section in record permissions of user group {#access-lists-allowed-excludefields}

When defining table fields in TYPO3, you can mark them as
[excluded](https://docs.typo3.org/m/typo3/reference-tca/main/en-us/Columns/Index.html#confval-columns-exclude) in TCA. Such fields are hidden
from backend users (except administrators) unless they are explicitly granted
access. This field manages that access by displaying a list of all tables and
their excluded fields.

![Section "Allowed fields" in tab "Record permissions" of the user group record](../../../Images/ManualScreenshots/UserManagement/Groups/AllowedFields.png)

> [!TIP]
> You can hide fields from a backend group by setting page TSconfig option
> [disabled](https://docs.typo3.org/m/typo3/reference-typoscript/main/en-us/PageTsconfig/TceForm.html#confval-tceform-disabled).

### "Explicitly allow field values" section in record permissions of user group {#access-lists-explicitly-allow-deny-field-values}

By default you can choose which content element types are allowed for a backend
group in this section. Some extensions might add additional tables and their values
here.

A content element type not checked in this section cannot be added or edited by
a user of this group.

![Section "Explicitly allow field values" in tab "Record permissions" of the user group record](../../../Images/ManualScreenshots/UserManagement/Groups/AllowedFields.png)

> [!TIP]
> You can remove options from select fields with page TSconfig option
> [removeItems](https://docs.typo3.org/m/typo3/reference-typoscript/main/en-us/PageTsconfig/TceForm.html#confval-tceform-removeitems) (blacklist) or
> [keepItems](https://docs.typo3.org/m/typo3/reference-typoscript/main/en-us/PageTsconfig/TceForm.html#confval-tceform-keepitems) (whitelist).

### "Limit to languages" section in record permissions of user group {#access-lists-language-limit}

In a multilingual web site, it is also possible to restrict users
to a specific language or set of languages.

![Section "Limit to languages" in tab "Record permissions" of the user group record](../../../Images/ManualScreenshots/UserManagement/Groups/LimitLanguages.png)

## "Module Permissions" tab - backend user groups {#access-lists-modules}

The section "Allowed modules" grants access to different backend modules.

![Tab "Module Permissions" with the list of allowed modules](../../../Images/ManualScreenshots/UserManagement/Groups/TabModule.png)

If you allow the module "Dashboard" you should also explicitly choose
"Allowed dashboard widgets" in the next section.

MFA is only possible if you allow at least
one provider in section "Allowed multi-factor authentication providers".

## "Mounts and Workspaces" tab - backend user groups {#access-lists-mounts}

The next tab contains very important fields which define
which parts of the page tree and the file system the members of
the group may have rights over.

We will cover only mounts here. Detailed information about
workspaces can be found in chapter
[Users and groups for workspaces](https://docs.typo3.org/c/typo3/cms-workspaces/main/en-us/Administration/CustomWorkspace/Index.html#custom-workspace-users)

### "DB Mounts" in tab "Mounts and Workspaces" {#access-lists-db-mounts}

Unless at least one DB mount is chosen your user
does not have rights to any page record and will not be able to do anything in
the backend.

Each mount corresponds to a page in the tree. The user will have access only
to those pages and their sub-pages.

![Tab "Mounts and workspaces" in the backend user group edit form.](../../../Images/ManualScreenshots/UserManagement/Groups/TabMounts.png)

> [!WARNING]
> A user is only able to make changes to a page if they have rights to the db mount of that
> page and at least "Show page" permissions for that page:
> [See chapter page permissions](https://docs.typo3.org/permalink/t3coreapi:page-permissions@main)

You can grant additional entry pages in the database record of the backend user.
If option "Mount from groups" is not set for "DB Mounts" you can even override
all db mounts.

### "File Mounts" in tab "Mounts and Workspaces" {#access-lists-file-mounts}

File mounts are similar to DB mounts but instead are used to manage access to
files.

File mounts need to be created first, for example using the context menu on the
file tree in module **Media**, or in the
[File mounts submodule of the Backend Users module](https://docs.typo3.org/permalink/t3coreapi:user-management-backend-users-file-mounts@main)

They can then be selected when editing a backend user group:

![Section "File Mounts" in tab "Mounts and Workspaces" in the backend user group edit form.](../../../Images/ManualScreenshots/UserManagement/Groups/FileMounts.png)

> [!WARNING]
> Adding a file mount is not sufficient for your editors to upload and
> use files. Due to the [File Abstraction Layer](https://docs.typo3.org/permalink/t3coreapi:fal@main) users
> also need permissions to read and write tables "Files" and "File references".
> Set those in the
> ["Table permissions" section in Record permissions of user group](https://docs.typo3.org/permalink/t3coreapi:access-lists-tables@main).
>
> It is also necessary to grant Directory and File operation permissions in
> section [File operation Permissions](https://docs.typo3.org/permalink/t3coreapi:access-lists-file-permissions@main).

Just like DB mounts, you can grant additional file mounts in the database record
of the backend user. If option "Mount from groups" is not set for "File Mounts"
you can even override all file mounts.

### "File operation permissions" in tab "Mounts and Workspaces" {#access-lists-file-permissions}

Specific operations on files and directories must be allowed.
Choose either "Directory" or "Files" and start checking boxes.

### Category mounts {#access-lists-category-permissions}

It is possible to limit the categories that a user can attach to a database
record by choosing the allowed categories in the field
"Category mount". If no category is selected in the category mount,
all categories are available.

> [!TIP]
> If you want to disallow categories, remove the read and write
> permissions for table categories in the
> ["Table permissions" section in tab "Record permissions"](https://docs.typo3.org/permalink/t3coreapi:access-lists-tables@main).