# User management

Source: https://support.storeconnect.com/articles/user-management · Last modified 21 August 2026

Use this process to give your team the access they need to run your StoreConnect store. What a team member can do is controlled by two separate layers that work together. Set up both when you onboard someone.

This topic covers the people who build and run your store from Salesforce: administrators, content editors, order desk staff, and theme developers. Two other kinds of access are managed separately: [customer storefront accounts](user-account-page), and [POS register access](add-a-pos-user), where staff sign in with a PIN rather than a Salesforce login.

## The permission model at a glance

Two independent layers decide what a team member can do. A person usually needs both, and they are granted in different places.

| Layer | What it controls | Where you set it | Covered in |
|---|---|---|---|
| **Salesforce access** | Whether the person can log in to Salesforce at all, and which StoreConnect records and fields they can see and edit (orders, products, content, themes, configuration). | The person's Salesforce **User** record, plus the permission sets you assign to it. | [Page layouts, profiles and permission sets](page-layouts-and-profiles) |
| **Store Roles** | Whether the person can open the storefront tools that live on the **Store** record: the **Website Builder** (make and approve content changes) and the **Web Console** (inspect a store's live render logs). | **Store Role** and **Store User Role** records in Salesforce. | [Store roles for site inspection and site builder](store-roles) |

The two layers are independent but both required for the tools they gate. A Store Role does nothing on its own: the person still needs a Salesforce login to open the **Store** record and launch the tool. Likewise, a Salesforce login alone does not open the Website Builder or Web Console until you add the matching Store Role.

## Layer 1: Salesforce access and permission sets

Every team member first needs a Salesforce **User** record with a license, so they can log in. Salesforce user setup itself is standard Salesforce; see [Salesforce basics](salesforce-basics) if you are new to it.

What each person can then see and do inside StoreConnect comes from the permission sets you assign. StoreConnect ships five, each scoped to a job. Assign the one that matches the person's role, following least privilege: give the narrowest set that lets them do their work.

| Permission set | Give it to | What it grants |
|---|---|---|
| **StoreConnect Administrator** | The store owner or lead admin who configures and runs the whole store. | Full access to the entire StoreConnect data model: catalog, orders, payments, content, themes, POS, and all configuration. |
| **StoreConnect Order Manager** | Order desk, customer service, and fulfillment staff. | Manage customers, carts, orders, payments, shipments, and bookings. Read-only on the surrounding pricing, promotion, tax, and catalog records. |
| **StoreConnect Content Manager** | Content editors and marketers who maintain the website. | Manage pages, articles, menus, content blocks, forms, and media. No access to orders, payments, catalog pricing, or configuration. |
| **StoreConnect Theme Manager** | Theme developers and designers. | Manage themes, templates, assets, variables, and translations. No access to commerce, content, or configuration data. |
| **StoreConnect Sync User** | The integration user. | The broad access StoreConnect's synchronization needs. See [how to create a StoreConnect sync user](how-to-create-a-storeconnect-sync-user). |

These roles are additive, so a person can hold more than one, for example **Content Manager** plus **Theme Manager** for someone who edits both content and themes.

:::note
The packaged permission sets do not include access to Salesforce standard objects such as Account, Contact, Order, and Product. A post-install script creates companion "Standard Permission" sets that you assign alongside the main set. See [Page layouts, profiles and permission sets](page-layouts-and-profiles) for the full breakdown and the standard-object companion sets.
:::

## Layer 2: Store Roles for Website Builder and Web Console

The **Website Builder** and **Web Console** are launched from a **Store** record, and access to them is not granted by permission sets. It comes from **Store Roles**. A **Store Role** defines one capability, and a **Store User Role** assigns that capability to a Salesforce user for a chosen set of stores.

A **Store Role** has two settings:

- **Type** — `Content Changes` for the Website Builder, or `Web Console` for the Web Console. If a person needs both, create two Store Roles.
- **Level** — for `Content Changes`, choose `Editor` or `Approver`. For `Web Console`, the level is `Viewer`.
  - `Editor` — open the Website Builder, make content changes, and submit them for review.
  - `Approver` — everything an editor can do, plus responsibility for reviewing and publishing changes. Changes stay off the live site until published.
  - `Viewer` — open the Web Console and inspect the live render and API logs for the store. See [inspect your site using the web console](web-console).

Each **Store User Role** also has a **Store Scope** that decides which stores the role applies to:

- `Store` — the one store you name.
- `Group` — every store in a chosen store group. Use this when a person manages several stores; set up a group rather than adding one role per store.
- `All` — every store in your org.

For the step-by-step on creating these records, see [store roles for site inspection and site builder](store-roles). Content approval and the Website Builder itself are covered in [the Website Builder](website-builder).

## When to set up access

- **During initial setup**, create the dedicated sync user and give your first administrators the **StoreConnect Administrator** permission set.
- **When someone joins** the team, add their Salesforce user and assign the permission set that matches their job.
- **When someone's job changes** or they need a storefront tool, add or swap permission sets and add the Store Roles they now need.
- **When someone leaves**, remove their access promptly. See [changing or removing access](#change-or-remove-access) below.

## Add a team member

1.  Go to **Setup** > **Users** and create the person's **User** record with an appropriate license. Standard Salesforce user setup applies; see [Salesforce basics](salesforce-basics).

2.  On the same user, open **Permission Set Assignments** and assign the StoreConnect permission set that matches their job, plus its companion Standard Permission set. Assign more than one only if their role genuinely spans both.

3.  Confirm the right **page layouts** are assigned so they see the StoreConnect fields on the records they work with. See [assigning page layouts](assigning-page-layouts).

4.  If the person will use the **Website Builder** or **Web Console**, create or reuse a **Store Role** of the right type and level, then add a **Store User Role** linking them to it with the correct **Store Scope**. See [store roles for site inspection and site builder](store-roles).

5.  Have the person log in and confirm they can reach the records and tools they need.

## Change or remove access

Adjust access by changing the same records you granted, never by editing the packaged permission sets themselves.

- **Add a capability** — assign an additional permission set, or add a **Store User Role**.
- **Remove a capability** — remove the permission set assignment from the user, or delete the **Store User Role**. Removing a Store User Role takes away Website Builder or Web Console access without affecting the person's other work.
- **Offboard someone** — deactivate their Salesforce **User** rather than deleting it, so historical records that reference them stay intact. Deactivating frees the license and removes all access at once. Remove their **Store User Roles** as well.

:::warning
Do not edit the packaged permission sets to change what a role can do. Upgrades re-apply them and your edits are lost. If you need a variation, clone the permission set and change the copy, or grant the extra access through a separate permission set.
:::

## Best practice

- **Least privilege.** Give each person the narrowest permission set that covers their job. Reserve **StoreConnect Administrator** for the few people who genuinely configure the whole store.
- **A dedicated sync user.** The synchronization user should be an integration account, not a person's login. A Salesforce Integration license is the recommended option. Don't reuse a staff member's account for it, and don't give staff the **StoreConnect Sync User** set. See [how to create a StoreConnect sync user](how-to-create-a-storeconnect-sync-user).
- **Use store groups for multi-store access.** When a person manages several stores, scope their Store Role to a `Group` rather than creating a separate role per store.
- **Deactivate, don't delete.** When someone leaves, deactivate their user to preserve the history on records they touched.
- **Review access periodically.** Check who holds **StoreConnect Administrator** and who has Store Roles, and remove access that is no longer needed.
- **Prefer single sign-on** for staff logins where you can, so access follows your identity provider. See [authentication providers and single sign-on](authentication-providers).

---

## Follow StoreConnect

- [Email Newsletter](https://getstoreconnect.com/c/lp-newsletter)
- [LinkedIn Newsletter](https://www.linkedin.com/build-relation/newsletter-follow?entityUrn=7444956928444862464)
- [YouTube](https://www.youtube.com/channel/UCngKdP2x8l1wcbAKW3tvU8g)
- [LinkedIn](https://www.linkedin.com/company/storeconnect)
- [X / Twitter](https://x.com/storeconnecthq)

## Popular Links

- [Partners](https://getstoreconnect.com/partners)
- [News](https://getstoreconnect.com/articles/news)
- [Events](https://getstoreconnect.com/articles/events)
- [Feature Comparison](https://getstoreconnect.com/how-we-compare)
- [Download a free trial](https://appexchange.salesforce.com/appxListingDetail?listingId=a0N3A00000FMkeKUAT)
- [Book a Demo](https://getstoreconnect.com/contact)

## Documentation

- [Help documentation](https://support.storeconnect.com/help-documentation)
- [AI agents](https://support.storeconnect.com/ai)
- [Videos & tutorials](https://support.storeconnect.com/videos-tutorials)
- [Developer reference](https://support.storeconnect.com/developer-reference)
- [Release notes](https://support.storeconnect.com/release-notes)
- [Troubleshooting](https://support.storeconnect.com/troubleshooting)
- [Trust Center](https://trust.getstoreconnect.com/)
- [Status Page](https://status.storeconnect.com/)

## Contact

- info@getstoreconnect.com
- US +1 415 745 3230
- AUS +61 2 8365 2308

100 S Ashley Dr, Suite 600-2461
Tampa FL 33602-600 USA

Level 22, Sydney Place
180 George Street
Sydney, NSW, 2000, AUS

---

StoreConnect Support — https://support.storeconnect.com/articles/user-management