QuickBooks Online User Roles and Access Rights: What Each Admin Level Can Do

QuickBooks Online organizes access around user roles, and the distinction between the two admin tiers trips up new subscribers more often than any other setup detail. When a company file is first created, the person who completes the initial setup automatically receives the primary admin role. That role sits at the top of the hierarchy and cannot be reassigned by anyone holding a lower permission level.

The primary admin can grant a second tier — company admin — to other users. Company admins hold broad authority over nearly every area of the file, but they face one hard ceiling: they cannot change, reassign, or remove the primary admin designation. Only an existing admin can add, edit, or remove other admins, which keeps the chain of authority intact and prevents accidental lockouts.

What Admins Can Do

Both admin roles carry effectively identical day-to-day permissions. The accepted community guidance outlines a wide-ranging set of capabilities that cover the full bookkeeping cycle and most configuration tasks. Admins can add, edit, and delete employees, customers, vendors, products, services, and accounts. They can change company preferences, create and manage budgets, and view the activity log to see what other users have done.

On the transactional side, admins are cleared to enter estimates, invoices, sales receipts, credit memos, refunds, charges, and credits. They can receive customer payments, create and delete statements, make deposits, transfer funds, enter bills, pay bills, write and print checks, and record cash and credit card purchases. Journal entries and completed reconciliation reversals are also within scope.

Banking, Projects, and Reporting Access

Admins can view and categorize imported bank transactions and access bank registers. They can add, edit, and delete projects, attach project-level transactions — including invoices, expenses, bills, time entries, purchase orders, and estimates — and receive payments tied to specific projects.

Reporting access is similarly broad. Admins can view all reports, including financial statements such as profit and loss, balance sheet, and cash flow. They can pull customer and accounts receivable reports as well as vendor and accounts payable reports. The one area called out as restricted is payroll reporting, which is handled through a separate access path.

Sales Tax and Multicurrency Controls

Admins hold full authority over sales tax configuration. They can view tax rates and agency settings, use and adjust sales tax on both sales and purchase transactions, manually override calculated tax amounts, prepare and file sales tax returns, record tax payments, and set up new tax agencies or change existing tax methods and rates.

Multicurrency management is similarly unrestricted for admins. They can add, edit, and delete currencies, edit exchange rates, set up multicurrency for the company, and perform home currency adjustments.

Payroll and Workforce Permissions

Payroll access runs through Intuit’s QuickBooks Workforce framework. Admins can manage and run payroll, fill out timesheets for any worker, and approve or pay bills online. The separation of payroll reports from the general reporting bundle reflects the sensitivity of compensation data and keeps it behind its own permission gate.

The One Boundary That Matters Most

The practical takeaway for teams setting up a new QuickBooks Online company is straightforward: decide early who should hold the primary admin role, because moving that title later requires action from the current primary admin — a company admin cannot promote themselves or anyone else into it. Beyond that single restriction, company admins operate with the same sweeping authority as the primary admin across customers, vendors, banking, projects, tax, currency, and payroll.

For teams managing access changes or locked-out admin accounts, QuickBooks Online troubleshooting resources can help clarify the steps before escalating within your own organization.