Skip to content

Adobe Commerce Support

Hyvä Enterprise Only

This documentation is only relevant for Adobe Commerce users with a Hyvä Enterprise license.

Advanced Admin Permissions runs on Adobe Commerce together with an additional compatibility module, Hyva_AdvancedAdminPermissionsEnterprise, from the hyva-themes/enterprise-module-advanced-admin-permissions package. This page covers what the Adobe Commerce compatibility module changes, how your existing Adobe Commerce role scopes are taken over, and which Adobe Commerce entities scope restriction covers. It assumes you have installed the Adobe Commerce compatibility module.

Scope Restriction Replaces Adobe Commerce Role Scopes

Adobe Commerce limits a role to certain websites or store groups with its own Role Scopes, provided by Magento_AdminGws. Advanced Admin Permissions has its own website and store view restriction, and running both side by side doesn't work well:

  • An admin only sees what both restrictions allow.
  • The role edit page shows two scope editors that save independently.
  • Magento_AdminGws reads only one of a user's roles, so a user with several roles is limited by whichever role comes first.

With the Adobe Commerce compatibility module installed, the Advanced Admin Permissions scope restriction replaces Adobe Commerce role scopes:

  • The role edit page no longer shows Role Scopes, and the roles grid no longer shows the Allowed Scopes column. Use the role's Scope Restriction tab instead.
  • Every role saved in the admin panel is stored as "all scopes" in Adobe Commerce, so Magento_AdminGws doesn't narrow anything on top of the scope restriction.

Importing Existing Adobe Commerce Role Scopes

Your existing Adobe Commerce role scopes are imported automatically. The first bin/magento setup:upgrade after installing the Adobe Commerce compatibility module runs a data patch that turns each role's Adobe Commerce role scope into an Advanced Admin Permissions scope restriction, and then sets the role to "all scopes" in Adobe Commerce. Each role is imported as follows:

Adobe Commerce role scope Imported scope restriction
Websites only Restrict by Websites, to the same websites.
Store groups beyond the role's websites Restrict by Store Views, to every store view of the role's websites and store groups. Advanced Admin Permissions has no store group mode.
All scopes Nothing to import.

A store view added later to an imported store group is not added to the role's restriction automatically, whereas Adobe Commerce would have included it. Add it on the role's Scope Restriction tab when you create the store view.

Roles the Import Leaves Alone

The import skips two kinds of roles, and both stay narrowed by their Adobe Commerce role scope until you settle them:

  • A role that already has a scope restriction of its own. Both restrictions are in force at the moment, so either choice changes what the role's users see. The import doesn't pick one for you.
  • A role whose websites and store groups no longer exist. Adobe Commerce shows the role's users nothing, and a restriction needs at least one website or store view.

A role that Adobe Commerce still narrows can't be saved in the role form, because saving it as "all scopes" would widen what its users can reach. The save is refused with "Adobe Commerce role scopes still limit this role. Import them before saving it."

Settling Roles with the Import Command

The hyva:admin-permissions:import-role-scopes command shows what the import did or would do, and settles the roles it left alone. Run it without options to see the import plan without changing anything:

bin/magento hyva:admin-permissions:import-role-scopes

The import command lists each role that Adobe Commerce limits, its Adobe Commerce role scope, the restriction it maps to and its status (import, conflict or skip). To settle the roles, add --apply, and use --prefer to choose which side wins for a role restricted by both:

# Import, and give Adobe Commerce's role scope precedence over a role's own restriction
bin/magento hyva:admin-permissions:import-role-scopes --apply --prefer=adobe-commerce

# Import, and keep a role's own restriction instead
bin/magento hyva:admin-permissions:import-role-scopes --apply --prefer=hyva

For a role whose Adobe Commerce scopes no longer exist, give the role a scope restriction first, then run the import command with --prefer=hyva. See the Command Line Reference for all options.

Import before disabling Magento_AdminGws

Adobe Commerce keeps role scopes in columns that belong to Magento_AdminGws. If you disable Magento_AdminGws, the next setup:upgrade drops those columns, and every role that hasn't been imported loses its restriction completely. The import command warns you while any role is left unsettled.

Adobe Commerce Entities Covered by Scope Restriction

In addition to everything scope restriction covers on Magento Open Source, the Adobe Commerce compatibility module restricts these Adobe Commerce entities for restricted admins:

  • Customer segments and dynamic blocks are narrowed through the tables that assign them to websites and store views.
  • CMS hierarchy nodes are narrowed by their scope. Saving, copying or deleting the CMS hierarchy of a scope the admin can't write is refused, including the default scope.

What Changes for Restricted Admins on Adobe Commerce

Adobe Commerce role scopes and the Advanced Admin Permissions scope restriction don't draw the line in exactly the same places. Once an imported role is set to "all scopes" in Adobe Commerce, only the scope restriction limits its users, so check your restricted roles against the two lists below before you install the Adobe Commerce compatibility module.

Areas Adobe Commerce Role Scopes Limited That Become Reachable

Magento_AdminGws limits these areas for a role restricted to some websites or store groups. The scope restriction doesn't, so a restricted admin whose role grants the ACL resource can work in them across all websites:

Area What Adobe Commerce role scopes did ACL resource
Catalog events Limited catalog events to the categories of the role's websites. Magento_CatalogEvent::events
Transactional email templates Made the email templates read-only. Magento_Email::template
Customer and customer address attributes Prevented creating and deleting attributes. Magento_CustomerCustomAttributes::customer_attributes, Magento_CustomerCustomAttributes::customer_address_attributes
Catalog price rules Prevented Apply Rules, which applies the pending changes of every website's rules. Magento_CatalogRule::promo_catalog
Reward exchange rates Prevented changing the rates that apply to All Websites. Magento_Reward::rates
Related product rules Prevented changing rules that are not assigned to a website. Magento_TargetRule::targetrule
Admin order creation Prevented creating orders for a role limited to store groups only. Magento_Sales::create

To keep a restricted admin out of these areas, either don't grant the ACL resource to their roles, for example with a negative role, or add the ACL resource to the denied resource list so it is denied to every restricted admin.

Areas Adobe Commerce Role Scopes Allowed That Become Restricted

The scope restriction is stricter than Adobe Commerce role scopes in a few places:

  • Products assigned to websites outside the admin's restriction can't be saved from the product form. The scope restriction refuses a save that spans into a website the admin can't reach, where Adobe Commerce kept the other websites' assignments and let the save through.
  • Some global areas are denied to restricted admins, including Stores → All Stores, import and export. See Areas That Are Denied Rather Than Narrowed for the full list, and the denied resource list to let an area through again.

Removing the Adobe Commerce Compatibility Module

Uninstalling Advanced Admin Permissions on Adobe Commerce doesn't bring back your former Adobe Commerce role scopes, because the import cleared them. Follow the uninstall instructions in Installing Advanced Admin Permissions to record each role's restriction before removal and set the role scopes again afterwards.