Shopify Staff Permissions: Roles, Risky Access and Offboarding
How Shopify staff roles and permissions work in 2026, which ones carry real risk (refunds, payments, apps, exports), how to require two-step sign-in and offboard.
In this guide
Every person you add to your Shopify admin can do exactly what their permissions allow, on a live store, with nothing in between. Most of the time that is what you want. The trouble comes from permissions given “just in case”, accounts that outlive the job, and nobody checking who still has access.
This guide covers how Shopify staff roles work as of October 2026, which permissions deserve care, how to require two-step sign-in, and a routine for reviewing and removing access.
How staff access works in Shopify
Users are tied to your plan
Staff accounts are available on Grow and higher. Shopify lists the maximum users per plan as 0 on Starter and Basic, 5 on Grow, 15 on Advanced and unlimited on Shopify Plus. The store owner, the organization owner, collaborators and POS-only staff don’t count toward that limit (Shopify Help Center).
If you downgrade to a plan with a lower limit, extra users are suspended: pending invites first, then active users who have been inactive longest.
Roles bundle permissions
A role represents a job and contains the permissions that job needs. You manage roles at Settings > Users > Roles, and a user can hold several roles, getting the combined permissions of all of them (Shopify Help Center).
That last point is easy to miss: adding a second role to someone never narrows their access, it only adds to it.
Some roles are managed by Shopify and can’t be edited (Shopify Help Center):
| Role | What it covers |
|---|---|
| Store owner / Organization owner | Complete access to the store or organization |
| Administrator | Almost all features in a single-store organization, including user management |
| Organization administrator | Almost all features across the organization and all its stores |
| Store user administrator | User management for specific stores |
| App developer | Dev Dashboard, custom apps and development stores; no production stores or billing |
| Collaborator access | A Partner organization member’s access to assigned collaborator stores |
For everyone else, build roles around jobs: fulfillment, customer service, merchandising, marketing.
Collaborators are separate
Agencies and freelancers usually come in as collaborators rather than staff. Only the store owner or an Administrator can grant collaborator access, collaborators can’t be given the Administrator role, and access expires automatically if they haven’t logged in within 90 days (Shopify Help Center). Our post on agency access to client stores goes deeper.
Permissions that carry real risk
Shopify flags a set of sensitive permissions that expose private store data, including Customers > Request data, Finance > Edit billing payment methods and pay invoices and Finance > Manage other payment settings. Its advice is to assign them only to your most trusted users and to spread sensitive tasks across several roles so no single account becomes a weak point (Shopify Help Center).
Beyond that list, some ordinary-looking store permissions move money, change what code runs in your store, or let data leave it. These are the names as Shopify lists them (Shopify Help Center):
| Area | Permission | Why it matters |
|---|---|---|
| Orders | Refund to original payment method, Refund to store credit | Money leaves the business |
| Orders | Cancel, Capture payments, Edit orders | Changes what the customer pays or receives |
| Orders | Export | Customer names and addresses leave Shopify |
| Customers | Export, Request data | Bulk or individual personal data leaves Shopify |
| Customers | Delete, Erase personal data | Records can’t be brought back |
| Finance | Manage payments settings (sensitive), View payouts, View tax documents (sensitive) | Payment configuration and financial data |
| Apps | Manage and install apps and channels | A new app gets its own access to your data |
| Apps | Approve app charges | Commits you to paid apps and themes |
| App development | Develop, Enable development | Custom apps with API access |
| Online store | Themes, Edit code | Code that runs on every page of your storefront |
| Gift cards | Create and edit, Export | Gift cards are stored value |
| Discounts | View, create, and delete | Margin on every order until noticed |
| Products | Export | Exports products and inventory |
Two details to know:
- The Reports permission lets a user view and create reports, and you can’t limit which reports they see.
- If you use Shopify Markets, permissions can’t vary by market. A staff member who can view orders sees orders from all markets (Shopify Help Center). If that matters, read Shopify Markets vs multiple stores.
A sensible default
- Give refund, capture, payment settings, app install and theme code permissions to as few people as possible, ideally the owner plus one named deputy.
- Keep export permissions off by default and grant them for a task, then remove them.
- Give customer service view access to orders and customers, and decide separately whether they can refund. Our returns and refunds process guide covers a refund policy your team can follow.
Two-step sign-in
A role means little if a password is phished. Shopify’s rules on two-step authentication (Shopify Help Center):
- Methods include an authenticator app, a security key, a built-in authenticator and passkeys. SMS can’t be set up as a new method.
- The store owner can’t switch on two-step authentication for someone else’s account. Each person sets it up themselves.
- If you use Shopify Payments, two-step authentication is required; without it, payouts might be put on hold.
What you can do is require a secure sign-in method per user. In Settings > Users, open the user and choose the required option under Secure sign-in method. New users are set to required by default. Switching an existing user to required logs them out, so tell them first (Shopify Help Center).
On Shopify Plus, an organization can require a secure sign-in method for all users at once, and also gets SAML single sign-on and SCIM user management (Shopify Help Center).
Reviewing access: a monthly routine
Set a recurring 20-minute slot. For each store:
- List users. In Settings > Users, search and filter the list, or export user information as a CSV (Shopify Help Center).
- Check each person against a job. Anyone without a current job in the store gets suspended.
- Check roles, not just names. Look for anyone holding refund, payment, app install, theme code or export permissions who doesn’t need them.
- Check secure sign-in is set to required for every user.
- Check collaborators and remove any agency or freelancer whose work has ended rather than waiting for the 90-day expiry.
- Read the user management activity log at Settings > Users > Security for role and user changes you don’t recognize (Shopify Help Center).
- Check installed apps in Settings > Apps and sales channels. Remove apps nobody uses anymore, and look closely at any app you don’t recognize.
With several stores, repeat this per store; each store has its own users. Seasonal hires make it worse, which we cover in seasonal staff access across multiple Shopify stores.
Offboarding: the same day someone leaves
Shopify gives you two actions on the user’s page under Actions (Shopify Help Center):
- Suspend blocks access and can be reversed with Reactivate.
- Remove deletes the user from your store permanently and can’t be undone.
A checklist:
- Suspend first on the day they leave, in every store they had access to. Removing can wait until you’ve checked their work.
- Check shared accounts. If the user was a shared login, Shopify advises creating a separate user for the person still working before you remove it.
- Reassign work in progress: open draft orders, pending returns, scheduled discounts.
- Review apps and custom apps they installed or developed.
- Rotate anything shared outside Shopify: carrier logins, payment provider dashboards, email accounts.
- Check Shopify Credit cards if they were a secondary cardholder: suspending locks their cards, removing cancels them.
- Record what you did and when, so a later question has an answer. Our guide to who changed what in Shopify explains what Shopify logs for you.
Common mistakes
- One shared login for the team. You lose any record of who did what.
- Copying the owner’s access to a new hire because building a role takes longer.
- Forgetting stacked roles. Two roles combine; check the total, not each role.
- Offboarding one store and forgetting the others.
- Relying on two-step authentication being “recommended”. Set secure sign-in to required for every user.
Adding approval on top of permissions
Shopify permissions are yes or no: a user who can refund can refund any order. If you want a second person to check money-moving changes, an approval workflow fills that gap. In the web dashboard of Storefleet Store Ops, refunds, cancellations and captures are always owner-only, stock and discount changes wait for an admin or manager unless you lower that per store, and staff can be limited to the stores and screens you choose. An admin can require two-factor sign-in for the whole workspace, and an audit log records sign-ins, role, screen and store changes. Details are on our security page.
FAQ
Can I give staff accounts on the Basic plan?
No. Shopify lists 0 staff users on Starter and Basic; users are available on Grow and higher. Collaborators and POS-only staff don’t count toward the limit.
Can I force my staff to use two-step authentication?
Per user, yes: set Secure sign-in method to required on each user in Settings > Users. New users are required by default. Requiring it for every user at once is a Shopify Plus feature. The owner can’t set it up on someone else’s behalf.
What is the difference between suspending and removing a user?
Suspend blocks access and can be reversed with Reactivate. Remove deletes the user from the store permanently. Suspend on the day someone leaves, then remove once you’ve checked their work.
Can I stop staff from issuing refunds but let them see orders?
Yes. Refund to original payment method and Refund to store credit are separate permissions under Orders. Give view access without them, and have refunds go to the owner or a named deputy.
Can I limit a staff member to one country in Shopify Markets?
No. Shopify says permissions can’t vary by market, so a staff member who can view orders sees orders from all markets. Separate stores are the way to split teams by region.