Installing the CRM is half the job. The other half is people: who can log in, what they can see, and what happens the day someone leaves. Set this up before the data goes in.
Almost every small office makes the same mistake: one shared admin password on a sticky note. Then nobody knows who changed a deal, a deleted contact cannot be traced, and a staff member who leaves still knows the master password. SuiteCRM already has the tools to do this properly — users, roles and security groups — and an hour spent here saves real pain later.
👆 The pattern to copy: few roles, clear boundaries, and nobody working as admin day to day — not even you.
admin and open Admin → User Management → CreateFrom now on, every call logged and every deal moved carries a name. That single fact changes how carefully people work.
A role controls which modules a user sees and what they may do inside them — view, edit, delete, import. A practical starter set:
Create roles under Admin → Role Management, then assign each user their role. Start strict and loosen where work genuinely needs it — the reverse direction is much harder.
Roles say what; security groups say whose. Put the sales team in a Sales group and each salesperson sees the group's customers, while support staff see the records assigned to Support. This is how you stop one branch — or one salesperson — from browsing another's pipeline. Keep it simple at first: one group per department is enough for most small businesses.
When someone leaves, do not delete their user — their name is attached to years of history. Set the account to Inactive instead: the login dies instantly, the records and their name stay, and you can reassign their open leads and deals to a colleague. This five-minute habit is the difference between a clean exit and a former employee who still knows the shared password.
Every screen of this install — the bootable USB, the guided setup and the first login — is shown live in the full video.
▶️ Watch Full VideoThey can technically, and they should not. Shared logins destroy accountability — when a deal amount changes, you cannot know who did it — and they usually violate the spirit of any data policy you show customers. Users are free in SuiteCRM; there is no per-seat cost to doing this properly.
As admin, open their user record and set a new temporary password, then have them change it after logging in. Because every person has their own account, a password reset never locks out the rest of the team — one more reason the shared login is a trap.
They can: import and export actions are controlled per module in the role settings. For most staff, turn export off for Contacts and Accounts. Remember the honest limit, though — anyone who can see data can copy some of it by hand. Roles manage honest mistakes and casual misuse; they are not magic.