SugarCRM User Management Guide

• Model type: hybrid
• Description: SugarCRM uses a hybrid model combining role-based access control (RBAC) with team-based record visibility. Roles define what actions a user can perform on which modules (view, edit, delete, import, export) at both the module and field level. Teams control which records a user can see. Multiple roles can be assigned to a single user; the most permissive role wins by default, but this can be changed to 'most restrictive' via the Roles settings. Field-level security (FLS) is available to restrict visibility or editability of individual fields.
• Custom roles: Yes
• Custom roles plan: Available on Standard, Advanced, and Premier plans; not confirmed available on Sell Essentials ($19/user/mo tier)
• Granularity: Module-level (view/edit/delete/import/export per module) and field-level (visible/read-only/hidden per field per role)

1. Log in as an Administrator or System Administrator.
2. Navigate to the top-right user menu and select 'Admin'.
3. Under the 'Users' section, click 'User Management'.
4. Click the 'Create User' button (or select 'Create User' from the Actions dropdown).
5. Enter required fields: First Name, Last Name, User Name, and Email Address.
6. Set a password or configure the user to receive a system-generated password via email.
7. Assign a License Type if prompted (varies by deployment).
8. Optionally assign Roles and Teams.
9. Click 'Save' to create the user.

Required fields: First Name, Last Name, User Name (must be unique), Email Address, Password (or trigger email invitation)

Watch out for:

• User Name must be unique across the instance and cannot be changed after creation in some versions.
• If SugarIdentity is enabled (cloud deployments on Enterprise/Premier), user creation and password management are handled through the SugarIdentity portal, not the standard Admin > User Management screen.
• Adding a user beyond the contracted seat count may be blocked or trigger a billing event depending on the contract terms.
• Roles and Teams must be configured separately before they can be assigned during user creation.

• Can delete users: Unknown
• Delete/deactivate behavior: SugarCRM supports both deactivation-oriented access control and delete-style user operations depending on deployment path and admin workflow. Public documentation should be treated as deployment-specific until verified in the tenant.

1. Log in as an Administrator or System Administrator.
2. Navigate to Admin > User Management.
3. Locate and open the user's record.
4. In the user detail view, click 'Edit'.
5. Change the 'Status' field from 'Active' to 'Inactive'.
6. Click 'Save'.

Watch out for:

• Deactivated users still appear in user lists and 'Assigned To' dropdowns unless filtered out, which can cause confusion.
• If the deactivated user was the only member of a team, records assigned to that team may become inaccessible to other users.
• In SugarIdentity-enabled deployments, deactivating the user in SugarCRM does not automatically deactivate them in the IdP; both systems must be updated.
• There is no automated record-reassignment workflow triggered by deactivation; reassignment must be done manually or via a bulk update.

• Where to check usage: Admin > User Management - the user list shows all Active and Inactive users. Active user count reflects consumed seats. There is no dedicated 'license usage dashboard' in the standard Admin UI; seat counts are tracked against the contract.
• How to identify unused seats: Filter the User Management list by Status = Active, then sort by 'Last Login' date to identify users who have not logged in recently. There is no built-in 'unused seat' report; admins must manually review last-login data.
• Billing notes: SugarCRM uses named-user licensing; each Active user consumes one seat. Seats are purchased in blocks per contract. Exceeding the contracted seat count requires a contract amendment. Implementation and onboarding costs ($15,000–$150,000 additional) are separate from per-user licensing fees. Portal users (Sugar Serve) are licensed separately from internal CRM users.

SugarCRM uses named-user licensing, so every active seat counts against a fixed contract block. Exceeding that block requires a contract amendment - there is no self-serve overage. Seats run from $19/user/month (Sell Essentials) to $115/user/month (Advanced, 10-user minimum), with Premier on custom terms.

Implementation and onboarding carry a separate cost of $15,000–$150,000 depending on scope. Portal users (Sugar Serve) are licensed independently and do not consume internal CRM seats.

Manual provisioning in SugarCRM is viable for teams with stable headcount and infrequent user changes, particularly on Standard or Advanced plans where role and team configurations are fully available.

The workflow breaks down at scale: no automated record reassignment on deactivation, no built-in license utilization dashboard, and a CSV bulk-import process with limited error feedback make every app lifecycle event - onboarding, role change, offboarding - a multi-step manual effort.

Organizations running SugarIdentity must also maintain two systems in sync, which adds operational surface area. Teams with frequent joiner/mover/leaver activity or audit requirements will find the manual approach increasingly difficult to sustain without tooling.

Bottom line

SugarCRM's manual user management works for small, stable teams but accumulates operational debt quickly as headcount grows. The split between in-app User Management and SugarIdentity means offboarding in particular requires coordinated action across two systems, and neither system automates record reassignment or flags unused seats.

Every app in your stack that requires this level of manual coordination compounds the administrative load - SugarCRM is not uniquely difficult, but it is not self-maintaining either.