Most agencies add users all the time and almost never review them. Contractors, former employees and clients who changed roles quietly keep access to data they shouldn't see. This guide shows how to audit user permissions across your GoHighLevel sub-accounts by hand, where that process gets slow, and how to speed it up.
Understand the two layers first
An audit goes wrong when you only check one layer. GoHighLevel manages users at two levels, and they are separate.
- Agency level: In the agency view, the path is Settings, then Team or Users, depending on your build. This is where people who sit above the sub-accounts live. An Agency user type can access all client accounts, while an Account user type can access only selected ones.
- Sub-account level: Inside the sub-account, go to Settings, then My Staff. This is where the client's staff and your account-level team members appear.
The layers stack. A user can have agency-wide access from an agency role plus sub-account-specific access from a sub-account role. So a person who looks harmless in one sub-account's staff list may still have agency-level reach.
One more limit: feature permissions set at the sub-account level control what the whole sub-account can use, individual user permissions can restrict further, and a user can't use a feature the sub-account doesn't have. Keep that in mind when a permission toggle seems to have no effect.
Decide what "correct" looks like
You can't audit against nothing. Before you open a single account, write down your baseline. For most agencies it's a short list:
| Role | Who should have it | What to check |
|---|---|---|
| Agency Admin | Owner, maybe one ops lead | Is each person still active and needed? |
| Agency user | Staff who work across many clients | Do they need all sub-accounts or only some? |
| Account Admin | Client owner or your account lead | Is there more than one per sub-account? |
| Account user | Reps, VAs, assistants | Are only the modules they use switched on? |
Keep the owner role in mind too. HighLevel has an Agency Owner role with the same permissions as an Agency Admin, plus the ability to transfer ownership. Make sure you know who holds it.
Step-by-step: audit users by hand in GoHighLevel
As of October 2026, this is the native process. Labels may shift, so describe what you see rather than trusting any screenshot.
- Start at the agency level. Open the agency view, then Settings, then Team (or Users). List every user with their user type, role and the sub-accounts they can reach.
- Flag agency-level oddities. Look for clients or contractors who are Agency type. HighLevel says clients shouldn't be agency-level users and should be added inside their own sub-account.
- Check Login As. Login As is permission-gated per admin, and when Enable Login As is off for a user, the option is hidden. Note who can impersonate other users.
- Open each sub-account's staff list. Switch into the sub-account, then go to Settings and My Staff. Record every user's name, email and role.
- Open each user's permissions. Edit the user and go to Roles and Permissions to see the toggles. Note which modules are on, such as contacts, conversations, workflows and settings.
- Check data scoping. The Only Assigned Data toggle controls key visibility. A rep who should see only their own leads needs this reviewed, since otherwise they may see the whole contact base.
- Record everything in one sheet. Use columns for sub-account, user, email, role, notable permissions, last reviewed and action needed. Without a record, the audit can't be repeated.
- Act on the findings. Remove users who left, downgrade over-privileged admins, and tighten modules. For temporary cases, see how to pause user access instead of deleting accounts.
Where the native way gets slow
The process works. The trouble is volume.
Every sub-account is a separate visit, and every user inside it is another click. With 40 sub-accounts and a handful of users each, you're opening hundreds of permission panels, then copying values into a spreadsheet by hand. There's no single native view that lines up every user against every sub-account for you.
That has three side effects:
- Audits get skipped. If a review takes a full day, it happens once a year, if ever.
- Copying errors creep in. Manual transcription across dozens of accounts produces gaps you won't notice.
- Fixes take as long as findings. Correcting the same over-permissioned role across many sub-accounts means repeating the same edit repeatedly.
There is a partial shortcut. On a user's permissions screen, a Copy Permissions button lets you pick a source user and apply those exact settings. That helps with consistency when you set people up, though it doesn't show you who's wrong across accounts. Confirm it's available in your current build.
Make the audit less painful
A few habits shrink the work whatever tools you use:
- Standardize roles. Define two or three permission profiles and use them everywhere. Variation is what makes audits slow.
- Add users consistently. Messy onboarding creates messy audits. Our sub-account onboarding checklist includes the user step, and adding users in bulk keeps new accounts uniform.
- Look at activity too. Permissions tell you what someone can do, not what they did. Pair this audit with a user activity report.
- Tie permissions to lead routing. If reps get assigned leads, review how you split leads between reps alongside Only Assigned Data.
How Sub-Account Manager handles it
Sub-Account Manager is built for this kind of agency-wide cleanup. Its User & Permission Manager is for viewing and managing users and their permissions across your sub-accounts without opening each one in turn. Its Bulk User Creator helps keep new users consistent from the start.
Sub-Account Manager is $49/month per agency, with unlimited sub-accounts, a 7-day free trial and cancel-any-time billing. You can connect your whole agency through a marketplace-app install, or a single sub-account with a Private Integration Token. Details are at builder.revenuegeneratingsolutions.com. RGS Tools isn't affiliated with HighLevel Inc.
You don't need it to run this audit. The manual steps above work for any agency, and the tool just removes the repetition.
A simple audit schedule
- Monthly: Check the agency-level list for new or departed users.
- Quarterly: Run the full per-sub-account review and update your sheet.
- On every offboarding: Remove the user at both layers, then confirm nothing remains.
Read more about user permissions in the glossary if you need a refresher on terms.
Questions
How often should I audit user permissions in GoHighLevel?
At least quarterly, plus any time someone leaves, changes roles or a client contract ends. A short, repeatable checklist matters more than the exact schedule.
Where do I see a user's permissions inside a sub-account?
Open the sub-account, go to Settings, then My Staff, and edit the user. The Roles and Permissions section lists what that user can access. Menu labels can change, so confirm against your current interface.
Can a user have access I can't see from inside one sub-account?
Yes. A person can hold an agency-level role and a sub-account role at the same time, and the two stack. Checking only the sub-account's staff list can miss agency-level access.
Should clients be agency-level users?
No. HighLevel's guidance is to add clients as users inside their own sub-account, because an agency-level user gets visibility across all sub-accounts you don't want them to have.