Setting up access rights to the 1C-Bitrix administrative section

Configuring Access Rights to the Administrative Section in 1C-Bitrix

Typical problem: a content manager logs into the administrative section and sees all modules, including server settings, backup, and license management. Or the opposite — a sales manager cannot open the required CRM section due to lack of permissions. Both issues are solved by configuring access to the administrative section.

How Permissions Work in the Administrative Part

Access to the administrative section in Bitrix is controlled at several levels:

1. User groups — a user must belong to a group with permission to access a specific module
2. Module permissions — each module has its own set of access levels
3. Site section permissions — access control to public and administrative pages via b_group_section

Database tables: b_user_group (user and group relationship), b_group (groups), module permissions stored in b_option with key format access_*.

Module Access Levels

For each module, available levels are: D (no access), R (read), W (write), X (full access). Configured via:

Settings → Users → User Groups → [group] → Access to Modules

Key modules and recommended levels for a typical content manager:

Permissions for Specific Pages and Sections

In addition to module permissions, you can restrict access to specific administrative pages. This is done via file system permissions for the /bitrix/admin/ folder:

Desktop → [right-click on folder] → Access Rights

Or programmatically via CComponentEngine::SetComponentPath and component permissions.

Administrative Access Without Administrator Group

To grant access to the administrative section without adding to the Administrators group:

1. Create a separate group (e.g., "Content Managers")
2. In group settings, enable "Access to Administrative Section" — flag ADMIN_SECTION in b_group table
3. Assign permissions to required modules

Without the ADMIN_SECTION flag, a user cannot access /bitrix/admin/, even with permissions for individual modules.

Permissions via API

Checking permissions in code:

// Check user permission for module
$APPLICATION->GetGroupRight('iblock'); // returns level: D/R/W/X

// Check if current user is an administrator
$USER->IsAdmin();

// Check membership in group
$USER->IsInGroup(5); // 5 - group ID

Execution Timeline

Configuring permissions for 2–3 user groups with typical roles — 2–3 hours. Designing a complex role model with custom restrictions at page and component level — up to 1 working day.