Is there a way to block users who are allowed to edit users roles from seeing the "permissions" tab?

Can this be done without code?

  • 1
    Would the RoleAssign module do what you're after ? Have a look drupal.org/project/roleassign and see...
    – rtome
    Commented Sep 9, 2015 at 15:11
  • RoleAssign module was the best answer! can you put this as an answer please ?
    – Diana
    Commented Sep 9, 2015 at 16:30
  • Well, glad that helped. ;-)
    – rtome
    Commented Sep 9, 2015 at 19:00

3 Answers 3


Option 1

Use the RoleAssign module for this. Some details from its project page:

RoleAssign specifically allows site administrators to further delegate the task of managing user's roles while withholding the Administer permissions permission.

RoleAssign introduces a new permission called Assign roles. Users with this permission are able to assign selected roles to still other users. Only users with the Administer permissions permission may select which roles are available for assignment through this module.

RoleAssign is ideal for smaller sites with a system administrator and one assistant administrator role that should be reasonably restricted in what it allows. For larger sites with multiple levels of administrators or whenever you need finer-grained control over which role can assign which other role, check out Role Delegation. See #961682: Does the role delegation module supersede this module? for a short discussion of the relative merits of the two modules.

Option 2

Use the Role Delegation for this. Some details from its project page:

This module allows site administrators to grant some roles the authority to assign selected roles to users, without them needing the administer permissions permission.

For each role, Role Delegation provides a new assign ROLE role permission to allow the assignment of that role.

The module also adds an assign all roles permission. Enabling this permission for a role is a convenient way to allow the assignment of any other role without having to check all the assign ROLE role permissions in the Permissions page.

If an administrator has the administer users permission, a role assignment widget gets displayed in the account creation or editing form, and bulk add/remove role operations become available on the user administration page. Otherwise, if s/he has at least the access user profiles permission, the module adds its own Roles tab to the user profile so that roles can be assigned.

Option 3

Use the Administer Users by Role module for this (only an RC version for D7). Some details from its project page:

This module allows site builders to set up fine-grained permissions for allowing "sub-admin" users to edit and delete other users — more specific than Drupal Core's all-or-nothing 'administer users' permission. It also provides and enforces a 'create users' permission.

  • I used Role Assign
    – Diana
    Commented Sep 9, 2015 at 18:13
  • Makes sense in your case. But as so often in Drupal, there are multiple options to GTD, no? Commented Sep 9, 2015 at 18:15

This cannot be done without code. If you take a look at user_menu() you'll see that access to both of those pages is determined by the administer permissions permission.

To block access to one but not the other will require you to implement hook_menu_alter() and change which permission is checked for one of those pages.


this code works

function mymodule_menu_alter(&$items){ $items['admin/people/permissions']['type'] = MENU_CALLBACK;


  • 2
    Perhaps this is what you want, but to be clear, this won't prevent a user from accessing the permissions page, they just won't see the tab.
    – Aaron
    Commented Sep 9, 2015 at 15:26
  • you are right, the best answer was the Role Assign module
    – Diana
    Commented Sep 9, 2015 at 16:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.