In Drupal 7 there is one permission for administering users, "Administer users".

This covers both the main user management page at 'admin/people/permissions', and the configuration of settings/fields for the user entity at 'admin/config/people/accounts' and 'admin/config/people/accounts/fields'.

A very common requirement for a site that's being released to a client is that they can administer the users (fair enough right?), so they need the "Administer users" permissions.

However, granting that permission also gives them access to edit the user entity settings/fields, which is very undesirable (no client should be able to change the underlying structure of the user once it's been set up, for obvious reasons).

This must be something a lot of people have to deal with...what methods/modules/custom code do people use to get around this limitation in the user module?


2 Answers 2


One method is to create a new permission

function MYMODULE_permission() {
  return array(
    'administer user configuration' => array(
      'title' => t('Administer User Configuration')

and then re-assign the pages under 'admin/config/people' to that permission:

function MYMODULE_menu_alter(&$items) {
  foreach ($items as $path => &$item) {
    if (strpos($path, 'admin/config/people') === 0) {
      $item['access callback'] = 'user_access';
      $item['access arguments'] = array('administer user configuration');

Then the user role in question can have the 'Administer users' permission, but not have access to the admin/people/config pages.

This feels messy at best though.

  • 1
    Also remember to not have any UI modules enabled on live sites, e.g. disable field_ui and views_ui - it is very bad practise to have those enabled on live website, same of course goes for debugging tools like devel.
    – lslinnet
    Dec 9, 2014 at 11:49

I do this by altering the access arguments of a menu item.

function MODULENAME_menu_alter(&$items) {
    // Accounts filter
    $items['admin/config/people/accounts/fields']['access arguments'] = array('custom user permission');
    $items['admin/config/people/accounts/display']['access arguments'] = array('custom user permission');


 * Implements hook_permission().
function MODULENAME_permission() {
   return array(
    'custom user permission' => array(
      'title' => t('Custom user account permission'), 
      'description' => t('Customized users permission @see MODULENAME.module'),
  • Thanks, I've got that one covered though :)
    – Clive
    Jul 17, 2012 at 11:55
  • This will not cover all pages what potentialy could be with admin/config/people/accounts prefix. If you want to change permission for all pages in admin/config/people/accounts you should use solution in answer by @Clive.
    – Bobík
    Sep 14, 2015 at 4:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.