User Management in Magento

User management in Magento, today part of Adobe Commerce, covers two things that every online business must govern at once: the accounts of its customers, including their data, addresses, groups and orders, and the accounts of its own staff, whose roles and permissions decide who can change prices, data and settings. Managed well, both protect revenue and trust.

Consider the Monday review of an online retailer. The customer service lead explains that the weekend produced a cluster of failed deliveries traced to badly typed addresses, and that several shoppers abandoned a purchase halfway because they could not complete the checkout and nobody called them. The finance controller adds a different concern: an intern with access to the store's admin changed a discount rule on Friday afternoon, and nobody noticed until margins were reviewed. Two incidents, one cause. The store has customers and users, but nobody manages them as a business asset.

That is the real subject of this article. The administration screens of Magento are simple to describe, and the chapters that follow walk through them, but their value is strategic. A store owner who assigns specific roles, manages access levels and gives every team member the permissions that correspond to their responsibility reduces risk, protects sensitive information and optimizes the flow of work. A store that knows its customers, corrects their data, helps them complete a purchase and treats each group differently converts and retains more. Both disciplines belong on the executive agenda.

>> How to execute mass actions in magento? <<

Why does user management matter for revenue and risk?

An ecommerce operation produces a constant flow of small decisions about people. Who may see a customer's tax number? Who may edit an address after a failed delivery? Who may approve a product review that will be read by thousands of prospects? Each decision is trivial in isolation, and each has a cost when it is made badly: a delay in delivery, a leaked record, a discount applied to the wrong group.

The financial effect is cumulative. Address errors generate failed purchases, delivery delays or packages that cannot be delivered at all, and each of those events adds cost to the operation, in the experience of the teams that run these stores. Permissions that are too wide expose the company to modifications nobody meant to make. Permissions that are too narrow slow the team down, because every small change needs a request to someone else. The goal is neither control for its own sake nor freedom for everyone, but a deliberate design of who does what, supported by the platform.

This is why the discipline has two faces. Toward the customer, user management is a service and loyalty tool. Toward the organization, it is an internal control. We take them in that order.

How do you find and edit a customer in Magento?

Once the customer you want to manage has been located in the customers grid, the Edit button in the Action column opens the full record. From there the administrator sees, at a glance, when the customer last logged in, whether they are online, the date the account was created, the customer group they belong to and their default delivery address. For a service team this is the starting point of every conversation: they know who they are speaking to before the customer finishes their first sentence.

The record is organized in a top menu and a side menu. The top menu lets the administrator delete the user, reset the changes that have not been saved, reset the password, save and continue editing, and create an order on the customer's behalf. The last of these deserves attention, because it turns the administration panel into an assisted sales channel.

What is a customer group and how does it affect discounts?

The customer group to which a user belongs determines which discounts apply to them and which tax class is associated with them. Adobe's documentation on customer groups confirms the logic: the group determines the available discounts and the tax class, cart price rules can be limited to selected groups, and a store starts with the General, Not Logged In and Wholesale groups.

That makes groups a simple instrument of segmentation. A retailer can create a VIP group, associate a cart rule to it and give those customers a ten percent discount. The mechanism is the same for a wholesale price, a professional customer or a loyalty tier. What matters for the executive is the decision behind the mechanism. Who qualifies for VIP? Is it purchase frequency, accumulated spend or strategic value? Is the discount funded by margin, by supplier support or by a marketing budget? A group without criteria is merely a label, and a group with clear criteria is a retention policy that the system applies without human intervention.

The administrator can also move a customer from General to VIP from the account information section, which gives that customer access to the promotions and content assigned to the group. One way to make customers feel special is to make them special in the store itself. Giving them access to special prices and showing them content that offers greater advantages than others encourages them to feel loyal to the brand. Our view of how groups relate to broader customer segmentation is in customer segmentation, the key to a personalized experience.

Read: Uploading Products to Magento Commerce

How can a store help a customer complete a purchase?

The Create Order option allows the administrator to place an order for the customer as if the customer were buying. The administrator adds the products the customer wants, indicates the delivery and billing addresses, selects the shipping method, and follows the order until it is processed and sent. According to Adobe, the administrator can add products from the customer's own activity lists, which are the wish list, the last ordered items, the comparison list, recently compared products and recently viewed products, as well as from the catalog, and can apply a custom price to an item when the situation requires it, in the way described in Adobe's guide to creating an order for a customer.

The strategic uses are easy to picture. A bank that sells a card accessory to its premium clients through a branch officer can place the order while the client is on the telephone. A furniture retailer can complete a large and complex purchase for a customer who has given up on a mobile checkout. A distributor can take the order of a long-standing customer who prefers to speak to a person, and still capture it in the same system, with the same inventory and the same reporting. The channel is assisted, but the data are the same, and that is what keeps the operation coherent.

This also explains why the custom price option needs governance. It is a legitimate tool for a negotiated exception, and an open door to margin erosion if it is available to every user. That brings us to the internal side of user management.

What does the side menu show about the customer?

Each submenu of the customer record supports a different service conversation. In account information, the team can update the name, the email, the birthday used for promotions and the tax or VAT number, and can change the customer group. In addresses, the administrator can add or edit the customer's addresses directly. One of the main challenges for people who venture into online shopping is to indicate their address correctly, and a store that can correct it with the customer avoids errors that turn into costs. Two situations are typical: the customer has trouble entering an address in the account, so the team enters it for them, or the delivery process reveals that the address is wrong, so it is corrected for future deliveries. In both cases it is wise to consult the customer, so that they stay informed of their activity in the store.

In orders, the team sees every order the customer has placed and can create a new one from any of them with the reorder function. In a worked example, order 000000016 is created from order 000000015 using Reorder. For consumables, replenishment and repeat B2B purchases, this is a service that saves minutes for both sides. Adobe's documentation on allowing reorders explains how the function is enabled for shoppers as well.

In the shopping cart view, the team sees which products the customer has added, and that information can be used to send direct promotions on products the customer is considering. The same data should be handled with discretion, because a customer who feels watched does not return.

How should newsletters, reviews and wish lists be handled?

The newsletter section manages the notifications sent to customers who subscribe. Their purpose is to keep the customer aware of promotions and offers, and to invite them to events and fairs. The customer has to request those notifications personally, and they cannot be sent without prior authorization because they could be considered spam. Beyond the legal reasoning, there is a commercial one. Communications should be intelligent, so that the store is regarded as a good source of information. Poor communication that does not produce interest, or ignores whom it is sent to, leads people who once showed interest to unsubscribe, and the store loses a potential buyer a little at a time. Every word we communicate is important and we must choose it carefully.

Recommended article: Magento B2B and its Importance in Businesses

Billing agreements show the PayPal agreements of customers who pay with that method, which requires a PayPal business account and the corresponding configuration in Magento. According to Adobe's documentation on PayPal billing agreements, an agreement lets the customer pay without re-entering payment details at each purchase, and merchants review and manage agreements in the admin. More information on the topic is available in the Magento user guide.

Product reviews come from customers who express how they felt using a product. It is the store administrator's mission that these messages are good references for other buyers. They are public and serve as a guide for those who see the product, and by default they require approval by an administrator before others can see them. The approval is made from Marketing, User Content, Pending Reviews, and once approved the review is visible both in the customer profile and on the product page. Wish lists, finally, are lists in which customers with an account add the products they like. They can be shared so that other people make the purchase or the gift, and they help the store understand its customers and offer discounts on products of interest. A related walk-through is available in our article on how to interact with a customer wish list in Magento 2.

Blog: Apply Cart Rules on Magento to give Free Shipping to your Customers

How do you manage the permissions of your own team?

The same discipline applies to the people who work in the admin. Magento's role-based access control allows administrators to assign responsibilities, control sensitive data and improve the efficiency of work, and ensures that only authorized personnel can access and modify key settings. Following Adobe's guide to user roles, a role is created under System, Permissions, User Roles, given a name, a scope (all stores or a custom selection of websites and stores) and the resources it may access, and is then assigned to users. Adobe also warns that if a role is restricted, access to the permissions tool itself should be disabled, otherwise users could modify their own permissions.

The practical question is who needs which role. A customer service agent needs to see customers and orders and to edit addresses, but not to change catalog prices or tax settings. A marketing analyst needs content and promotions, not customer payment data. A finance user needs sales and reports. An agency or external developer needs a time-limited role that is removed when the project ends. The principle is the one that auditors apply everywhere: least privilege, reviewed periodically, with a named owner for each role.

The incident of our opening scene was avoidable. A discount rule is a pricing decision, and the right to change it should belong to the people who answer for margin. Our article on essential cybersecurity for your store in Adobe Commerce extends the argument to the wider security posture of the store.

What does this mean for the C-level?

For the chief executive and the commercial leadership, the customer record is where retention is decided. A single view of the customer, with groups that reflect real value and a service team empowered to correct data and complete orders, converts moments of friction into loyalty. The question to ask is how many customers currently abandon a purchase or receive a late delivery for reasons that a competent service team could have fixed in minutes.

For the chief financial officer and the chief risk officer, the issue is control. Price overrides, discount rules, customer data and refunds should sit behind roles that reflect accountability, with periodic reviews of who holds them. Each unnecessary permission is a small liability, and the cost of an incident is far larger than the cost of a review. For operations and technology leaders, the benefit is efficiency, because clear roles reduce the number of requests that pass through a few overloaded people.

For marketing, the opportunity lies in disciplined communication. Consent-based newsletters, groups that map to real segments and wish list and cart data used with respect increase the relevance of every message, and relevance is what keeps the unsubscribe rate low.

How should a director start next week?

Begin with a conversation, not a configuration. Ask the service team which five customer problems consume most of their time and which of them they cannot solve without help from someone else. Ask the finance controller for the list of staff who can change prices or discounts, and compare it with the list of people who should. The differences between the two lists are the first agenda.

Then define the customer groups the business really needs, with written criteria and an owner, and review the roles in the admin against the principle of least privilege. Decide how the assisted order will be used, by whom and under what limits on custom prices. Set a calendar to review all of this quarterly and to remove users who have left the company. These are modest changes that do not require a project, and together they remove most of the exposure described at the beginning of this article.

How ICX helps

ICX Consulting looks at user management as part of the customer experience and the control environment of a digital business. Our digital ecommerce for B2C and digital ecommerce for B2B practices define the service model, segmentation and responsibilities behind the store, and our team implements them on Adobe Commerce when that is the right platform. Our sales enablement work helps commercial teams use assisted ordering and customer data with consistency.

To map the points of contact where a customer needs help, use the Customer Journey Toolkit. Do you know which customer and staff permissions put your margin and your reputation at risk? Request a diagnostic with an ICX consultant.

Frequently asked questions

What is the difference between a customer and an admin user in Magento?

A customer is a shopper with an account in the store, managed from the customers section. An admin user is a member of your team with access to the back office, whose capabilities are set by a role. They need different policies, because the first is about service and consent, and the second about control and accountability.

Can an administrator place an order for a customer?

Yes. From the customer record the administrator can create an order, add products from the customer's activity lists or the catalog, and complete the address and shipping method. It suits assisted sales and recovery of abandoned purchases, provided that custom prices are limited to authorized roles.

How often should roles and permissions be reviewed?

At least quarterly, and whenever someone changes position, leaves the company or an external partner finishes a project. The review compares who holds each permission with who should, and removes the difference. Documenting an owner for every role makes the review quick.

Do customers need to consent to receive newsletters?

Yes. Notifications should only be sent to customers who have requested them, since unsolicited messages can be considered spam and damage the relationship. Consent also improves performance, because a subscriber who chose to receive your messages is more likely to read them.

Customers and teams are the two assets that an online store cannot buy back once they are lost. A business that treats customer records with care and gives its team the right permissions builds an operation that serves better, sells more and sleeps better, and if you would like to review where yours stands, we would be pleased to look at it with you.