This article is for those Joomla developers that have clients or other contributors that need to access the Administrative Menu, but you don't want them to have access to areas that could potentially harm the site. You can set the permissions so that they don't have the ability to change things, but it might be best if they don't have access to these areas at all.

Restricted Admin Menu for Joomla

You want the client to have as much control as needed, but if someone that doesn't know what they are doing accesses areas such as the Global Configuration, there is the potential of breaking the web site. They could change database information or permissions and wreak havoc. On the other hand, access to only the Front End isn't quite enough for what they need to do. You can set up a User Group and assign permissions and access levels for the client so that when he or she logs into the backend, only specific features are available.

The steps in this article are a bit challenging, so be cautious. We will walk through creating a new User Group, creating a new User, assigning specific Access Levels, and assigning specific Permissions in Global Configuration.

The following steps are assuming that you are logged in as a Super Administrator for your Joomla 3 site. This process is much easier if you open two different browsers, for example, Chrome and Firefox. This way you can stay logged in as the Super Administrator in one browser and test your settings by logging in as the client would in the other browser. It saves a lot of steps of logging in and out of Joomla.

Step 1 - Create a New User Group

Pull down Users -> Group. Select New. For the Group Title put in Client Admin. Leave the Group Parent at Public. The Public level has the lowest permissions, and we will add permissions from there. Click on Save & Close.

Step 2 - Create a New User

You need to set up a new User account for your client or change the Assigned User Group in a current User account. The Assigned User Group should only be Client Admin. Click on Save & Close.

Step 3 - Add Client Admin to the Special Viewing Access Level

Most of the Administrator Modules, such as the menu across the top, have the Special Access Level assigned. In the User Manager, open up Viewing Access Levels and then open up Special. Check the checkbox next to Client Admin.

Step 4 - Assign permissions to the Client Admin User Group

We will start out giving this new user group very limited permissions and then add from there. Go to System -> Global Configuration. Click on the Permissions tab. Click on Client Admin from the list.

For the Admin Login, change the setting from Inherited to Allowed. Click on Save, but do not close yet. When you save, the screen returns to the Site tab. Click on the Permissions tab again, you should see that the Calculated Setting has changed to Allowed. Save & Close this window and return to Control Panel

Step 5 - Log in as the Client

Using a different browser (not a different tab, but a different browser - for example you are logged in as Super Administrator in a Chrome browser, open up Firefox as well), log into the backend of Joomla with the client's login and password.

You should see a very limited interface for the Administrative menu. The normal Menu items along the top are not appearing, not should the Quick Icons for access to the other areas of the Admin menu. You should still see the list of Logged In Users, Popular Articles and Recently Added Articles. The System menu item should only have one sub-menu of Control Panel. The help menu should also be appearing, as well as the little gear icon for logging out and navigating to the account information for this individual user.

Step 6 - Add the Content section to the available Administrative menu items

It is likely that you client needs to be able to access Article Manager and Media Manager. These are both in the Content section.

Back in the browser where you are logged in as a Super Administrator, go to Content -> Article Manager. Click on the Options button. This takes you to the Global Configuration for Articles & Categories. 

Click on the Permissions tab. Select Client Admin from the list of User Groups. For Access Administrative Interface, change Inherited to Allowed. Click on Save. The Calculated Setting for this should now read Allowed.

Step 7 - Verify changes

Refresh the screen of the other browser, where you are logged in as the client. You should see the Menu Item of Content appear. You may need to log out and log back in. You should be able to navigate to Article Manager. You won't have the ability to create articles or open and edit them until additional permissions have been assigned. 

Step 8 - Add additional permissions

Back in the first browser, go back into the Options for Article Manager and click on the Permissions tab.

Change the permissions for Client Admin as needed. They will likely be Create, Delete, Edit, Edit State and Edit Own. Change these all from Inherited to Allowed.

Step 9 - Check access levels

In the second browser, refresh the screen. You should now be able to open up the articles, edit them and create new ones. 

Step 10 - Repeat above steps for other sections

You likely need to give the client access to the Media Manager. This is done in the Permissions tab for Media Manager under System -> Global Configuration.

If you need to allow the client access to create Menu Items, this is done in the Permissions tab for Menus Manager under System -> Global Configuration.

If you need to add access for various Components, say the Contact component. Go into System -> Global Configuration and select the component in question. When you change the Client Admin permissions for any item in the Component dropdown menu, it will appear when the client logs in to the back end.