Blog
NetSuite ERP Implementation: The Complete Step-by-Step Guide
On this page A NetSuite ERP implementation is one of the highest-stakes technology projects a…
20 min read
Read article →
NetSuite’s role-based access system gives each user access to exactly what they need. Sales reps see their deals and customer records. Warehouse staff see inventory and fulfilment. The CFO sees everything. For Indian mid-market companies with 20 to 200 users across departments, getting roles and permissions right is critical for data security and operational efficiency.
How NetSuite Roles Work
Every NetSuite user is assigned one or more roles. A role defines which modules, records, reports, and actions the user can access. NetSuite ships with 20+ standard roles (Administrator, Sales Manager, Accountant, Warehouse Manager, etc.) that cover most common configurations.
For Indian businesses going live on NetSuite, the roles most frequently assigned are Administrator (full system access, typically limited to one or two IT or ERP admins), Accountant (access to all accounting transactions and reports, but no ability to change system configuration), Sales Rep (access to CRM, quotes, and orders, but not financial data), Purchasing Agent (access to requisitions, POs, and vendor bills), and Warehouse Manager (access to inventory, item receipts, and fulfilment).
Standard Roles for Indian Businesses
| Role | Access |
|---|---|
| Sales Rep | Own leads, contacts, opportunities, quotes |
| Sales Manager | All sales data, team pipeline, forecasts |
| Accountant | GL, AP, AR, bank reconciliation, reports |
| A/P Clerk | Vendor bills, payments, PO matching |
| Warehouse | Inventory, fulfilment, receiving, transfers |
| Executive | Dashboards, KPIs, all reports (read-only) |
| Administrator | Full access including configuration |
Standard roles are a good starting point, but most Indian businesses need adjustments. The standard Accountant role, for example, gives access to all subsidiaries by default, which is inappropriate if your company has subsidiaries in different states and you want each accounts team to see only their own entity’s data. This is where role customisation becomes necessary.
Creating Custom Roles
Go to Setup > Users/Roles > Manage Roles > New. A custom role is a permission set you build from scratch. For each transaction type, set permission to None, View, Create, Edit, or Full. For example, a “Purchase Coordinator” role might have Create and Edit on Purchase Orders but View-only on Vendor Bills.
Rather than building a role from a blank slate, start by copying the standard role that is closest to what you need, then adjust permissions from there. NetSuite permissions work at two levels: record-level access, which determines whether a user can see a given record type at all, and field-level security, which controls visibility of specific fields within a record the user can otherwise access. For sensitive data such as salary information or bank account details, apply field-level security even within a role that otherwise has broad access.
Record-Level Restrictions
Beyond role permissions, restrict record access by department, subsidiary, or location. A salesperson in the West India team sees only customers and deals in the West India subsidiary. A warehouse manager in the Mumbai location sees only Mumbai inventory. Configure these restrictions in the role settings under Audience.
Subsidiary access is controlled separately from module permissions: a role can have full functional access across NetSuite but still be restricted to a single subsidiary. This matters for Indian companies with subsidiaries registered in different states, for example a Maharashtra entity and a Karnataka entity with separate GSTINs, where each state’s accounts team should see only its own subsidiary’s transactions.
Segregation of Duties
For audit NetSuite India GST setup, ensure no single user can both create a vendor bill and approve its payment. NetSuite supports segregation of duties by assigning different roles for creation and approval. The person who enters a vendor bill should not be the same person who releases the payment.
This follows the least privilege principle: users should have only the access they need to do their job, nothing more. This matters in Indian businesses where ERP fraud in the form of duplicate vendor payments, fictitious vendors, or unauthorised PO approvals is a real risk. Common over-permission situations to check for:
- Sales users with access to the Vendor Bill module (they can see what your company pays to vendors, which may be commercially sensitive).
- Accounts users with access to the Setup menu (they can change tax codes, payment terms, or approval workflows).
- Multiple users with the Administrator role (this reduces audit trail effectiveness; limit it to one or two named individuals).
NetSuite’s User Access Audit report (under Reports > Audit Trail) shows a log of who accessed which records and when. Run this quarterly and investigate any unusual access patterns.
Frequently Asked Questions
How many roles can a user have?
A user can have multiple roles and switch between them: at login, select which role to use from a dropdown in the top right corner. Common pattern: a finance manager has both Accountant and A/P Manager roles, switching based on the task, and each role change adjusts the user’s access and menu options immediately. This is also common for senior employees who need a departmental role plus read-only access to other areas. Multiple roles do increase complexity and can inadvertently grant broader access than intended, so review multi-role assignments during each quarterly access audit.
Can I restrict access to specific fields on a record?
Yes. Use field-level permissions and form customisation. Create a custom form for a specific role that hides sensitive fields (like cost price or margin) while showing the rest. Different roles can use different forms for the same record type.
How do I audit who accessed what in NetSuite?
NetSuite logs all record views, edits, and deletions in the system audit trail. Administrators can review login history, record access logs, and permission changes. For Indian companies subject to statutory audits, this trail demonstrates proper access control.
Can external users (vendors, customers) get limited access?
Yes. NetSuite supports customer and vendor center roles. These are limited portals where external users can view their own transactions (orders, invoices, support cases) without seeing internal data. Useful for customer self-service and vendor invoice submission.
Can NetSuite enforce IP address restrictions for specific roles?
Yes. NetSuite supports IP address access restrictions per role. You can configure a role so that it can only be used from a specific IP range, for example your office network or a VPN. This is a useful additional control for the Administrator role, ensuring system configuration changes can only be made from a trusted network. The setting is under Setup > Users/Roles > Manage Roles, in each role’s Allowed IP Address field.
How does NetSuite handle access control for employees who change departments?
Role changes in NetSuite are immediate. When an employee moves departments, update their assigned role in their Employee record under the Access tab: remove the old role and assign the new one, and the change takes effect on next login. For employees leaving the organisation, disable their login under Setup > Users/Roles > Manage Users to prevent any post-exit access.
