⚡ Quick Summary

Handing out admin access to your whole team is one of the fastest ways to break a client's GoHighLevel setup. Add staff through Settings > Team, assign custom roles with only the permissions each person actually needs, and use role templates so scaling your team doesn't mean starting from scratch every time you hire.

🎯 Key Takeaways

  • Never give agency-level access to anyone who doesn't need to see billing, API keys, or SaaS configuration u2014 keep that list to two or three people maximum
  • Create custom role templates for your most common positions (VA, salesperson, account manager) so onboarding new hires takes minutes, not an hour of permission toggling
  • Always log in as the new user with a test account to verify exactly what they can and can't see before giving real access
  • Sub-account users are siloed to one client environment by default u2014 you must manually add someone to each sub-account they need
  • GoHighLevel does not charge per user seat, so there's no cost reason to share logins u2014 every team member should have their own account for accountability and audit trails
  • Deactivate departing team members rather than deleting their accounts, so you retain a history of their activity inside your client environments

🔍 In-Depth Guide

Agency-Level vs Sub-Account-Level Staff: Know the Difference Before You Click Anything

This is where most people get confused, and it costs them later. Agency-level users have access to your master dashboard u2014 they can see all your clients, manage billing, create new sub-accounts, and potentially view API keys. Sub-account-level users only exist inside one client's workspace. They can't jump between accounts unless you explicitly add them elsewhere.nnFor a typical agency setup, your operations manager might be an agency-level admin. Your VA who handles one client's inbox? Sub-account user only. A salesperson following up leads for a Dubai real estate client? Sub-account user with CRM access only u2014 no access to automations or settings.nnWhen I set up white-label agencies for my clients, I never give agency-level access to anyone who doesn't need to see pricing, Stripe data, or SaaS configuration. It's not about trust u2014 it's about minimizing risk. One wrong click in the agency dashboard can affect every client you have. Keep that list short.

Step-by-Step: Adding a Staff Member to a Sub-Account

Here's the exact process I walk through with every new agency I onboard:nn1. Log into GoHighLevel and navigate to the sub-account you want to add them to.n2. Go to Settings (bottom left gear icon), then click on Team.n3. Hit 'Add Employee' u2014 enter their name, email, and assign a role.n4. Choose between Admin, User, or create a custom role.n5. For custom roles, manually toggle permissions: CRM access, conversations, calendars, marketing, reporting, automation u2014 each can be turned on or off.n6. Save and they'll receive an email invite to set up their login.nnOne thing I always do: before adding a real team member, I create a test account with the exact permissions I plan to assign, then log in as that user to verify what they can and can't see. Takes five minutes and has saved me from awkward calls with clients more than once. Never assume the permissions work the way you think u2014 verify it.

Custom Roles and Permission Templates: Build Once, Scale Fast

If you're running an agency with more than three team members, you need role templates. GHL allows you to create custom roles under Agency Settings > Roles & Permissions. You define the exact access once, give the role a name (e.g., 'Client Success VA' or 'Ads Manager'), and then assign that role to any new user you add.nnFor real estate marketing agencies u2014 which is a big part of what I do in Dubai u2014 I typically create three roles: one for ISAs (Inside Sales Agents) who only need conversations and the calendar, one for marketing assistants who need funnel and email access but not billing, and one for account managers who get broader CRM and reporting access.nnThis matters especially when you're scaling. Hiring a fifth, sixth, seventh person should take minutes, not an hour of figuring out what permissions to toggle. Build your role library early. And when someone leaves your team, deactivating their account is one click u2014 no password changing, no worrying about who has what login. That's the kind of operational clarity that makes your agency actually scalable.

📚 Article Summary

Most agency owners I work with set up GoHighLevel, hand out admin access to everyone on their team, and wonder why things keep breaking. Wrong approach. Staff accounts in GHL exist for a reason — and getting your permission structure right from day one saves you from expensive mistakes, data leaks, and the chaos of someone accidentally deleting a client’s automation while trying to update a contact.Staff accounts let you add team members to your agency or sub-account with controlled access. You decide what they can see, what they can edit, and what’s completely off-limits. There are two main levels: agency-level users (who can access your dashboard, billing, and client sub-accounts) and sub-account-level users (who only work within one specific client’s environment). Getting this distinction right is the first thing I teach in my GoHighLevel courses.In my experience training agencies in Dubai and across the GCC, the most common mistake I see is giving a VA or junior team member full admin rights just because it’s faster. Three weeks later, someone’s changed a Twilio number, broken a workflow trigger, or worse — seen client revenue data they shouldn’t. GHL’s role-based permissions exist specifically to prevent this.The setup process itself is straightforward. From your agency dashboard, you go to Settings, then Team, and add a user with a defined role. For sub-accounts, you do the same from within that account’s settings. You can assign roles like Admin, User, or custom roles where you manually check each permission. I always recommend building a custom role template for common positions — one for VAs, one for salespeople, one for media buyers. Set it once, reuse it forever. That’s the kind of system thinking that separates a real agency from someone just using GHL as a fancy CRM.

❓ Frequently Asked Questions

Go to the sub-account settings, click Team, then Add Employee. When assigning a role, choose 'User' instead of 'Admin', or create a custom role where you manually select which features they can access u2014 such as CRM, conversations, or calendars only. This way they can do their job without seeing sensitive data like billing, API keys, or automation logic. Always test the account before handing it over.
Agency users are added at the master agency dashboard level and can access multiple sub-accounts, billing, SaaS settings, and API configurations. Sub-account users only exist within one specific client account. For most team members u2014 VAs, salespeople, media buyers u2014 sub-account access is all they need. Agency-level access should be reserved for owners and senior operations staff due to the scope of what it exposes.
Yes. GoHighLevel supports granular permissions through custom roles. You can enable or disable access to specific sections including contacts, pipelines, conversations, calendars, marketing tools, automation workflows, reporting, and settings. For example, a VA handling inbox replies needs Conversations turned on but has no reason to access Automations or Payment settings. Custom roles let you enforce that boundary without restricting their ability to work.
GoHighLevel does not cap the number of users you can add at the agency or sub-account level u2014 it's unlimited across all plans. This is one of the reasons I recommend GHL to agencies that are scaling, since other CRM platforms charge per seat. You can add your full team, contractors, and even client-side users without worrying about hitting a user limit or extra charges per person.
Navigate to Settings > Team within the relevant sub-account (or agency settings for agency-level users), find the user's name, and either deactivate or delete the account. Deactivating keeps their activity history intact while blocking access u2014 useful if you want a record of what they did. Deleting removes them entirely. I always deactivate rather than delete, especially for client-facing roles, so there's a traceable log if anything comes into question later.
Yes, but only if you explicitly add them to each sub-account individually, or if they have agency-level access. There is no automatic cross-account access for sub-account users. If you have an account manager handling three clients, you need to add them as a user inside each of those three sub-accounts separately. This is by design u2014 it keeps client data siloed, which is important both for data privacy and for maintaining professional boundaries between client environments.
📘

New Book by Sawan Kumar

Explore Premium Courses
Master AI, Data Engineering & Business Automation Learn more →

The AI-Proof Content Creator

Build an audience that follows YOU — not the tools you use.

Buy on Amazon →
Sawan Kumar

Written by

Sawan Kumar

I'm Sawan Kumar — I started my journey as a Chartered Accountant and evolved into a Techpreneur, Coach, and creator of the MADE EASY™ Framework.

Free Mini-Course

Want to master AI & Business Automation?

Get free access to step-by-step video lessons from Sawan Kumar. Join 55,000+ students already learning.

Start Free Course →

LEAVE A REPLY

Please enter your comment!
Please enter your name here