Magento 2 Admin ACL Access Control Lists

Magento 2 admin panel use an authentication system and a robust system for create Access Control List Rules (ACL) which allows a store owner to create fine grained roles for each and every user in their system. In this article, we will find how it work and how to add ACL for our custom module.

Magento 2 Access Control List Rules

The Magento 2 Admin ACL resources are visible under the Magento 2 admin System > Permissions > User Roles area. When we click on the Add New Role button or access to a role, you will see the page look like:

magento 2 admin acl

In this resources tab, you can see a tree-list of all the available resources in your system. You can choose all Resource or some of them for this role and select the user for this role in Role Users tab. All of the user who belong to this role will be limit access to the resource which you choose. They cannot see and access to other one.

Create ACL rule

Now, we will see how to add our module to ACL role. We will use a previous simple module Hello World to do this. As in the Admin Menu and System Configuration article, you saw that we alway have a resource attribute when create it. Now we will register that resources to the system, so Magento can realize and let us set a role for them. To register the resource, we use the acl.xml file which located in {module_root}/etc/acl.xml. Let’s create this file for our simple Module:

File: app/code/Mageplaza/HelloWorld/etc/acl.xml

<?xml version="1.0"?>
<config xmlns:xsi="" xsi:noNamespaceSchemaLocation="urn:magento:framework:Acl/etc/acl.xsd">
            <resource id="Magento_Backend::admin">
                <resource id="Mageplaza_HelloWorld::hello" title="Hello World" sortOrder="10" >
                    <resource id="Mageplaza_HelloWorld::hello_manage_items" title="Manage Items" sortOrder="0" />
                    <resource id="Mageplaza_HelloWorld::hello_configuration" title="Configuration" sortOrder="100" />

Our resource will be placed as child of Magento_Backend::admin. Each resource will have an Id, title and sortOrder attribute:

  • Id attribute is the identify of this resource. You can use this when define resource in Admin menu, configuration and limit access to your module controller. This is a unique string and should be in this format: Vendor_ModuleName::resource_name.
  • Title attribute is the label of this resource when showing in resource tree.
  • sortOrder attribute define the position of this resource in tree.

After this done, please refresh the cache and see the result on resource tree

magento 2 admin acl

Checking ACL rule

There are some place where we put the ACL resource to make it limit the access:

Admin menu: Put the ACL resource to hide the menu if it’s not allowed by store owner.

File: app/code/Mageplaza/HelloWorld/etc/adminhtml/menu.xml

<add id="Mageplaza_HelloWorld::hello" title="Hello World" module="Mageplaza_HelloWorld" sortOrder="50" resource="Mageplaza_HelloWorld::hello"/>

System configuration: Put the ACL resource to limit access to this section page.

File: app/code/Mageplaza/HelloWorld/etc/adminhtml/system.xml

<section id="hello" translate="label" sortOrder="130" showInDefault="1" showInWebsite="1" showInStore="1">

Admin controllers: Magento provides an abstract type Magento\Framework\AuthorizationInterface which you can use to validate the currently logged in user against a specific ACL. You can call that object by use the variable: $this->_authorization. In the controller, you have to write a protected function to check the resource:

File: vendor/magento/module-customer/Controller/Adminhtml/Index.php

protected function _isAllowed()
 return $this->_authorization->isAllowed('Magento_Customer::manage');

Enjoyed the tutorial? Spread it to your friends!


Comments for Magento 2 Admin ACL Access Control Lists

Please leave comments if you have any questions, feedbacks.

You also may like these Magento 2 Extensions

One Step Checkout

10 reviews

Layered Navigation

12 reviews


6 reviews


3 reviews


10 reviews

Store Locator

1 review

Shop By Brand

no review

Better Blog

8 reviews