Short answer: Standard Odoo hides menus and fields only by security group, and hiding a button or tab means editing XML views. To hide a field, menu, button or tab from one user or group without code, install User Access Rights Pro by Vayasoft. Turn on Restrict Mode, point at the element on the real screen, choose Hide, Read-only or Required, and press Publish. It works on Odoo 17, 18 and 19, Community and Enterprise.
What can standard Odoo hide on its own?
Odoo’s access rights are built around security groups. That works for broad roles, but it gets awkward the moment one person needs a slightly different screen.
- Menus and apps can be hidden by group only. A user either sees the whole menu or doesn’t.
- Which records a user sees is controlled by record rules, which are domains written in XML or developer mode.
- A single field can be limited to a group in the view definition, which changes it for everyone in or out of that group.
- Buttons and notebook tabs can’t be hidden per user without changing views.
- Odoo Studio edits a view for everyone, not for one user.
Standard Odoo vs. User Access Rights Pro
| What you need to do | Standard Odoo | User Access Rights Pro |
|---|---|---|
| Hide a menu or a whole app from one person | Group only, all or nothing | Per user or group |
| Limit which records a user can see | Record rules, written in XML | Point and click |
| Stop someone creating or deleting records | Per group, via access rights | Per user or group, enforced on the server |
| Block export or import for one person | One global group, everywhere | Per model |
| Hide a single field from one person | Group on the field itself | Per user or group |
| Make a field read-only or required for one person | Not supported | Yes, with conditions |
| Hide a button or a notebook tab | Not supported | Per user or group |
| Turn off parts of the chatter | Not supported | Four parts |
| Keep developer mode away from non-admins | Not supported | Always on |
| See exactly what a user sees | Not supported | Log In As, with an audit trail |
How do I hide a field from one user in Odoo?
- Install User Access Rights Pro from the Odoo App Store.
- As an administrator, turn on Restrict Mode.
- Hover over the field, button, tab, menu or chatter. Click the badge that appears.
- Choose Hide, Read-only, Required or Exclude from export. Pick the user or group, and the company if you run several.
- Press Publish. Until then the change is a draft that only you can see, and you can undo one item without undoing the rest.
- Use Log In As to check the screen exactly as that user sees it. Odoo asks for a reason, and the session is stamped on the record’s chatter.
Is hiding a field the same as securing it?
No, and it’s worth knowing the difference. The app works at two levels:
- Server-enforced: blocking create and delete, domain-based record scoping, archive, export and import blocking, and the developer-mode lock. These block even a direct API call.
- Interface-level: hiding menus, fields, buttons, tabs, chatter and search filters. This is the same layer Odoo itself uses for visibility.
For data that must never leave the system, use record scoping and export blocking, not just a hidden field. The app’s Security Inspection helps here. It runs 13 checks on your real groups and rules, including a security score, permission-path tracing, a 2FA check, dormant admin and orphan user detection, duplicate groups and record-rule conflicts.
Who uses it?
- Sales managers who want reps to stop seeing margins, costs or expected revenue.
- Finance teams who need a field to be read-only for everyone outside accounts.
- Multi-company groups where each company’s users should see only their own records.
- Odoo partners who set up access for clients and want to skip writing XML.
Frequently asked questions
Does User Access Rights Pro work on Odoo Community?
Yes. It works on Odoo 17, 18 and 19, in both Community and Enterprise.
Do I need developer mode or XML?
No. Every rule is created by pointing at the real screen in Restrict Mode, and it ends up as a normal Odoo rule.
Can I lock myself out?
Yes, if you restrict a group you belong to. Keep one administrator account untouched as a fallback.
Is there a free version?
Yes. CRM Access Rights is free and offers the same point-and-click approach for the CRM app only.
Can a user still reach a hidden field another way?
Hiding a field works at the interface level, like Odoo’s own visibility settings. For sensitive data, combine it with the server-enforced options: record scoping, export blocking and create or delete blocking.
Talk to Vayasoft
Not sure who can see what in your Odoo? Book a free 30-minute Odoo access and security review with Vayasoft. We’ll run through your groups, record rules and 2FA status and send you a short written report.
Links: User Access Rights Pro on the Odoo App Store · User Access Rights Pro product page
About Vayasoft: Vayasoft is an official Odoo Ready Partner based in India. We build Odoo apps and implement, upgrade and support Odoo for trading, manufacturing, solar EPC, retail and healthcare businesses.