User Roles

Last updated: October 26, 2026

xltrail differentiates between two roles:

• User
• Admin

User Role

A user has the following rights:

• Users can add new projects (both drag-and-drop and Git integrations). Note that by default, project are visible within an organization. To restrict access rights, you need to have the admin role, see below.
• Users can add new Excel files and new versions of existing files for projects they have been granted access to.

Admin Role

An admin can do everything a user can do. Additionally, they can access the Settings page by clicking on the user icon on the top right. From there, they can:

• Delete and resync projects.
• Remove users (which frees their seat).
• They can change permissions, i.e. restrict projects to certain users or groups only.

For more details, see Settings.

Where roles come from

Users sign in through your organization’s identity provider (IdP), and the role comes from the IdP: a user is an admin if their token carries the configured admin claim (for example the Microsoft Entra ID app role xltrail-admin). It is evaluated at every sign-in and cannot be changed inside xltrail. To grant or revoke admin rights, change the user’s assignment in the IdP and ask them to sign in again.

Since version 4.4.0 there is no built-in admin system account and no password login. On self-hosted installations, the admin claim is configured with OIDC_ADMIN_CLAIM / OIDC_ADMIN_VALUE, and administrators can be listed with the server command python manage.py users list --admins, see Authentication (OIDC).