Epicor Kinetic: Menu Item Missing or Access Denied for a User
Epicor user cannot see menu item or program access denied
Also searched as
- Epicor menu option missing for user
- Epicor you do not have security rights to this program
- Epicor Kinetic user cannot open Job Entry
- Epicor security group menu access setup
Short answer
When an Epicor Kinetic user cannot see a menu item or gets an access denied message, the cause is nearly always security: the user's security group lacks access to that menu or program, the user is not linked to the company, the license or module is not available, or a menu customization hides the item. Check each in that order.
Applies to: Epicor Kinetic 2021.x to current and Epicor ERP 10.x; menu, security group and company access settings (screen names can vary by version)
Diagnose menu and program access
- 1Confirm the user is in the correct company. Log out and back in selecting the company, and check User Account Maintenance for the company list on the user.
- 2In User Account Maintenance, review the user's security group assignments and note whether they belong to the group that should own the program.
- 3Open Security Maintenance (or Menu Security Maintenance) and find the menu item. Check whether the group and the company have access granted.
- 4Check the parent menu folder too. If a folder is not granted, its child items are hidden even when the child has access.
- 5Check that a module or license is available. If the module is not licensed or enabled for the company, the menu item may not display at all.
- 6Look for a customized menu: Menu Maintenance may hide, move or rename an item on a user or group level.
- 7Ask the user to clear their local cache or refresh their client, then sign in again to rule out stale menu data.
- 8If the menu shows but the program refuses to open, check method security for the underlying business object, and any BPM directive that blocks access.
How Epicor decides what a user sees
Epicor layers several controls. First, the company: a user only sees what exists for companies they are linked to. Second, the menu itself, which is a tree of folders and programs, each with a security ID. Third, security groups that grant access to menu IDs. Fourth, per-method security on the business objects behind the screen. A failure at any level looks to the user like a missing or broken menu.
Because these are separate, the fix depends on where the symptom is. A missing menu item is a menu level issue. An item that is visible but throws an access error is almost always a business object or method level issue.
Menu hidden versus program denied
If the item does not appear at all, work through company, group, menu security and licensing. This is the frequent case when a new hire is cloned from a template user that lacks a group, or when a new module was added to the menu but nobody granted the group.
If the item appears and clicking it opens an error, note the exact wording. Messages about not having rights to a method or service point to business object security. A message from a custom rule points to a Method Directive or customization. The text decides where to look next, so capture it exactly.
Granting access without over-granting
Prefer giving the user a role based security group over editing individual rights. A group per job role, such as Production Planner or AP Clerk, keeps audits tractable and makes new hires a one-step setup.
Avoid granting everything to fix one complaint. Over-broad grants are how users end up able to release jobs, post invoices or edit master data they should not touch. Use the least access that works, record the reason in your change log, and test with the user's real account or an equivalent test user.
-- Read-only check: which security groups is a user in? (run on a reporting copy; table names vary by version) SELECT UserID, SecurityGroupID FROM Ice.UserSecGrp WHERE UserID = 'JSMITH';
Before and after: audit what changed
After any security change, test as the user, or have them test, from a fresh login. Confirm they can do the task and cannot do tasks outside their role. Keep a record of old and new group membership.
If menu problems reappear after an upgrade or a company copy, compare the menu and security data between environments. Imported menus can overwrite customizations, and copied companies may lack the company links the user had before.
Try it here, free
Epicor Kinetic User Access Request Form Template
A fill-in form for requesting, changing or removing Epicor user access, with security group, company and approval fields.
Common pitfalls
- !Granting a security group full access to make a complaint go away, and breaking segregation of duties.
- !Forgetting that a hidden parent folder hides every child item.
- !Fixing the symptom for one user and not the template or group, so the next hire has the same issue.
- !Ignoring method level security when the menu is visible but the program errors.
- !Testing as an administrator, who sees everything, and concluding it works.
How an ERP-grounded AI assistant handles this
An assistant grounded in your Epicor security configuration can answer who has access to a given program, show which group and company grants it, and explain why a particular user does not see it, all read-only and under the asker's own role. It does not edit security. A security administrator makes the change, and the assistant can draft the request with the exact group and menu ID.
Frequently asked questions
Why can a user see a program in Epicor but not open it?
The menu grants visibility, but the business object behind the screen enforces its own method security. A user can see Job Entry yet lack rights to a method it calls. Read the error text, then check the security group's method level rights for the named service, and any Method Directive that blocks the action.
How do I copy a user's security in Epicor?
Create the new account in User Account Maintenance and assign the same security groups and companies as the model user, or use a template user if your site has one. Review the result rather than copying blindly, because the model user may carry rights that were added for a one-off need.
Does an Epicor license affect menu visibility?
Yes. Menu items for modules the company is not licensed for, or has not enabled, may not appear regardless of security group. Check the licensed modules and company configuration before adjusting groups, especially after adding a new module or restoring to a different environment.
Where do I change which menu folder a program is in?
Use Menu Maintenance. Be careful, because a moved item keeps its security ID, so access follows the program, but the parent folder access still applies. Document changes and re-test with a non-administrator account after moving items.
Related
Fixing Epicor BusinessObjectException: BPM Directive Errors
A BusinessObjectException that says "A Business Process Management (BPM) directive has raised the following error" means a directive on that business object stopped the transaction, either deliberately via a Raise Exception widget or accidentally via an unhandled .NET error in Custom Code. Expand the InnerException on the error dialog to see the real message and the directive name, then open BPM Designer for that object and method to find the widget that fired.
Error fixFixing Epicor REST v2 API 401 Unauthorized Errors
A 401 Unauthorized calling Epicor's REST v2 (api/v2/odata) endpoint almost always comes down to one of three things: a missing or wrong x-api-key header, valid credentials but an API key scoped to a different company than the one in the URL, or REST services simply not enabled for that endpoint. Confirm the API key exists and is active in Application Studio (or the classic REST API help page), matches the company segment in the URL, and that the account used for Basic auth or OAuth has the right security group.
AdvancedEpicor Application Studio: understanding customization layers
Kinetic UI is built in layers loaded in order - Base (Epicor-delivered), Customization (Application Studio, company/layer-wide), Personalization (user- or role-specific, applied on top), and optionally Extended (packaged add-on layers) - and a change you make will not appear if a higher layer overrides the same control or if you are testing in the wrong layer context.
How-toHow to Create a BPM Method Directive in Epicor Kinetic
In Epicor Kinetic, open Business Process Management > Method Directive Maintenance (the BPM Workbench), pick the business object and method, choose Pre-Processing, Base Processing or Post-Processing, then add a condition and actions such as Show Message or Set Field. Enable it and test in a pilot company before production.
How-toFixing a Slow Epicor BAQ (Business Activity Query)
A slow BAQ in Epicor is usually caused by unindexed join columns, a subquery or calculated field forcing a table scan, or the BAQ pulling far more rows than the dashboard actually displays before filtering client-side. Fix it by reading the SQL Server execution plan Epicor generates, moving filters into the BAQ criteria instead of the dashboard filter panel, and replacing subqueries with joins where possible.
How-toEpicor MRP Runs but Generates No Suggestions
When Epicor's MRP process completes without a job or purchase suggestion for a part you expect one for, the cause is almost always the part's own configuration (Part Class Type, Make Direct, Non-MRP flag, planning Time Fence) or the demand not being linked in a way MRP recognizes, not a defect in the MRP engine. Work through the part's Planning tab, its safety stock and lead time setup, and the demand source (sales order line status, job material requirement) before assuming the run itself failed.
AI for ERPAI for Epicor Kinetic, Beyond What Prism Covers
Add AI to Epicor Kinetic beyond Prism: private LLM over BAQs, BPM data, and REST v2, on-prem or private cloud, with honest guidance on when Prism already covers you.
AI for ERPPrivate AI for Epicor Kinetic Cloud, Outside the Multi-Tenant Boundary
Run a private LLM on Epicor Kinetic private cloud or Kinetic Cloud data via BAQs, REST v2 and Data Fabric, keeping sensitive manufacturing data off shared AI.
Stuck on Epicor Kinetic?
Talk to engineers who work inside Epicor Kinetic every week, and who build private AI that answers these questions from your own ERP data.
New to Epicor ERP? Start with the Epicor ERP guide and toolkit, or plan with Training Path Builder, ERP Certification Study Planner, Upgrade Path Planner.
Keep exploring
Free tools
- Epicor Kinetic User Access Request Form TemplateA fill-in form for requesting, changing or removing Epicor user access, with security group, company and approval fields.
- Epicor Security Group Design WorksheetAn editable worksheet to plan security groups by role and score each for exposure, so over-broad access is visible before audit.
- Epicor Kinetic Private AI Layer Blueprint GeneratorGenerate a shareable private AI architecture plan for Epicor Kinetic on-premises, with components, security controls, rollout phases and open questions for IT.
ERP fixes and how-tos
- Epicor: No Employee Attached to User, Supplier Not Approved, Serial Mask TokensFix the Epicor error no employee attached to user, plus supplier not approved for operation and serial mask token setup, and where to look in Kinetic.
- Epicor Kinetic UD Tables and UD Fields: Setup, Studio Binding, BAQ and SecurityHow to create and use UD tables and UD fields in Epicor Kinetic: setup, binding in Application Studio, reading them in a BAQ, and securing access.
- How to Create a BPM Method Directive in Epicor KineticHow to build a Method Directive in Epicor Kinetic: choose the business object method, pre or post processing, add conditions and actions, test, and deploy safely.
AI on your ERP
- Private AI for Epicor Kinetic Cloud, Outside the Multi-Tenant BoundaryRun a private LLM on Epicor Kinetic private cloud or Kinetic Cloud data via BAQs, REST v2 and Data Fabric, keeping sensitive manufacturing data off shared AI.
- AI for Epicor Kinetic Job Shops: Quote History, Job Variance and Schedule RiskPrivate AI for Epicor Kinetic job shops: quote-to-job history, JobHead and JobOper variance, subcontract delays and schedule risk, via REST and BAQs.
Integrations
- How to use ChatGPT with Epicor KineticConnect ChatGPT to Epicor Kinetic through a custom GPT with Actions, an exported dataset, or a private gateway. Covers BAQs, auth, data controls and when to go private.
- How to add AI agents to Epicor KineticHow to add AI agents to Epicor Kinetic: a tool layer over the REST v2 API and BAQs, MRP exception triage, PO expediting, and human approval before any write.
Software
- Epicor KineticEpicor Kinetic explained for manufacturers: modules, REST API, BAQs, deployment, strengths, limits and alternatives to compare before choosing or upgrading.
- Epicor CPQEpicor CPQ is a cloud configure-price-quote product with visual 3D configuration for manufacturers. Modules, ERP integrations and alternatives explained.