Epicor Kinetic: Menu Item Missing or Access Denied for a User
Epicor user cannot see menu item or program access denied
Also searched as
- Epicor menu option missing for user
- Epicor you do not have security rights to this program
- Epicor Kinetic user cannot open Job Entry
- Epicor security group menu access setup
Short answer
When an Epicor Kinetic user cannot see a menu item or gets an access denied message, the cause is nearly always security: the user's security group lacks access to that menu or program, the user is not linked to the company, the license or module is not available, or a menu customization hides the item. Check each in that order.
Applies to: Epicor Kinetic 2021.x to current and Epicor ERP 10.x; menu, security group and company access settings (screen names can vary by version)
Diagnose menu and program access
- 1Confirm the user is in the correct company. Log out and back in selecting the company, and check User Account Maintenance for the company list on the user.
- 2In User Account Maintenance, review the user's security group assignments and note whether they belong to the group that should own the program.
- 3Open Security Maintenance (or Menu Security Maintenance) and find the menu item. Check whether the group and the company have access granted.
- 4Check the parent menu folder too. If a folder is not granted, its child items are hidden even when the child has access.
- 5Check that a module or license is available. If the module is not licensed or enabled for the company, the menu item may not display at all.
- 6Look for a customized menu: Menu Maintenance may hide, move or rename an item on a user or group level.
- 7Ask the user to clear their local cache or refresh their client, then sign in again to rule out stale menu data.
- 8If the menu shows but the program refuses to open, check method security for the underlying business object, and any BPM directive that blocks access.
How Epicor decides what a user sees
Epicor layers several controls. First, the company: a user only sees what exists for companies they are linked to. Second, the menu itself, which is a tree of folders and programs, each with a security ID. Third, security groups that grant access to menu IDs. Fourth, per-method security on the business objects behind the screen. A failure at any level looks to the user like a missing or broken menu.
Because these are separate, the fix depends on where the symptom is. A missing menu item is a menu level issue. An item that is visible but throws an access error is almost always a business object or method level issue.
Menu hidden versus program denied
If the item does not appear at all, work through company, group, menu security and licensing. This is the frequent case when a new hire is cloned from a template user that lacks a group, or when a new module was added to the menu but nobody granted the group.
If the item appears and clicking it opens an error, note the exact wording. Messages about not having rights to a method or service point to business object security. A message from a custom rule points to a Method Directive or customization. The text decides where to look next, so capture it exactly.
Granting access without over-granting
Prefer giving the user a role based security group over editing individual rights. A group per job role, such as Production Planner or AP Clerk, keeps audits tractable and makes new hires a one-step setup.
Avoid granting everything to fix one complaint. Over-broad grants are how users end up able to release jobs, post invoices or edit master data they should not touch. Use the least access that works, record the reason in your change log, and test with the user's real account or an equivalent test user.
-- Read-only check: which security groups is a user in? (run on a reporting copy; table names vary by version) SELECT UserID, SecurityGroupID FROM Ice.UserSecGrp WHERE UserID = 'JSMITH';
Before and after: audit what changed
After any security change, test as the user, or have them test, from a fresh login. Confirm they can do the task and cannot do tasks outside their role. Keep a record of old and new group membership.
If menu problems reappear after an upgrade or a company copy, compare the menu and security data between environments. Imported menus can overwrite customizations, and copied companies may lack the company links the user had before.
Common pitfalls
- !Granting a security group full access to make a complaint go away, and breaking segregation of duties.
- !Forgetting that a hidden parent folder hides every child item.
- !Fixing the symptom for one user and not the template or group, so the next hire has the same issue.
- !Ignoring method level security when the menu is visible but the program errors.
- !Testing as an administrator, who sees everything, and concluding it works.
How an ERP-grounded AI assistant handles this
An assistant grounded in your Epicor security configuration can answer who has access to a given program, show which group and company grants it, and explain why a particular user does not see it, all read-only and under the asker's own role. It does not edit security. A security administrator makes the change, and the assistant can draft the request with the exact group and menu ID.
Frequently asked questions
Why can a user see a program in Epicor but not open it?
The menu grants visibility, but the business object behind the screen enforces its own method security. A user can see Job Entry yet lack rights to a method it calls. Read the error text, then check the security group's method level rights for the named service, and any Method Directive that blocks the action.
How do I copy a user's security in Epicor?
Create the new account in User Account Maintenance and assign the same security groups and companies as the model user, or use a template user if your site has one. Review the result rather than copying blindly, because the model user may carry rights that were added for a one-off need.
Does an Epicor license affect menu visibility?
Yes. Menu items for modules the company is not licensed for, or has not enabled, may not appear regardless of security group. Check the licensed modules and company configuration before adjusting groups, especially after adding a new module or restoring to a different environment.
Where do I change which menu folder a program is in?
Use Menu Maintenance. Be careful, because a moved item keeps its security ID, so access follows the program, but the parent folder access still applies. Document changes and re-test with a non-administrator account after moving items.
Related
Fixing Epicor BusinessObjectException: BPM Directive Errors
A BusinessObjectException that says "A Business Process Management (BPM) directive has raised the following error" means a directive on that business object stopped the transaction, either deliberately via a Raise Exception widget or accidentally via an unhandled .NET error in Custom Code. Expand the InnerException on the error dialog to see the real message and the directive name, then open BPM Designer for that object and method to find the widget that fired.
Error fixFixing Epicor REST v2 API 401 Unauthorized Errors
A 401 Unauthorized calling Epicor's REST v2 (api/v2/odata) endpoint almost always comes down to one of three things: a missing or wrong x-api-key header, valid credentials but an API key scoped to a different company than the one in the URL, or REST services simply not enabled for that endpoint. Confirm the API key exists and is active in Application Studio (or the classic REST API help page), matches the company segment in the URL, and that the account used for Basic auth or OAuth has the right security group.
AdvancedEpicor Application Studio: understanding customization layers
Kinetic UI is built in layers loaded in order - Base (Epicor-delivered), Customization (Application Studio, company/layer-wide), Personalization (user- or role-specific, applied on top), and optionally Extended (packaged add-on layers) - and a change you make will not appear if a higher layer overrides the same control or if you are testing in the wrong layer context.
How-toHow to Create a BPM Method Directive in Epicor Kinetic
In Epicor Kinetic, open Business Process Management > Method Directive Maintenance (the BPM Workbench), pick the business object and method, choose Pre-Processing, Base Processing or Post-Processing, then add a condition and actions such as Show Message or Set Field. Enable it and test in a pilot company before production.
How-toFixing a Slow Epicor BAQ (Business Activity Query)
A slow BAQ in Epicor is usually caused by unindexed join columns, a subquery or calculated field forcing a table scan, or the BAQ pulling far more rows than the dashboard actually displays before filtering client-side. Fix it by reading the SQL Server execution plan Epicor generates, moving filters into the BAQ criteria instead of the dashboard filter panel, and replacing subqueries with joins where possible.
How-toEpicor MRP Runs but Generates No Suggestions
When Epicor's MRP process completes without a job or purchase suggestion for a part you expect one for, the cause is almost always the part's own configuration (Part Class Type, Make Direct, Non-MRP flag, planning Time Fence) or the demand not being linked in a way MRP recognizes, not a defect in the MRP engine. Work through the part's Planning tab, its safety stock and lead time setup, and the demand source (sales order line status, job material requirement) before assuming the run itself failed.
AI for ERPAI for Epicor Kinetic, Beyond What Prism Covers
Add AI to Epicor Kinetic beyond Prism: private LLM over BAQs, BPM data, and REST v2, on-prem or private cloud, with honest guidance on when Prism already covers you.
AI for ERPPrivate AI for Epicor Kinetic Cloud, Outside the Multi-Tenant Boundary
Ground a private LLM on Epicor Kinetic Cloud via BAQs, REST v2, and Data Fabric so sensitive manufacturing data never enters a multi-tenant AI feature.
Stuck on Epicor Kinetic?
Talk to engineers who work inside Epicor Kinetic every week, and who build private AI that answers these questions from your own ERP data.