Verified on release 3.4.5.21 "Trade Management for Kazakhstan" (edition 3.4).
A partner calls and says: "I logged into my personal account, but I don't see my orders — it's empty." Or the opposite: a counterparty's manager opens the database via the web and sees documents belonging to other companies, which shouldn't happen. You go into the settings, and it seems the user has "no rights at all." The secret is that external users are not granted rights one by one, but through groups. Until you add a person to the appropriate external users group, they either see nothing or see too much. This reference guide is exactly about who to group and where, so that each partner sees exactly what belongs to them.
1. Purpose
The "External Users Groups" catalog combines external users (counterparties, individuals, partners working through the web client or personal account) into groups, so that access rights can be assigned in bulk rather than individually. Rights are assigned to a group through access profiles and access groups, and membership in the group determines who receives these rights. This is an administrative (service) catalog — it is not about money or taxes, but about who sees what in the database.
2. Where to find it
Menu path:
Master Data and Administration → User and Rights Settings → External Users — this opens the list of external users. Groups are displayed as folders on the left or via the "External Users Groups" command on the list panel.
If the section is not visible — enable working with external users: Master Data and Administration → User and Rights Settings → "External Users" checkbox. Without this checkbox, neither the catalog nor personal accounts work.
A quick way to open the catalog directly in 1C: Main Menu → File → no; the correct way is via "Service → Show Navigation Link", insert:
e1cib/list/Catalog.ExternalUsersGroups
and click "Go". The list of groups will open immediately, bypassing the menu.
2a. How to find your release
Main Menu (≡ icon or "Help") → About the program. In the window that opens:
- Platform version (e.g., 8.3.24.xxxx) — this is the 1C engine;
- Configuration: Trade Management for Kazakhstan, edition 3.4, version 3.4.5.21 — this is the application solution.
The instructions below apply to release 3.4.5.21. If you have a different one — the field layout may differ slightly, but the logic is the same.
3. How to fill it in
Open the catalog → "Create". A group card appears. Let's go through each field.
| Field | Required | Why it's needed and what happens if it's wrong |
|---|---|---|
| Name | Yes | The group name you will search for when granting rights. Write it meaningfully: "Customers — Personal Account," "Dealers," "Individual Customers." If you name it "Group1" — a month later you won't remember who it grants access to, and you'll assign rights to the wrong people. |
| Belongs to Group (Parent) | No | The catalog is hierarchical. The parent allows you to build a tree: for example, keep "Retail" and "Wholesale" inside "Customers." It affects rights indirectly — convenient for navigation and bulk operations. |
| Group Composition (toggle) | Yes, essentially | The key field. Two options: "Specified users" — you manually build the list; "All users authorized through …" — membership is determined automatically by the type of authorization object (all Counterparties or all Individuals). Get this wrong, and you'll either have to manually add every new partner (forget, and they'll see nothing), or accidentally open access to everyone at once. |
| Authorization Object Type | Only for auto-group | Appears if you selected "All users authorized through …". Choose Counterparties or Individuals. Then any new external user of this type joins the group automatically. |
| Composition (member table) | For manual group | List of specific external users. Button "Select" / "Add". Empty composition = the group has rights, but no one to receive them. |
| Comment | No | Free-form note: what the group is for, who maintains it. Doesn't affect access, but helps when handing over the database. |
Rights as such are not set in this card. They are granted separately: Master Data and Administration → User and Rights Settings → Access Groups (or access group profiles), where you specify the external users group as a member and attach a profile to it (a set of roles and restrictions by organizations/partners).
4. Worked example
Situation. Three of your wholesale customers need to log into the database themselves via the web and see only their own orders and mutual settlements. Separately, one private client (an individual) needs to see their personal account.
Step 1. Create a group for wholesalers.
- Name:
Wholesale Customers — Personal Account - Group composition: Specified users
- In the "Composition" table, select three external users: TOO "Astana-Trade," TOO "Karavan," IP "Satybaldy."
- Save the record.
Step 2. Create a group for individuals automatically.
- Name:
Individual Customers - Group composition: All users authorized through → Individuals
- Save the record. Now any new individual external user joins this group automatically.
Step 3. Grant rights. Go to Access Groups, create an access group "Customer Cabinet," profile — "External User (orders)," members — both groups created above. In the restrictions, specify access by your own organization.
What you got. TOO "Astana-Trade" logs in via the web and sees the Customer Order document and the Reconciliation Statement only for itself — amounts in tenge (₸), for example, an order for 1,740,000 ₸ with 16% VAT (240,000 ₸ tax included). Data on orders from other customers is not accessible to them.
About postings — honestly. This catalog is a service object; it does not generate accounting postings. No entries like Dt 1210 Kt 6010 arise when a group is recorded: money, VAT, and cost of goods move in sales documents (Sales, Customer Order), while the group only determines who sees those documents. So expecting Dt/Kt entries here is a mistaken expectation: this is about access, not accounting.
5. "Transaction Types" — what the catalog provides
The catalog has no transaction types like a document does. In practice, it works in two membership modes:
- Group with manual composition — you maintain the list of members yourself. Suitable for targeted access assignment (specific dealers).
- Group with auto-composition by authorization object type — membership is calculated by the rule "all counterparties" or "all individuals." Suitable for mass uniform access.
Plus the predefined group "All External Users" — it includes absolutely all external users; it's convenient to use for basic rights available to everyone (e.g., logging into the account).
6. What is generated upon recording
When a group is recorded, movements in the information registers of the "Users" subsystem are generated, not postings:
- an entry in the external user group composition register — who belongs to the group (for an auto-group, the composition is recalculated according to the rule);
- updating service access rights registers, when the group is linked to an access group/profile — based on these, the platform decides what to show the user upon login.
What is not generated:
- postings under the Kazakhstan chart of accounts (1210, 1030, 3130, 6010, etc.) — there are none;
- ESF in the ESF IS and SNT — electronic documents are issued from sales/transfer documents, not from the access catalog;
- movements in cost of goods, VAT, or mutual settlements registers.
Simply put: the catalog changes the visibility of data, not the data itself.
7. Printed forms
The catalog has no printed forms of its own — this is normal for a service object. Indirectly, group data appears in the service report "Access Rights" and in the report on external users (who belongs to which groups and what rights they have), which is opened from the external user's card or from the rights settings. There's no point in printing a "group" as an act or invoice, and no such form is provided.
8. Common mistakes
"Insufficient rights to perform the operation on the object" / "Access rights violation." The external user exists, but has not been added to a group, or the group has not been assigned a profile. Check: the user is a member of the required group → the group has been added as a member of an Access Group → the access group has a correct profile selected.
A partner sees other people's orders. You added them to the "All Counterparties" auto-group with a broad profile without restriction by partner/organization. Remove them from the broad group or configure access restriction by values (by their own partner) in the access group.
"The 'Name' field is not filled in." Empty group name — fill it in meaningfully, not "New Group."
A new partner has been created but cannot log in. You created a group with manual composition and forgot to add the new user to it. Either add them manually or use an auto-group by authorization object type.
The "External Users" section has disappeared from the menu. The Master Data and Administration → User and Rights Settings → External Users checkbox has been unchecked. Enable it (administrator rights required).
Cannot delete the group. It is used in an access group, or there are users in its composition. First remove it from access groups and clear the composition, then mark it for deletion.
9. FAQ
(see block below)
10. Related objects
- What it is based on: External Users (the "External Users" catalog) must already exist, linked to an authorization object — a Counterparty or an Individual. The group combines already created external users.
- What is configured next: Access Groups and Access Group Profiles — it is there that roles and restrictions are assigned to the group. Without this link, the group grants no rights.
- What it works with in practice: the documents that the external user will see in their account — Customer Order, Sales of Goods and Services, Reconciliation Statement. These documents themselves generate postings, ESF, and SNT; the group only opens access to them.
How to find your release: Main Menu → Help → About the program → line "Trade Management for Kazakhstan, edition 3.4, version 3.4.5.21" and platform version 8.3.
Guide prepared for release 3.4.5.21 "Trade Management for Kazakhstan" (edition 3.4).