--- title: "External Users\" Directory in UT for Kazakhstan 3.4: How to Create and Configure Access for a Counterparty" country: KZ lang: en author: Сапа Т.И. (https://buhgpt.kz/authors/sapa-ti) date: 2026-09-24 canonical: https://buhgpt.kz/suraqtar/spravochnik-vneshnie-polzovateli-v-ut-dlya-kazahstana-3-4-en source: BuhGPT --- # External Users" Directory in UT for Kazakhstan 3.4: How to Create and Configure Access for a Counterparty > **TL;DR:** Verified on release 3.4.5.21 "Trade Management for Kazakhstan" (edition 3.4). Straight to the point: when you end up here A partner calls and asks: "Give us access so we can see our own orders and mutual settlements without bothering you every time." Or a manager says: "Let ou --- Verified on release 3.4.5.21 "Trade Management for Kazakhstan" (edition 3.4). Straight to the point: when you end up here A partner calls and asks: "Give us access so we can see our own orders and mutual settlements without bothering you every time." Or a manager says: "Let our client view stock and prices through a browser themselves." You open 1C — and realize that regular users from the "Users" catalog won't work for this: those are your employees, and they have full access to your database. You need an external user — a person "outside" the company to whom you grant access strictly to their own data. This is where the "External Users" catalog comes in. It's not a document or a posting — it's an account card for someone who is not your employee but needs to log into the database (via web client, thin client, or a service). Important to understand right away. This is a service (technical) object. It does not generate accounting entries, does not produce ESF or SNT (electronic invoices or waybills), and does not participate in the calculation of VAT, individual income tax, mandatory pension contributions, or other taxes. Kazakhstan rates and accounts have nothing to do with it — the object is only responsible for who logs into the program and with what rights. That's why the sections on postings and electronic documents below are honestly marked as not applicable. 1. Purpose The catalog stores accounts of people and organizations outside your staff to whom you grant access to the information base. Each external user is linked to an "authorization object" (counterparty, partner, or individual) and sees only what you've allowed via the access profile. It's used to organize client/partner self-service and secure external access. 2. Where to find it External users are disabled by default — you must first enable the mechanism. - Section "Master data and administration" → "User and rights settings". - Expand the "External users" group and check the "External users" flag. - A link command "External users" will appear below — it opens the list itself. You can also open the list directly via a navigation link. Menu "Tools and settings" → "Functions for technical specialist… → Go to navigation link" (or the link input field), paste: e1cib/list/Справочник.ВнешниеПользователи If the "External users" item is inactive in the settings, you don't have administrative rights — contact someone who has the administrator role. 2a. How to find out your release "Help" → "About the program" (or the "i" icon in the top right corner). In the window that opens: - Platform version — for example, 8.3.24.xxxx; - Configuration — "Trade Management for Kazakhstan", edition 3.4, release 3.4.5.21. Mention these numbers to support — they show which version the instructions apply to. 3. How to fill it in Click "Create". The external user card is divided into logical blocks. "Main" block Field Purpose and what happens if it's wrong Authorization object — required Key field. Specifies who this person is in your database: Counterparty, Partner, or Individual. It is to this that the "see only their own" rights will be tied. If left blank — the record won't save. If you pick the wrong counterparty — the user will see someone else's mutual settlements. One authorization object = one external user (the system won't let you reuse the same counterparty). Full name — required How the user is displayed in lists and the login log. Filled automatically from the authorization object but can be edited. Don't leave it blank — otherwise the logs won't show clearly who logged in. Invalid A "block without deleting" flag. Set it when access needs to be closed (the contract ended) but the login history should be kept. With the flag set, the person cannot log in. This is the correct alternative to deletion. "Login to the program" block Field Purpose and what happens if it's wrong Login to the program is allowed Until this flag is set, the card exists but login is not possible. Uncheck the flag to temporarily disable login without touching other settings. Name (for login) — required if login is allowed Login in Latin characters. Must be unique among all users (both internal and external). The program won't allow a match with an existing login. 1C:Enterprise authentication Password login. This is where you set/change the password. If a password complexity policy is in effect, a simple password won't be accepted. Be sure to send the password to the client via a secure channel. Require password setup at login The user logs in with a temporary password and immediately sets their own. Convenient and secure for initial issuance. OpenID / OpenID-Connect authentication Login via an external identity provider (single sign-on). Enable only if such a service is configured, otherwise the person won't be able to log in. Login by username and password allowed (for web) Allows login to the database published on a web server. Needed for browser access. Show in selection list Whether to show the login in the selection window at startup. For external users, this is usually unchecked — so outsiders can't see the list of accounts. "Access rights" block Field Purpose and what happens if it's wrong Access groups / Profile — effectively required Defines what the user can do and see. Without an assigned access group, the person will be able to log in but won't see anything useful (or will get a rights error). For external users, choose a profile with limited rights — for example, viewing only their own orders and mutual settlements. "Contact information" block Email and phone — so you have somewhere to send the login/password and someone to contact. They don't affect postings or access, but without an email you can't send an invitation or reset the password automatically. External user groups On the left of the list is a hierarchy of external user groups. A group is convenient when there are many users: you assign rights once to the group instead of to each person individually. One user can belong to several groups. After filling in — "Save and close". 4. Worked example Task. Counterparty LLP "Bereke-Logistics" asks for access so their manager can view their own orders and reconciliation report. You grant login access only to view their own data. Steps: - Master data and administration → User and rights settings → the "External users" flag is already enabled → open the list. - "Create" → Authorization object = Counterparty "Bereke-Logistics" → Full name is auto-filled: "Bereke-Logistics". - Check "Login to the program is allowed", Name (for login) = bereke_manager. - 1C:Enterprise authentication → set a temporary password, check "Require password setup at login". - Uncheck "Show in selection list", check "Login by username and password allowed" (browser access). - Access group = profile "External user: own orders only" (limited). - Manager's Email = manager@bereke.kz. - Save and close. What you get: the counterparty's manager logs in via a browser with their own login, changes the password at first login, and sees only the orders and mutual settlements of LLP "Bereke-Logistics" — they don't see anyone else's amounts, cost of goods (account 7010), money in bank accounts (1030), or your accounts payable to suppliers (3310). About postings. There are none. Creating an external user is an access configuration action, not a business transaction. Neither account 1210, nor 6010, nor 3130 is affected when this card is saved, and 16% VAT is not calculated. If you need a document with postings, that would be "Sales of goods and services," "Receipt…," "Write-off from bank account," etc., but not this catalog. 5. "Operation types" (types of authorization object) The catalog has no separate "Operation type" attribute. The practical choice is the authorization object type: Type When to choose it Counterparty A legal entity/sole proprietor client or supplier to whom you grant access to their data. Partner When records are kept by partner, and access is needed at the partner level. Individual A specific person — a representative, a freelance auditor, an authorized agent. The set of available types depends on which authorization objects are enabled in the database. 6. What is generated on save There are no accounting entries or electronic documents. This object does not create ESF (ESF IS), SNT, movements in VAT registers, or tax registers. Service data is recorded: - An account in the list of information base users (login, authentication method, login allowed flag). - A link between "external user ↔ authorization object". - Membership in external user groups and assigned access groups (profiles), which determine actual rights. - Entries in the login log for this user's logins/logouts. 7. Printed forms The catalog has no printed forms — it is a service object. Look for access reporting not here, but in standard administration tools: - "User and rights settings" → "Access rights reports" (user rights, access groups); - "Login log" — who logged in, when, and from what address. 8. Common errors "Name (for login) … already in use. Specify another name." This login is already taken by an internal or external user. Set a unique name. "Authorization object is not filled in." An external user card without an authorization object cannot be saved. Select a counterparty, partner, or individual. "An external user has already been created for this authorization object." One counterparty/partner/individual = one external account. Find the existing record instead of creating a duplicate. "Password does not meet requirements." A password complexity policy is in effect. Set a password of the required length and composition (letters/digits). The user logs in but "sees emptiness" or gets a rights error. No access group (profile) is assigned, or the profile is too narrow. Add the user to a suitable access group. The "External users" item is inactive / the list won't open. The mechanism is not enabled in "User and rights settings," or you don't have administrator rights. Enable the "External users" flag under an administrator account. 9. FAQ How is an external user different from a regular one? A regular user is your employee from the "Users" catalog with broad rights. An external one is a person "outside," tied to an authorization object, who sees only their own data and only what their profile allows. How do I temporarily close access without deleting the record? Uncheck "Login to the program is allowed" or set "Invalid." The history and settings will be preserved, but login will not be possible. Does this catalog generate postings, ESF, or SNT? No. This is an access configuration, not a business transaction. It creates no postings, no electronic documents, and no 16% VAT calculation. Can one counterparty have two users? One authorization object corresponds to one external account. If two people from a counterparty need access, this is usually either a single shared login or different authorization objects (e.g., different individual representatives). How do I grant browser access? Enable "Login by username and password allowed" and publish the database on a web server. The external user logs in at the publication address with their login. How do I reset a client's password? Open the card → "Login to the program" block → set a new password and enable "Require password setup at login" so they change it themselves. Why doesn't the login show in the selection window at startup? For external users, the "Show in selection list" flag is usually unchecked — for security reasons. The login is entered manually. Can I set it up so a client sees only their own documents? Yes, this is handled by the authorization object + access profile. A correctly chosen limited profile shows the user only their own counterparty's/partner's data. What happens if I delete the authorization object (counterparty)? The external user will be left without a link and will effectively lose access to data. Instead of deleting the counterparty, block the user with the "Invalid" flag. Do I need to enable anything extra for the mechanism to work? Yes, the "External users" flag in "User and rights settings." Until it's enabled, the catalog and external login are unavailable. 10. Related objects - "Users" catalog — accounts for your employees (internal). External ones are managed separately, but the rights mechanisms are shared. - "External user groups" — grouping of external users for batch rights assignment. - "Access groups" and "Access group profiles" — what actually defines rights; the external user is included here. - "Counterparties," "Partners," "Individuals" catalogs — sources of the "authorization object" to which the external account is linked. - Login log — where external users' login/logout events are recorded. Instructions prepared for "Trade Management for Kazakhstan," edition 3.4, release 3.4.5.21. Check your own release in "Help" → "About the program." In other releases, the set of card fields may differ. --- _BuhGPT — ИИ-помощник для бухгалтеров Казахстана: https://buhgpt.kz_