I want some CiviCRM events to be Member-only and some to be public. But I'm not seeing a way of creating an ACL permission for the anonymous user and then assigning it to an event.

The only way of doing seems to be to revert to Drupal permissioning, which is global and not selective.

Is there a way around this? I'm thinking make all events available to everyone and put ACLs on profiles attached to events?


2 Answers 2


The title of your question only makes a distinction for "anonymous" users; the question itself mentions "Member-only" vs "public".

If by "Member" you mean "current membership holders as defined in CiviMember", then the Member Only Event extension is probably a good choice.

If on the other hand you only mean "members of my site" a.k.a. "logged in users", then what you're describing is possible with ACLs. The following will default to "authenticated users only" for all events, with exceptions defined on a per-event basis using ACLs.

  1. Configure Drupal (or other CMS) permissions to deny the "CiviEvent: register for events" permission for the Anonymous role, and grant this permission to the Authenticated role.

  2. In CiviCRM, create an ACL that grants "Edit" permission to a single event for the "Everyone" role, as in this example: enter image description here

  3. Naturally you'll want to test that event and a normal "authenticated user only" event, both as an authenticated user and as an anonymous user, for your own peace of mind that it's configured correctly.

An important caveat here is that with ACLs you are introducing a separate mechanism for managing user permissions, which runs parallel with -- and sometimes overlaps with -- Drupal permissions. That's not a bad thing; it just means it's important to a) have a clear understanding of what you're enabling, b) test to ensure you've configured it correctly, and c) remember to check ACLs as well as Drupal permissions, if you ever find an issue later on where users have different access levels than you expected.

  • good info. so for each additional 'public' event you would need to add that event to the ACL?
    – petednz - fuzion
    Mar 16, 2020 at 20:23
  • and if so - and if that makes this not sufficient, perhaps a custom field on an Event to mark some as 'For public eyes' and some for 'special folk'' (and i agree, knowing if the OP means 'users' or 'contacts with a membership' is a key point to get clarified
    – petednz - fuzion
    Mar 16, 2020 at 20:27
  • Pete: Yes, you would need to add a new ACL for each "unauthenticated users event", since the ACL UI will only allow selecting one event.
    – TwoMice
    Mar 17, 2020 at 14:47
  • Pete: And to your other point, I'm not sure that a custom field would help, as there's no support for that in ACLs. If you want to elaborate, it might make a nice alternative answer.
    – TwoMice
    Mar 17, 2020 at 14:49
  • yes the custom field would require an extension
    – petednz - fuzion
    Mar 17, 2020 at 18:35

A more custom approach could involve adding a Custom Field to Events, that is used to differentiate if the Event is 'public' or not, and then build an extension that provides the ACL to determine whether anonymous should be able to see/register the event.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.