I have successfully set up CiviCRM ACLs so that only contacts within the group "NYC Team" have access to certain events.

What I am trying to figure out is how to prevent low-level users from adding themselves (or other contacts) to the CiviCRM group "NYC Team". (If a low level user can add themselves (or others) to the group "NYC Team" (and other Access Control type groups), it renders the ACLs to be ineffective.

5 Answers 5


With situations like that I simply just disable the group. The ACL still works, but users don't have access to add anyone to the group.

If you need to add someone else to the group, just enable, add and disable again.


  • I've always used this method - its a pain but the simplest way. Will explore the Group Protect extension to see if that is simpler. Really, this should be baked in along with adding permissions for any data field regardless of whether it is Custom or not (e.g. data of birth, gender or any other sensitive information)
    – ChumKui
    Nov 18, 2020 at 12:05
  • Hi how do you prevent users from enabling the group again? thanks
    – Cirrus
    Sep 12, 2022 at 16:02

There is a useful little CiviCoop extension called group-protect to mark a group as protected. You can use this to protect your ACL groups and assign a permission to those who should edit them.


I think you'd need to use hooks to hide the ACL groups from the dropdowns. There's a forum post here that links to a module that does this - looks like it could be adapted into an extension to hide the groups from everyone but admins. It's a few years old, mind.


Set the view permission for the group so that users you don't want adding themselves or others to it can't see it.

  • How can I set the view permission for a specific group?
    – Graham
    Sep 18, 2015 at 16:56

CiviCRM has an option for groups in the group settings to make the group "Reserved". You can use this setting along with the CMS permission "CiviCRM: administer reserved groups" to limit who can edit a group.

For more information, here are some good docs: http://book.civicrm.org/user/current/organising-your-data/groups-and-tags/

Another way to control who can create groups is using hook_civicrm_buildForm and warning/redirecting the user to another page if they don't have certain permissions. See code snippet below.

function memberperms_civicrm_buildForm( $formName, &$form ) {
    if (strpos($formName, "AddToGroup")
        !CRM_Core_Permission::check('edit all contacts')
    ) {

        // Display Error Message
        CRM_Core_Session::setStatus("Sorry, the group feature is not currently supported for members", "Permission Denied", "error");

        // Redirect to civicrm home
  • Please see most recent edit where I offer a workaround with hook_civicrm_buildForm.
    – bdombro
    Apr 23, 2015 at 21:50
  • 3
    From my testing, it appears that making a group "Reserved" does not prevent a user from adding himself to the group. (The Group Settings dialog itself says "If reserved, only users with 'administer reserved groups' permission can disable, delete, or change settings for this group. The reserved flag does NOT affect users ability to add or remove contacts from a group.")
    – Martin_W
    Jun 7, 2018 at 8:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.