In Odoo 19, company setup, users and permissions all live under Settings › Users & Companies. Set up the company first (legal details, tax ID, logo, document layout), decide whether extra entities are separate companies or branches, then create users with a role and an access level per app. Anyone outside your organisation, such as a customer or vendor, should be a portal user, never an internal one.
This is part 4 of our Odoo 19 guide. It assumes Odoo is installed and you have chosen where it runs (part 3).
Company setup in Odoo 19
Everything that prints comes from the company record: invoices, quotations, delivery slips, payslips. Get it right before anyone creates a document.
Settings › General Settings › Companies Update Info name, address, tax ID, currency, logo Manage Companies list of companies and branches Document Layout layout, fonts, colours, footer Settings › Users & Companies Users · Companies · Groups (developer mode)
For an Indian company, the tax ID is your GSTIN, and the state on the address matters because it drives whether GST is split into CGST and SGST or charged as IGST. The company's currency and chart of accounts come from the fiscal localisation you pick when you set up Invoicing or Accounting. Install the right localisation (the Indian one for INR and GST) before you post a single entry, because changing it afterwards is painful.
Then open Document Layout and set the layout, logo, colours and footer. Five minutes here saves weeks of "can we change the invoice" requests.
Branches vs separate companies
Odoo 19 gives you two ways to model more than one entity, and choosing the wrong one is hard to undo.
| Branch | Separate company | |
|---|---|---|
| How to create | Branches tab on the parent company | New company in Manage Companies |
| Chart of accounts | Takes the parent's chart template | Its own, from its own localisation |
| Lock dates | Also respects the parent's lock dates | Its own |
| Typical use | Same legal entity, different location or registration | Different legal entity, different books |
In India we usually model each extra GST registration of the same legal entity (one GSTIN per state) as a branch of the parent company, and a genuinely separate private limited company as its own company. A group with a trading company in Chennai and a services company in Bengaluru is two companies. One company with warehouses registered in Tamil Nadu and Karnataka is one company with branches.
Once you have more than one company, each user gets a Companies list (what they may access) and a Default Company on the Access Rights tab of their user record. A company switcher appears in the top bar, and record rules keep each user's data limited to the companies they have selected. For groups that trade with each other, the Inter-Company Transactions setting (Enterprise) creates the matching sales order, purchase order or bill in the other company automatically.
Users, roles and per-app access rights
Create users under Settings › Users & Companies › Users. In Odoo 19 the user form's Access Rights tab starts with a Role: User or Administrator. Administrator gives access to Settings; keep it to one or two people. Below the role, each installed app shows its own access level. Sales, for example, offers three:
- User: Own Documents Only — sees their own quotations and orders.
- User: All Documents — sees the whole team's.
- Administrator — can also change the app's configuration.
Most apps follow the same pattern of user, officer or manager levels. Leaving an app blank means the user cannot open it at all. In developer mode, the user form also shows buttons counting the groups, access rights and record rules that apply to that person, which is the fastest way to answer "why can't Priya see this?".
- Write down roles, not people. "Sales executive", "Accounts assistant", "Store keeper", "Warehouse manager". Five to ten roles cover most businesses.
- Map each role to an access level per app. A small table is enough: role down the side, apps across the top.
- Set Default Access Rights. Settings › General Settings › Permissions defines what every new user starts with. Make it the least-privileged role.
- Create users and adjust from the default. Only give extra access for a reason you can state.
- Review every quarter. People change jobs; their access rarely follows unless someone checks.
Two security settings belong in the same sitting. Enforce two-factor authentication can apply to employees only or to all users. And Minimum Password Length defaults to 8 characters; raise it if your policy asks for more.
The access rights problem we fix most often is not someone seeing too little. It is the finance module open to everyone because it was quicker at go-live.
Internal users vs portal users
Odoo has two kinds of login. Internal users work inside the back end with the apps and access levels above. Portal users are external: customers, vendors, sometimes contractors. They log in to the website portal at /my and see only their own records, such as quotations to accept and sign, invoices to download and pay, delivery status, support tickets and shared project tasks, depending on which apps you run.
You do not create portal users from the Users menu. Open the contact, choose Grant portal access from the action menu, and Odoo sends an invitation email. The user record that results is flagged as an external user, with a ribbon on its form.
Keep the line clean. Never make a customer or a freelance accountant an internal user to "just let them see one thing"; they will see far more than that. Internal users are what Enterprise subscriptions are counted on, so the portal is usually the cheaper answer as well as the safer one. See odoo.com/pricing for current terms.
With the company, users and roles in place, you can safely install the business apps. Before that, part 5 looks at the new AI features, since some of them depend on the access you have just defined. If you are structuring several companies or GST registrations, we can help you plan it.
Questions we get asked
What is the difference between a branch and a company in Odoo 19?
A branch is a sub-company created from the Branches tab of a parent company. It takes the parent's chart of accounts template and respects the parent's lock dates, so it suits the same legal entity operating in another location or under another tax registration. A separate company has its own localisation and books, and suits a different legal entity.
How do I give a customer access to their invoices in Odoo?
Open the customer's contact record, use the action menu and choose Grant portal access. Odoo emails them an invitation to set a password. Once logged in at /my on your website, they see only their own documents, such as quotations, sales orders, invoices and, if those apps are installed, helpdesk tickets and project tasks. Portal users cannot open the back-end apps.
How do I restrict a salesperson to their own quotations in Odoo 19?
Open the user under Settings, Users and Companies, Users, go to the Access Rights tab and set the Sales access level to User: Own Documents Only. They will then see only the quotations and sales orders where they are the salesperson. User: All Documents shows the whole team's records, and Administrator adds access to the Sales configuration.
Can I force two-factor authentication in Odoo 19?
Yes. In Settings, the Enforce two-factor authentication option lets you require 2FA for employees only or for all users, including portal users. Users who have not set up an authenticator app are asked to verify by email at login until they do. It is worth enabling from the start, especially for administrators and anyone with Accounting access.