# Menu Security - None vs Disallow? **URL:** \ **Category:** Kinetic ERP\ **Tags:** menu-security\ **Created:** [May 1, 2025, 2:51pm UTC](https://www.epiusers.help/t/menu-security-none-vs-disallow/125334 "2025-05-01T14:51:40Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![askulte](https://www.epiusers.help/user_avatar/www.epiusers.help/askulte/32/7325_2.png) [@askulte](https://www.epiusers.help/u/askulte)\ **Post date:** [May 1, 2025, 2:51pm UTC](https://www.epiusers.help/t/menu-security-none-vs-disallow/125334/1 "2025-05-01T14:51:40Z")
In Menu Security, what’s the difference between ‘None’ and ‘Disallow’ for Default Access? ![image](https://www.epiusers.help/uploads/default/original/3X/7/0/708a949a4b88498d8f460a3237d72deb28d48399.png) Field Help is empty, and the linked help in Kinetic doesn’t mention ‘None’ at all. ![image](https://www.epiusers.help/uploads/default/original/3X/3/2/32abff9988370b1576588d0a2bf657e707254c75.png) Thanks for the clarification! (I’m trying to get our process automation user access to MRP without having to give it access to all the menus above it. It seems Epicor in the last update to 2024.2 no longer gives access to the process, even though my security group is ‘Allow’. Epicor wants to have access to all the menu paths leading to it, which we don’t want to give. And I really don’t want to set every other program in the MRP \> General to disallow for my automation security group, just to restrict MRP from accessing it. ) ---
**Author:** ![kve](https://www.epiusers.help/user_avatar/www.epiusers.help/kve/32/76150_2.png) [@kve](https://www.epiusers.help/u/kve)\ **Post date:** [May 1, 2025, 3:00pm UTC](https://www.epiusers.help/t/menu-security-none-vs-disallow/125334/2 "2025-05-01T15:00:48Z")
I’m almost positive that “None” means the user / group will not have access by default, but if they are in another security group that has “Allow”, it will work. For example, if the default is set to “None” and all users are set to “Default”, they won’t have access. But if I have one security group set specifically to “Allow”, the users with that group will have access. BUT If I have one group set to “Disallow” and another group set to “Allow”, a user in both of those groups would not have access. Or if I have a group set to “Allow”, and a specific user set to “Disallow”, that user will not have access, even if they are assigned the Security Group that is set to “Allow”. I’m not an expert in Menu Security, so someone correct me if this is incorrect. ---
**Author:** ![aosemwengie1](https://www.epiusers.help/user_avatar/www.epiusers.help/aosemwengie1/32/95533_2.png) [@aosemwengie1](https://www.epiusers.help/u/aosemwengie1)\ **Post date:** [May 1, 2025, 3:14pm UTC](https://www.epiusers.help/t/menu-security-none-vs-disallow/125334/3 "2025-05-01T15:14:03Z")
> [@askulte](#): > > Field Help is empty I have no idea but can you log a support case about this? Apparently the field help won’t get filled unless/until we notify them field by field of every thing that is missing. ---
**Author:** ![kve](https://www.epiusers.help/user_avatar/www.epiusers.help/kve/32/76150_2.png) [@kve](https://www.epiusers.help/u/kve)\ **Post date:** [May 1, 2025, 3:16pm UTC](https://www.epiusers.help/t/menu-security-none-vs-disallow/125334/4 "2025-05-01T15:16:40Z")
> [@askulte](#): > > I’m trying to get our process automation user access to MRP without having to give it access to all the menus above it. I probably should have finished reading before posting my reply. In cases when I want someone to have 1 module but nothing else from the folder / subfolder, the option I usually go with is to create a new Menu for MRP (by copying it) and put it in a directory that user has access to (or create a new main menu folder for it). Sometimes I will create a new Security for that folder specifically. ---
**Author:** ![Mark\_Wonsil](https://www.epiusers.help/user_avatar/www.epiusers.help/mark_wonsil/32/51594_2.png) [@Mark\_Wonsil](https://www.epiusers.help/u/Mark_Wonsil)\ **Post date:** [May 1, 2025, 3:24pm UTC](https://www.epiusers.help/t/menu-security-none-vs-disallow/125334/5 "2025-05-01T15:24:25Z")
> [@askulte](#): > > I’m trying to get our process automation user access to MRP without having to give it access to all the menus above it When you say, “process automation user”, is that a person or actual automation? ---
**Author:** ![askulte](https://www.epiusers.help/user_avatar/www.epiusers.help/askulte/32/7325_2.png) [@askulte](https://www.epiusers.help/u/askulte)\ **Post date:** [May 1, 2025, 3:33pm UTC](https://www.epiusers.help/t/menu-security-none-vs-disallow/125334/6 "2025-05-01T15:33:43Z")
Mark, It’s a user account I created for running the scheduled processes. Currently MRP nightly and Multi-Company Direct Server ever 10 minutes. This way the we can see the process automation user on the system monitor, and not my UserID running every 10 minutes 24 x 7. ---
**Author:** ![kve](https://www.epiusers.help/user_avatar/www.epiusers.help/kve/32/76150_2.png) [@kve](https://www.epiusers.help/u/kve)\ **Post date:** [May 1, 2025, 3:53pm UTC](https://www.epiusers.help/t/menu-security-none-vs-disallow/125334/7 "2025-05-01T15:53:29Z")
I always run those as manager. Is that bad practice? ---
**Author:** ![Mark\_Wonsil](https://www.epiusers.help/user_avatar/www.epiusers.help/mark_wonsil/32/51594_2.png) [@Mark\_Wonsil](https://www.epiusers.help/u/Mark_Wonsil)\ **Post date:** [May 1, 2025, 4:18pm UTC](https://www.epiusers.help/t/menu-security-none-vs-disallow/125334/8 "2025-05-01T16:18:18Z")
> [@kve](#): > > Is that bad practice? One might argue it’s over-privileged. 🤷 ---
**Author:** ![kananga](https://www.epiusers.help/user_avatar/www.epiusers.help/kananga/32/80812_2.png) [@kananga](https://www.epiusers.help/u/kananga)\ **Post date:** [May 1, 2025, 5:52pm UTC](https://www.epiusers.help/t/menu-security-none-vs-disallow/125334/9 "2025-05-01T17:52:49Z")
> [@Mark\_Wonsil](#): > > over-privileged Adding on… The default manager account is also an easy target for mischief, so that’s a good one to disable in any case. An account that’s used by humans can be fragile if it might be deactivated when roles change. A specific, special account’s privs can be tightly targeted by an access scope. Making it an ‘integration account’ helps avoid account expiration surprises if someone falls off the password rotation wagon - whether that’s treated as a pro or con depends on the business.