Remove Groups/User from Having Access to a Module

[Rae Khan]

Hi everyone, 

How can I ensure that certain users/groups do have access to certain Modules/Applications?

Ex: I would like to ensure a user 'Abel Tuter', part of a group 'Test Group', does not have access to an application such as 'Service Portal'. 

How would I create this? I believe it is an ACL but am uncertain as to how to proceed

Any help would be greatly appreciated

[Sandeep Rajput]

@Rae Khan You can choose to add a role to you module as follows.

You can choose to assign the role to users via a group (Test Group in your case) or you can directly assign it to users. Now the users with the role assigned on the module can access it. Users not having role defined on the module will not be able to see this module in the Application Navigator.

[Rae Khan]

This is additive, which would mean I would have to allow everyone except the specified user. Is this correct?

If so, I am looking for a subtractive solution. Simply removing the role/group. Is that possible?

[Sandeep Rajput]

@Rae Khan The configuration shown allows access to Sample Table module only if the logged in user is having u_sample_table_user role. Those who do not have this role, will not be able to see this module. 

Regarding ACLs, even the solution with ACL on sys_app_module will be an additive one as the role defined in role list will make it an additive solution. 

[Rae Khan]

Ok, so in order to ensure a role does not have access  - the only solution is to add everyone (which is alot of users) except the one specified?