XPM Permissions by Member Role

This article explains which StructureGram member levels can perform each Xero Practice Manager (XPM) workflow, so you can pick the right role when inviting people who will work with XPM data.

This is about StructureGram's roles, not Xero's. For Xero-side requirements (which Xero account you need, which OAuth scopes to grant), see Connecting to Xero Practice Manager.

Quick Reference

Workflow	Tenancy Admin	Member - Group Admin	Member - Edit	Member - View / No Baseline Access / Guest
See XPM features and browse XPM groups and clients	Yes	Yes	Yes	No
Use the XPM Sync Hub	Yes	Yes	Yes (Limited Sync)	No
Pull from XPM (sync)	Yes	Yes	Yes	No
Link a Group to XPM	Yes	Yes	Yes	No
Unlink a Group from XPM	Yes	Yes	Yes	No
Two-way sync (reconciliation): preview, and apply pull-side choices	Yes	Yes	Yes (Limited Sync)	No
Two-way sync: apply push and delete choices	Yes	Yes	No	No
Push a Group to XPM	Yes	Yes	No	No
Push from an entity page	Yes	Yes	No	No
Create a new Group in XPM	Yes	Yes	No	No
Delete an entity, relationship or Group in XPM	Yes	Yes	No	No
Delete an entity locally in StructureGram	Yes	Yes	Yes	No
Connect or disconnect Xero	Yes	No	No	No

The pattern: anything that only changes StructureGram (pull, link, unlink, local edits and deletes, and the pull side of two-way sync) is available to anyone with an editor baseline. Anything that writes to or deletes in XPM requires Group Admin or Tenancy Admin.

Browsing XPM depends on your tenancy-wide default: it needs a Member - Edit or Member - Group Admin default (or Tenancy Admin). Linking a Group means choosing from XPM's groups, so it needs that default too.

Everything else follows your access to the Group itself. Someone whose default is View or No Baseline Access, but who has been granted access to one Group, sees that Group's XPM actions: with edit access they can pull it, unlink it and run two-way sync in Limited Sync once it is linked. With Group Admin access they can also push and delete in XPM. They can't browse XPM to choose a link. The same applies to entities and relationships in that Group.

An entity in more than one Group needs Group Admin access in any one of them to push or delete it in XPM. A relationship needs that for each of its two ends: Group Admin in one Group of each entity it links.

Importing an XPM group as a new StructureGram Group also needs permission to create Groups (see Group Access and Permissions).

Limited Sync

When a Member - Edit opens the XPM Sync Hub, a Group's XPM page, or two-way sync, StructureGram shows Limited Sync: a banner saying you can pull from XPM, and that pushing to or deleting in XPM needs a Group Admin.

In a Limited Sync review, choices that would push to or delete in XPM stay visible but are locked, marked Needs a Group Admin. Items whose suggested choice was a push default to Ignore instead. You can still apply everything on the pull side; ask a Group Admin to apply the rest.

Why Some Workflows Need Higher Permissions

XPM workflows split cleanly into two groups by risk profile:

Pull-shaped workflows — bring data from XPM into StructureGram. These can't damage anything in XPM, so anyone with editor access can run them.

Push and delete workflows — make changes in XPM, including creating clients, updating fields, and deleting clients. These can affect data your team or your client may rely on, so they're limited to Group Admin and Tenancy Admin roles. Two-way sync spans both: an editor can apply its pull side (Limited Sync), and a Group Admin applies the push and delete side.

Why You Might Restrict Push and Delete

Many practices treat Xero Practice Manager as their source of truth for client data. In that setup, XPM is the system staff trust to be correct — the place billing, compliance, and reporting all reference back to.

When XPM is your source of truth, you typically want StructureGram to be:

Easy to draft and experiment in. Junior staff, paraplanners, and intermediates should feel free to build diagrams, model scenarios, and explore client structures without worrying about damaging real client data.
Hard to push back from. Changes that flow into XPM should be deliberate, reviewed, and made by senior staff who understand the downstream impact.

The role split is designed around this:

Member - Edit can pull the latest XPM data into StructureGram any time, edit and reshape inside StructureGram (including deleting entities locally), and build diagrams freely. Nothing they do affects XPM directly.
Member - Group Admin and Tenancy Admin are the people who can deliberately push back to XPM via two-way sync or direct entity-page push.

This pattern has practical benefits:

Mistakes stay local. A staff member who creates a duplicate, mis-types a name, or restructures a diagram for a hypothetical scenario can't accidentally damage the XPM record. Pulling fresh from XPM restores the canonical view.
Reconciliation becomes a clear, owned step. Pushing data back to XPM is a conscious decision by a senior reviewer who can confirm it's the right move and explain why.
Audit trails are cleaner. When XPM changes flow through a small number of specific people, you can attribute every remote change to a named decision.
Trainees can experiment safely. New staff can build practice diagrams and explore restructure scenarios on real client data without a senior having to review every interaction.

For broader guidance on choosing roles and team structures for your firm, see Setting Up Roles, Teams, and Access Patterns.

What Each Role Can Do

Tenancy Admin

Full access to all XPM workflows. Can also manage tenancy-wide integration settings (connect, disconnect, choose the active Xero organisation).

Member - Group Admin

Full access to all XPM workflows within the Groups they have access to. Cannot manage tenancy-wide integration settings — that's reserved for Tenancy Admin.

Use this role for senior advisors, partners, or anyone who needs to actively manage XPM-linked client data including pushing changes back to XPM and resolving reconciliation differences.

Member - Edit

Can use XPM workflows for read-shaped operations:

Pull from XPM — sync clients, relationships, and group membership into StructureGram.
Use the XPM Sync Hub — to import an XPM group or link an existing Group, then pull.
Link and unlink a Group — connect a StructureGram Group to an existing XPM group, or disconnect it. Unlinking only removes StructureGram's link; nothing changes in XPM.
Two-way sync, in Limited Sync — preview the differences and apply every pull-side choice (import from XPM, use the XPM value, link to an existing record, ignore).
Edit and delete entities locally in StructureGram — full ability to make changes inside StructureGram.

Cannot:

Apply push or delete choices in two-way sync — they are shown, locked, as Needs a Group Admin.
Push a Group to XPM, or push individual entities from an entity page.
Create a new Group in XPM — this writes the Group and its entities into XPM.
Delete anything in XPM — even if the local entity is deleted in StructureGram, the corresponding XPM client is not removed.

Where a push or delete action isn't available to you, StructureGram locks or hides the control and says why, rather than showing a button that fails. If you reach one directly, you'll get a message naming the access you need.

Tip: This is the right role for staff who need to keep StructureGram up to date by pulling the latest XPM data, but who shouldn't be making changes that propagate back to XPM.

Member - View, Member - No Baseline Access, External Guest

XPM features are hidden from these roles. One exception: a Member - View or No Baseline Access member who has been granted edit or Group Admin access to a Group sees that Group's XPM actions, as described above. External Guests never see XPM features.

Local Delete vs Remote Delete

A common point of confusion: deleting an entity locally in StructureGram is not the same as removing the client from XPM.

Local delete (available to Member - Edit and above): removes the entity from StructureGram only. The XPM client and its data remain in Xero Practice Manager.
Remote delete from XPM (available to Member - Group Admin and Tenancy Admin only): removes the entity from both StructureGram and the XPM client list. Deleting in XPM needs both push and delete access to the Group.

If you need to remove a client from XPM and you're a Member - Edit, ask a Group Admin or Tenancy Admin to perform the delete from the entity page or via two-way sync.

Worked Examples

"I'm setting up a new staff member who'll keep our XPM-linked Groups synced. What role do they need?" Member - Edit is enough. They can pull from XPM whenever XPM data changes and edit StructureGram entities locally. If they later need to push changes back to XPM or run reconciliation, you can lift them to Member - Group Admin.

"Our client wants their XPM client list cleaned up by removing duplicate clients. Which role can do that from StructureGram?" Member - Group Admin or Tenancy Admin. Deleting clients from XPM via StructureGram requires Group Admin or higher.

"A Member - Edit user reported a stale relationship in StructureGram that they fixed locally. Does that fix flow back to XPM?" No. Member - Edit can change StructureGram data, but those changes aren't pushed to XPM. A Group Admin or Tenancy Admin needs to apply the push side of two-way sync (or use the push workflow) to propagate the change back.

"What's the smallest role that can resolve all differences between StructureGram and XPM?" Member - Group Admin. A Member - Edit can run two-way sync and apply the pull side (Limited Sync); the push and delete choices need a Group Admin.

Edge Cases

A Limited Sync apply is all or nothing. If a saved choice would push or delete in XPM, StructureGram refuses the whole apply and names the items, rather than applying part of what you reviewed. Set those items to Ignore, or ask a Group Admin.
MFA is required for all XPM actions regardless of role. See Connecting to Xero Practice Manager for the MFA setup steps.
Restricted Groups still apply. Even a Tenancy Admin can lose XPM access to a specific Group if that Group is restricted and they haven't been granted explicit access to it.

Help & Documentation