Fix Staff Permission Loss After Role Changes in AppFolio Property Manager

A staff user usually loses permissions after role changes in AppFolio Property Manager because their new role does not include the same permission set, the change has not fully applied to all related access areas (like portfolios, properties, bank accounts, or reports), or the user is now blocked by a security rule (MFA, IP restrictions, SSO, or approval workflows) that overrides role permissions. Even if everything “looks correct,” the most common cause is a missing secondary access assignment (property/portfolio access) or a role template mismatch.

 

What “role” controls vs what it does not

 

• Role permissions control what features a user can click (AP, AR, reports, leasing, maintenance, etc.).
• Data access controls what they can see inside those features (which properties, owners, residents, GL accounts, bank accounts).
• Security controls can block access even when permissions are correct (MFA required, locked user, SSO group not matched).

 

Most common reasons permissions “disappear” after a role change

 

• Role downgrade or different role template: the new role simply lacks a permission (example: “View Reports” vs “Edit Accounting”).
• Property/portfolio assignment got reset: user has the right buttons, but sees “no data” or missing menus because they are not assigned to the needed properties/portfolios.
• Accounting access is restricted: access to bank accounts, GL, owner payables may require separate accounting settings beyond the role.
• Approval workflows override: user can enter bills/charges but cannot post/approve after role change.
• Cached session: user is still in an old session; changes apply after sign-out/sign-in.
• User status/security: locked account, MFA not completed, IP restriction, or SSO group mapping changed.

 

How to confirm and fix it (fast checklist)

 

• Compare roles: open the user’s role and verify each needed permission is enabled (especially accounting, reports, owner/resident data).
• Verify property/portfolio access: confirm the user is assigned to the correct properties/portfolios; missing assignment looks like “permissions lost.”
• Check accounting-specific access: confirm bank accounts/GL visibility rules are not limiting them.
• Test with a known task: have them try one exact action (run a report, post a charge, approve a bill) and note the exact error text.
• Force refresh: sign out, close browser, sign back in; if using SSO, re-authenticate fully.

 

If the user already meets all requirements and it still happens

 

• Role propagation delay or stuck permission state: re-save the role, then re-save the user profile; have the user re-login.
• Conflicting admin settings: a global security or accounting restriction can silently override role permissions.
• SSO group mismatch: SSO may re-apply a default role at login, undoing manual changes.
• Data-level restriction: they have the permission, but the specific entity (property, bank, report) is excluded.

 

When to contact AppFolio Support

 

• Permissions revert after login (common with SSO).
• User has correct role and assignments but still gets access errors with screenshots.
• Only one user is affected after multiple re-saves and re-logins (possible account-level issue).