Why did my staff's POS permissions just change overnight when nobody touched them?
If staff POS permissions or location access shift on their own, here's how to audit what changed, document it, and get it corrected.
What's going on
My POS staff logged in this morning and a couple of them suddenly can't process refunds, and one lost access to a location they've always had. Nobody on my team touched the permissions settings. Did something change on Shopify's end?
This kind of report does come up periodically: merchants notice a cashier who could previously issue refunds or apply discounts suddenly can't, or a staff PIN that worked the day before no longer grants POS access at the expected register, with no configuration change made on their side.
Why it happens
Shopify manages staff accounts, permission sets, and location access as related but separate pieces of configuration, with POS layering its own permission-set model on top of general staff account settings. When any of these pieces gets updated on Shopify's side, an error in how existing data carries over can leave some staff records changed in ways the merchant never intended.
Because most merchants set staff permissions once and rarely revisit them, a problem like this can go unnoticed until an employee hits a wall during a shift, which is why it tends to surface as an urgent scramble on the sales floor rather than something caught ahead of time.
5 ways to fix it
Export every staff member's current permissions before changing anything
In Shopify admin, go to Settings, then Users and permissions, and open each staff profile to record their permission set, location access, and PIN status in a spreadsheet. This gives you a documented before-and-after baseline, which you'll need both to restore access correctly and to show Shopify Support exactly what changed.
Manually re-check every POS permission set rather than trusting what's there now
POS permission sets bundle individual permissions, like processing refunds, applying discounts, or viewing reports, and are assigned per staff member. If yours look off after an unexplained change, don't assume the current configuration is correct: open each set and re-check every toggle against your notes, since some merchants have reported custom permission sets reverting toward more limited defaults after platform updates.
Check location access separately from permission sets
Location access and permission-level settings are configured independently, so a staff member can keep their permission set but lose access to the location their POS device uses, or the reverse. Compare each profile's assigned locations against your baseline, since staff being able to log in but not ring up sales at their usual register is a common symptom of this kind of issue.
File a support ticket with your before-and-after comparison
If your notes show permissions changed without anyone on your team touching them, contact Shopify Support through the Help Center in your admin and share the comparison. Concrete before-and-after detail, rather than a general description of the symptom, gives support the best chance of identifying what happened and correcting it on their end.
Set a recurring reminder to spot-check staff and POS permissions
Because these settings aren't touched often, an unannounced change can go unnoticed for weeks until a staff member is blocked mid-shift. Add a recurring reminder, monthly or quarterly, to re-export your staff and POS permissions and compare them against your saved baseline, so any future drift gets caught quickly.
Bottom line
This looks like a platform-side issue rather than a setting your team changed, so the practical response is procedural: keep a standing export of staff and POS permissions as a rollback reference, and treat any unexplained mismatch as a support ticket rather than a re-configuration project. There's no real app-fit here; this is an account administration and support-escalation problem, not something a third-party app prevents or fixes.
Browse the rest of the problem library, run a free storefront scan to catch issues like this automatically, or email us and we'll work out a custom solution for it.