You can use labels to decide which targets a user can see. When a user is restricted to a label, they only see the targets with that label. Everything else in your organization stays hidden from them.

This is useful when, for example:

* An external IT partner should only see the targets they manage.

* A team should only see the targets at their own location.

## How access works

* **No label assigned:** if neither the user nor any of their groups has a label, the user can access **all** targets.

* **One or more labels:** the user can access all targets of **all** assigned labels. A user with the labels `Amsterdam datacenter` and `Managed by Partner A` sees the targets of both labels.

* **Admins are not exempt.** Label restrictions also apply to users with the `admin` role. An admin can always remove their own label restrictions again.

You can assign labels in two ways: directly to a user, or through a user group.

## Method 1: assign a label directly to a user

Use this method for one-off cases or small organizations.

1. In the left-hand menu, under **Organization Management**, click **Members**.

2. Find the user in the list.

3. In the **Labels** column, click **Select Labels** and tick the labels you want to give this user.

![](https://support.catcher24.com/rails/active_storage/blobs/redirect/eyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaHBiUT09IiwiZXhwIjpudWxsLCJwdXIiOiJibG9iX2lkIn19--dd78f0cb99986af6b6d3fe7114bac0550830d57a/members-labels-dropdown.jpg)

To remove the restriction, clear the labels again. Without labels, the user can see all targets.

## Method 2: assign a label through a group

Use this method when several users need the same access. Change the group once and every member follows.

1. Create a group and give it a label. See [Manage user groups](https://help.catcher24.com/hc/help-centre/articles/1790938434-manage-user-groups).

2. In the left-hand menu, click **Members**.

3. In the **Groups** column of the user, click **Select Groups** and tick the group.

![](https://support.catcher24.com/rails/active_storage/blobs/redirect/eyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaHBiZz09IiwiZXhwIjpudWxsLCJwdXIiOiJibG9iX2lkIn19--e75e52f4166068614653dff00ffb37a64a903d94/groups-overview.jpg)

The user now gets the labels of that group.

## Roles and labels

Labels decide **which targets** a user sees. The user's role decides **what they can do**. You can create extra roles with exactly the permissions you need under **Organization Management > Roles**, and combine them with labels for precise access.

## Tips

* Label all targets before you restrict users, so nobody is locked out of targets they need.

* Prefer groups to direct labels when more than one user needs the same access.

* Review access when you add a new target. A new target without a label is invisible to restricted users.