# How to Add Logins and Permissions to a Spreadsheet Process

> Excel and Google Sheets share by role and protect ranges, and that is the ceiling. Here is how to get user accounts, roles, and an audit log for your process.

Source: https://llamapress.ai/how-to-add-user-logins-and-permissions-to-a-spreadsheet-based-process | Updated: 2026-09-02

---

[LlamaPress Blog](https://llamapress.ai/blog)

Excel and Google Sheets share by role and protect ranges, and that is the ceiling. Here is how to get user accounts, roles, and an audit log for your process.

 [Back to all articles](https://llamapress.ai/blog)

![Kody Kendall](https://llamapress-ai-image-uploads.s3.us-west-2.amazonaws.com/jujc1ep8nuqrdiftdfer1ngp833u)

Written by

### Kody Kendall

AI & Software Engineer | Creator of the Leonardo Coding Agent

Updated September 2026

Excel and Google Sheets let you share a file by role and protect a tab or a range, and that is the ceiling. Neither tool offers per-row permissions, per-field rules, approval steps, or a reliable log of who changed what. Microsoft states that worksheet protection is not intended as a security feature. Real logins and permissions require moving the process into an app with user accounts and roles. In 2026 an AI-built app made from your spreadsheet includes accounts, roles, and an audit log by default.

In short

- Excel and Google Sheets control access at the file, tab, and range level only. A single row or field cannot be locked to one person.
- Microsoft and Google both state in their own documentation that sheet protection is not a security measure.
- An app gives each person a login, a role, and a record of every change with a name and a timestamp.
- A permission matrix drawn from your tabs and columns takes about 30 minutes and becomes the spec for the app.
- Several no-code tools charge a higher tier for roles. An AI-built custom app includes accounts, roles, and an audit log from day one.

I am a software engineer, and I created Leonardo, the AI coding agent that turns spreadsheets into apps at LlamaPress. Logins and permissions are the first request most operators make after they upload a file. I have read hundreds of these spreadsheets. The access rules are usually buried in a hidden tab, a locked range, or a note that says "do not touch column K". This page covers what the spreadsheet tools can do, where they stop, and how to get the real thing.

![Three coworkers sharing one laptop at a black office table, the way a team shares one spreadsheet login](https://images.unsplash.com/photo-1603195827187-459ab02554a0?crop=entropy&cs=tinysrgb&fit=max&fm=jpg&ixid=M3w4NTU2MDF8MHwxfHNlYXJjaHwyfHxvZmZpY2UlMjB0ZWFtJTIwbGFwdG9wJTIwbG9naW4lMjBwYXNzd29yZHxlbnwwfHx8fDE3ODgzNjE5MDN8MA&ixlib=rb-4.1.0&q=80&w=1080)

Photo by [Cherrydeck](https://unsplash.com/@cherrydeck?utm_source=leonardo_rails_app&utm_medium=referral) on [Unsplash](https://unsplash.com/photos/people-collaborating-on-office-laptop-Qx7A7SChpnI?utm_source=leonardo_rails_app&utm_medium=referral)

## What "Permissions" Actually Means

Permissions answer two questions for every person: what can they see, and what can they change. Access control works at four levels. The file level decides who can open the spreadsheet at all. The tab level decides who can see the Pricing tab or the Payroll tab. The range or column level decides who can edit the Cost column while everyone else reads it. The row and field level decides that a client sees only their own row, and finance alone edits the Approved field.

Spreadsheets handle the first three levels in a limited way. The fourth level is where a business process actually lives. Add the actions on top of the levels: view, edit, approve, delete, and export. A real permission model states which of those five actions each role gets at each level. Write that out once and you have the spec for an app.

## What Can You Do Inside Excel and Google Sheets Today?

You can share a file as view-only, protect a tab or a range, hide columns, keep one file per person, or use a Form. Each option solves one small problem and has a hard limit. The table below lists all six with the Excel method, the Google Sheets method, and the limit, as of this writing.

| Need | Excel | Google Sheets | The limit |
| --- | --- | --- | --- |
| Share as view-only | Share the file from OneDrive or SharePoint with view access only | Share as Viewer or Commenter. Editor gets view, comment, edit, and share | All or nothing for the whole file. A Viewer can still download a copy |
| Protect a tab | Review, Protect Sheet, optional password | Data, Protect sheets and ranges, then warn or restrict editors | Locks the same cells for every editor. Microsoft says the feature is not for security |
| Protect a range or column | Unlock the editable cells, then protect the tab | Protect the range and pick who may edit it | The rule follows cells, not records. Every new row needs the rule again |
| Hide columns | Hide the column, then protect the tab | Hide the column, then protect the tab | Any editor can unhide. Google says people can copy and export a protected file |
| One file per person | A file per rep plus a master file that links to each one | A file per rep plus IMPORTRANGE into a master file | Ten people means ten files to maintain. Links break when a file moves |
| Forms for entry | Microsoft Forms with a live connection to a workbook in OneDrive | Google Forms with responses in a linked sheet | One-way only. A respondent cannot view or edit an existing row |

The sources are the vendors' own help pages. Microsoft's guide to [protecting a worksheet](https://support.microsoft.com/en-us/office/protect-a-worksheet-3179efdb-1285-4d49-a9c3-f4ca36276de6) covers unlocking ranges and setting a password, and nothing about giving different people different rows. Google's page on [protecting sheets and ranges](https://support.google.com/docs/answer/1218656) offers two modes, a warning or a restricted editor list. Google's Drive documentation lists three sharing roles, Viewer, Commenter, and Editor, and allows up to 600 individual email addresses per file. Both Forms products append new responses and give the respondent no way back in.

## Why Is Spreadsheet Protection Not Access Control?

Spreadsheet protection stops accidental edits. Access control decides who may see and change each record. Those are different jobs. Microsoft's documentation states that worksheet level protection "isn't intended as a security feature" and "simply prevents users from modifying locked cells." Google's documentation says the same about protected ranges: "This shouldn't be used as a security measure." Google adds that people can print, copy, paste, and export copies of a protected spreadsheet.

Five gaps show up in every shared spreadsheet I have reviewed. First, there is no row-level rule. An onboarding sheet with 40 clients shows all 40 rows to every editor. Second, the file can be copied, and a protected tab in a copy is open. Third, there is no per-record log. You cannot ask the spreadsheet who changed the Go-Live Date for client 17 and when. Fourth, many teams share one login for the master file, so even the file history shows one name. Fifth, there is no approval step. A cell turns green because someone typed "Approved", and anyone with edit rights can type it.

Protection also does nothing about two people saving over each other. If your team keeps losing entries, read [the fix for people overwriting each other in a shared inventory spreadsheet](https://llamapress.ai/people-keep-overwriting-each-other-in-our-inventory-spreadsheet-here-is-the-fix). This page stays on access control.

## What Do Logins and Roles Look Like in an App?

In an app every person has their own account, and every account has a role. The role decides which records the person sees and which actions the person may take. The rules attach to the record, so a new client gets the right permissions the moment the record exists. Every change is logged with the user, the field, the old value, the new value, and the time.

The matrix below is a working example for a client onboarding process. The roles are the onboarding coordinator, the account manager, finance, and the client. A [guided client onboarding app](https://llamapress.ai/guided-client-onboarding-software-that-replaces-your-checklist-spreadsheet) enforces a matrix like this one without anyone policing the file.

| Action | Onboarding coordinator | Account manager | Finance | Client |
| --- | --- | --- | --- | --- |
| See all clients | Yes | Own accounts only | Yes | Own record only |
| Edit intake answers | Yes | Yes, until submitted | No | Own record, until submitted |
| Upload documents | Yes | Yes | No | Yes, to own record |
| Approve go-live | No, can request | No, can request | Yes | No |
| See pricing | No | Yes | Yes | Own quote only |
| Export | No | No | Yes, CSV | No |

Read the Client column and notice what a spreadsheet can never do. The client logs in, sees one record, uploads to that record, and never sees anyone else's pricing. The same pattern works for an estimating team. An estimator creates and edits estimates. A reviewer approves them. Sales sees the approved total and the client-facing PDF, and never the margin column. The same roles carry over to a phone screen. See our page on [turning a spreadsheet into an app your field team can use on their phones](https://llamapress.ai/how-to-turn-an-excel-spreadsheet-into-an-app-your-field-team-can-use-on-their-phones).

![A team seated around a table with laptops, each person working from their own login](https://images.unsplash.com/photo-1690378820474-b468b8ee64d3?crop=entropy&cs=tinysrgb&fit=max&fm=jpg&ixid=M3w4NTU2MDF8MHwxfHNlYXJjaHwxfHxvZmZpY2UlMjB0ZWFtJTIwbGFwdG9wJTIwbG9naW4lMjBwYXNzd29yZHxlbnwwfHx8fDE3ODgzNjE5MDN8MA&ixlib=rb-4.1.0&q=80&w=1080)

Photo by [Lyubomyr Reverchuk](https://unsplash.com/@lreverchuk?utm_source=leonardo_rails_app&utm_medium=referral) on [Unsplash](https://unsplash.com/photos/a-group-of-people-sitting-around-a-table-with-laptops-rtD_lcsN6_U?utm_source=leonardo_rails_app&utm_medium=referral)

## How Do You Design a Permission Matrix From the Spreadsheet in 30 Minutes?

Open the spreadsheet, open a blank sheet next to it, and follow five steps. Step one, list the people. Include clients, contractors, and the accountant who gets a copy each month. Group them into roles. Four or five roles cover almost every business process.

Step two, list the tabs and the columns. Each tab is usually one type of record. Each column is one field on that record. Note the columns you have hidden, locked, or colored. Those marks are your current permission rules.

Step three, mark who may see each field and who may change it. Put a V for view or an E for edit in each role's column. Leave a blank where the role should never see the field. The Cost and Margin columns usually produce the first hard conversation. Have it now, on paper.

Step four, mark the approval moments. Find every cell where someone types "Approved", "Ready", or "Sent". Each one needs a role, a rule, and a timestamp. Step five, mark delete and export. Almost nobody needs delete. One or two roles need export. That completed sheet is your permission matrix, and any developer or AI agent can build from it.

## How Do You Get It Built?

You have three routes: a no-code builder, a developer, or an AI-built custom app. All three can give you logins. They differ on where roles and record-level rules sit in the price list. As of September 2026, Noloco's Free plan includes 2 user roles with no record or field permissions. Record and field permissions arrive on Noloco's Build plan at $79 per month, per [Noloco's pricing page](https://noloco.io/pricing). Google AppSheet's Starter plan at $5 per user per month has no role-based user management or security filters. Both start on the Core plan at $10 per user per month, per [AppSheet's pricing page](https://about.appsheet.com/pricing/). Softr's pricing page places custom role-based permissions on its Pro plan at $99 per month. Softr lists audit logs under Enterprise only.

A developer builds whatever matrix you hand over. The cost is discovery time, and the 30-minute matrix removes most of it. An AI-built custom app is the third route, and the one I work on. You [upload the spreadsheet](https://llamapress.ai/excel-to-app), Leonardo reads the tabs and columns, and the app ships with user accounts, roles, and an audit log by default. The app is a standard Ruby on Rails application on a PostgreSQL database, and the code lives in your own GitHub repository. Hosted plans start at $9.99 per month with no per-user seat fees, and build sprints start at $2,000, as of this writing. A human engineer reviews every build. The move from a file to a database is what makes the audit log possible. Our guide on [converting Excel to a database to secure your business data](https://llamapress.ai/converting-excel-to-a-database-how-to-secure-your-business-data-and-scale) covers that side.

## When View-Only Sharing Plus a Form Is Enough

Sometimes the spreadsheet tools are the right answer. If one person owns the data and everyone else only reads it, share the file as view-only and stop there. If other people only add new entries, a Google Form or Microsoft Form into the sheet works well. The one-way limit becomes a feature, because nobody can edit history. If the data is not sensitive and stays inside the company, protection against accidental edits is enough. You need an app when a client must log in, when two roles must see different columns, or when an approval has to mean something.

## Your Spreadsheet Already Holds the Permission Model

The expensive part of a custom build was always discovery, and your spreadsheet has already done it. The tabs are your record types. The columns are your fields. The hidden columns, the locked ranges, and the "do not edit" notes are your permission rules. The colored status cells are your approval steps. Leonardo reads all of that when you [upload the spreadsheet at /excel-to-app](https://llamapress.ai/excel-to-app). The step-by-step version is in our guide on [how to convert an Excel spreadsheet to a web app without rebuilding from scratch](https://llamapress.ai/how-to-convert-your-excel-spreadsheet-to-a-web-application-without-rebuilding-from-scratch).

The first version of the app has a login page, one role per group you named, and an editable matrix in the admin screen. Every record keeps a history with the user and the time. Clients get their own login and see their own records only. We have converted more than 400 spreadsheets this way. The permission matrix you drew is the first thing we check against the running app.

From Spreadsheet to Software

### Give every person their own login and their own view.

Upload the spreadsheet that runs your onboarding, orders, or intake. Leonardo builds an app with accounts, roles, and an audit log, in your own GitHub repository.

[Add Logins to My Process](https://llamapress.ai/excel-to-app) [See Onboarding Apps](https://llamapress.ai/guided-client-onboarding-software-that-replaces-your-checklist-spreadsheet)

Prefer to talk first? [Contact us](https://llamapress.ai/contact) and we will look at your workbook with you.

## Frequently Asked Questions

### How do I add user logins and permissions to a spreadsheet-based process?

Excel and Google Sheets cannot give each user a login with different rows and fields. To add user logins and permissions, move the process into an app with user accounts and roles. Draw a permission matrix from the tabs and columns first, then build the app from that matrix. An AI-built app from your spreadsheet includes accounts, roles, and an audit log by default.

### Can I password protect parts of an Excel spreadsheet for different users?

Excel lets you protect a tab with one password and unlock chosen ranges. The same protection applies to everyone who opens the file. Excel has no way to show one user one set of rows and another user a different set. Microsoft's documentation states that worksheet protection is not intended as a security feature.

### Can Google Sheets restrict who can edit certain rows?

Google Sheets can restrict who edits a protected range, and a range can be a block of rows. The restriction covers editing only, so every editor still sees those rows. New rows need a new protected range. Google's documentation says protected ranges should not be used as a security measure. Per-user row permissions require an app with accounts and roles.

### How do I see who changed a cell in Excel?

Excel has no per-record audit log you can query by client, by field, or by user. Microsoft's legacy Shared Workbook feature tracked changes, but Microsoft describes that feature as older, with many limitations, and replaced by co-authoring. Version history in cloud storage restores older copies of the whole file, so you compare copies by hand. An app writes the user, the field, the old value, the new value, and the time against every record.

### What is role-based access control in a business app?

Role-based access control gives every user account a role, such as coordinator, finance, or client. Each role has a fixed set of permissions that say which records the role can see and which actions the role can take. Permissions attach to the record, so a new record is protected the moment someone creates it. A permission matrix is the written form of role-based access control.

### Can clients log in to see only their own records?

Yes, in an app with user accounts. Each client gets a login tied to their own record, and the app filters every screen to that record. The client can upload documents and answer intake questions without seeing another client's data. A shared spreadsheet cannot do this, because every editor sees every row.