Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesOn a Minecraft: Bedrock Edition Dedicated Server, creating a sub-user has two separate parts: decide who is allowed to connect, then decide what each connected player can do. Add the player to the server allowlist, assign the least-powerful suitable role, test the result, and keep a clear revocation path. The procedures below apply to Bedrock Dedicated Server; Java servers use different server software and permission systems.
Playing with friends? Godlike.Host runs hosted Minecraft Java servers from 10 data-center locations, with free DDoS protection.
What “sub-user” means on a Minecraft server
Minecraft does not use “sub-user” as one universal permission object. In practice, the term means an additional player, moderator, builder, family member, or helper whose access you want to control.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Bedrock separates access into two controls:
- Join access: the allowlist determines which Gamertags may connect when the server is restricted.
- In-game authority: the player-permission role determines whether that connected player can build, interact with the world, attack, or run administrative commands.
A player can be on the allowlist without being an operator. Conversely, changing someone’s role does not automatically add that person to the allowlist. Manage both controls whenever you add or remove a helper.
Prepare the Bedrock Dedicated Server
Use the correct server edition
This guide assumes Minecraft: Bedrock Edition Dedicated Server running on supported Windows or Ubuntu Linux. The server executable, world files, server.properties, allowlist.json, and permission data must be accessible to the administrator.
#1 Best Overall
Keep an Internet-facing server authenticated
For a public or Internet-facing installation, leave online-mode=true. This allows the server to authenticate player accounts instead of accepting unauthenticated identities.
Open the required network ports
Bedrock Dedicated Server documents UDP ports 19132 and 19133 as the default ports used for firewall configuration. Forward or allow the port that your installation actually uses, and restrict administrative access to the machine itself rather than exposing a console or file share unnecessarily.
Back up before changing access
Copy the server folder, including the world, server.properties, allowlist.json, and any permission files, before a first-time permission change. A backup gives you a recovery option if a manual edit locks out every administrator or grants broader access than intended.
Turn on the Bedrock allowlist
Enable restriction in server.properties
Stop the server or use its documented configuration workflow, open server.properties, and set:
allow-list=trueThis setting restricts connections to players listed in allowlist.json. The property is a server-wide switch: when it is enabled, an unlisted player should not be able to join even if the player knows the address and port.
Use the console commands
With the server running, the console can manage entries without opening the JSON file:
/allowlist add <GamerTag>
/allowlist list
/allowlist remove <GamerTag>
/allowlist reloadThe /whitelist command is an alias for /allowlist. Use the player’s current Gamertag exactly as the account presents it. The list command is useful for confirming spelling before you troubleshoot a failed connection.
When to reload
If you add or remove a person through the console, the server applies the command directly. If you edit allowlist.json while the server is running, execute /allowlist reload afterward so Bedrock reads the updated file. A reload is preferable to an unnecessary full restart when only the allowlist changed.
Add a player as a sub-user: a complete procedure
- Confirm the account name. Ask the player for the Gamertag they will actually use. Do not rely on a nickname shown by a third-party panel or on a display name that differs from the authenticated account.
- Add the account to the allowlist. Run
/allowlist add <GamerTag>from the Bedrock server console. - Confirm the entry. Run
/allowlist listand check that the expected Gamertag appears once and is spelled correctly. - Choose a role before the first session. Start with Member for ordinary play, Visitor for observation, or Custom when the player needs a narrow combination of abilities. Do not grant Operator merely because the player is helping with a build.
- Have the player connect. Ask them to join while the allowlist is enabled. This tests both account authentication and the network path.
- Test intended actions. Have the player perform the activities their role is supposed to permit, such as placing blocks or opening a container.
- Test a forbidden action. Try one administrative action that the player should not have. This confirms that the role is restrictive rather than merely functional.
- Record ownership and recovery information. Keep an administrator-only note of who has elevated access, why it was granted, and how to remove it.
Choose the smallest useful Bedrock role
| Role | Use it for | Administrative risk |
|---|---|---|
| Visitor | Watching or moving through a world with minimal interaction | Low; intended for observation rather than active play |
| Member | Normal players who should participate in ordinary gameplay | Lower than Operator, but still verify the server’s gameplay rules |
| Custom | A tailored helper, builder, moderator, or restricted test account | Depends entirely on the controls selected |
| Operator | Trusted administrators who must run server commands | Highest; command access can change the world and other users’ access |
When Member is enough
Use Member for a friend, family member, or community player who needs to play normally but does not administer the server. It avoids the common mistake of making every helpful player an operator.
When Visitor is appropriate
Visitor suits an observer, tour participant, or account that should be able to enter and look around without receiving normal building and interaction privileges.
Recommended Free Tools
When Custom is safer than Operator
Custom permissions can be used to allow only the capabilities a particular job requires. The documented controls can distinguish building, mining, using doors and switches, opening containers, attacking players or mobs, and using operator commands. For example, a builder may need building and container access but not command execution; a tour guide may need movement and selected interaction without combat.
When Operator is justified
Reserve Operator for people who genuinely need administrative commands and who are trusted to affect the entire server. Operator is not a “super Member” setting for convenience; it is a broad recovery and administration role.
Rank #3
- The classic UNO card game builds fun on game night with a Minecraft theme.
- UNO Minecraft features a deck and storage tin decorated with graphics from the popular video game.
- Players match colors and numbers to the card on top of the discard pile as in the classic game.
- The Creeper card unique to this deck forces other players to draw 3 cards.
- Makes a great gift for kid, teen, adult and family game nights with 2 to 10 players ages 7 years and older, especially Minecraft and video game fans.
Grant and revoke operator access
From the Bedrock server console, use:
op <playername>
deop <playername>op grants operator privileges to the named player. deop removes them. Use the exact player name and verify the result with the player’s next connection or an administrative status check available in your server interface.
Grant operator status only after the player is already correctly identified and, where applicable, allowlisted. If an operator leaves the project, loses trust, or only needed temporary access, run deop immediately; do not wait for the next scheduled maintenance window.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Use permission data for finer control
Bedrock Dedicated Server provides a /permission command for permission data. The documented operations include:
/permission list
/permission reloadThe command reference also documents a set form. Use the syntax exposed by your current Bedrock server build or its command help rather than copying a role format from a different edition or plugin. Java permissions plugins and Bedrock permission files are not interchangeable.
Reload after a permission-file edit
If you change permission data outside the game, run /permission reload. This applies the edited data without requiring you to guess whether a panel or server restart has already loaded it.
Separate capability design from account management
First define the job: ordinary player, spectator, builder, moderator, or administrator. Then select only the capabilities needed for that job. Keeping these decisions separate prevents a harmless allowlist addition from silently becoming a command-access grant.
Rank #4
- Now Minecraft lovers can play a special version of UNO!
- Same as Basic UNO but features Minecraft characters and includes special Creeper rule card. Draw this card and the other players have to draw three more cards from the pile!
- The goal is to get rid of all the cards in your hand.
- First player or team to 500 wins.
- When you're down to one card, don't forget to yell "UNO"!
Understand allowlist.json and server.properties
allowlist.json fields
Bedrock stores allowlist entries in allowlist.json. The documented entry fields include:
name: the player name used for the allowlist entry.xuid: an optional Xbox user identifier.ignoresPlayerLimit: an option that allows the listed account to bypass the configured player limit.
Do not add ignoresPlayerLimit casually. It changes capacity behavior rather than merely granting permission to join. If you edit this file by hand, preserve valid JSON syntax and run /allowlist reload.
Important server.properties settings
Access management commonly intersects with these properties:
| Property | What it controls |
|---|---|
allow-list |
Whether only entries in allowlist.json may connect |
default-player-permission-level |
The default role assigned to players who do not receive a more specific setting |
online-mode |
Whether connecting accounts are authenticated; keep enabled for Internet-facing servers |
max-players |
The server’s configured player capacity |
Some configuration changes require a restart, while allowlist and permission data have documented reload commands. If you change a property and the running server does not reflect it, perform a controlled restart after backing up the files.
Verify a new sub-user without over-granting access
Connection test
Ask the player to connect from the same account whose Gamertag you added. If the account is refused, check the allowlist spelling, whether allow-list=true is loaded, the server address and UDP port, and whether the player is signing in through the expected account.
Capability test
Use a short test checklist appropriate to the assigned role:
- Can the player perform the required task, such as place blocks or open a container?
- Can the player use a door or switch if that is part of the job?
- Can the player attack mobs or other players only when intended?
- Can the player run an operator command? If not, the least-privilege boundary is working.
- Does the player remain unable to change access for other accounts?
Document temporary access
For a short-lived helper, note the reason and planned removal date. Temporary operator access should be treated as an exception, not as the default onboarding path.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Remove a sub-user cleanly
- Remove join access. Run
/allowlist remove <GamerTag>if the player should no longer connect. - Revoke operator status. Run
deop <playername>if the account had operator privileges. - Remove custom permission data. Use the permission-management method used by your installation, then run
/permission reloadwhen the data was edited outside the server. - Reload the allowlist. If the removal was made in
allowlist.json, run/allowlist reload. - Check active sessions. A player already connected may need to disconnect before the removal is fully apparent to them.
- Review related credentials. If the person had access to the host machine, panel, backups, or file share, revoke those independently; changing Minecraft permissions does not secure the operating system.
Console, files, panel, or managed hosting?
The right administration boundary depends on who will maintain the server. A console-and-files setup offers direct control, while a web panel or managed service can reduce operational work. A panel is not a new permission model by itself; it is an interface over server settings, allowlist data, roles, restarts, and backups.
| Administration method | Control | Operational burden | Permission granularity | Recovery and audit questions |
|---|---|---|---|---|
| Direct console and files | Direct access to server.properties, allowlist, and permission data |
You handle executable updates, firewall rules, backups, and restarts | As granular as the Bedrock role and permission data support | Can you restore files, restrict shell access, and record every change? |
| Web management panel | Centralized controls for allowlists, roles, and server operations | The panel may simplify restarts and file editing, but it has its own accounts and failure modes | Check whether it exposes Custom controls or only broad presets | Verify backup, audit-log, rollback, and permission boundaries before delegating access |
| Managed hosting | Provider-controlled machine and network configuration with customer-facing controls | Less firewall and operating-system maintenance, but less direct infrastructure control | Depends on the exact Bedrock support and interface offered | Confirm who can change access, how backups are restored, and how quickly a locked-out owner can recover |
Before giving a helper panel access, check whether the panel account can edit files, restart the server, view backups, or change other users’ roles. A person who only needs to add players should not automatically receive host-level permissions.
Common failures and fixes
“The player is allowlisted but still cannot join”
- Run
/allowlist listand compare the spelling with the authenticated Gamertag. - Confirm
allow-list=trueis in the activeserver.properties, not an unused copy. - Run
/allowlist reloadif the JSON was edited manually. - Check that the player is using the correct server address and UDP port and that the firewall allows it.
- Confirm the account is authenticated under the expected Microsoft/Xbox identity when
online-mode=true.
“The player can join but cannot build”
Joining proves allowlist access, not a building permission. Check whether the account is Visitor, whether a Custom role omitted building, or whether a world-specific rule is blocking interaction. Assign Member or the precise Custom capability required, then reconnect and test again.
“The player can do too much”
Check for accidental Operator status first and run deop <playername> if it is not required. Then inspect Custom controls and the default player permission level. Reload permission data after an external edit.
Free tools Windows power users keep installed
One-click scans. No signup required.
“A file edit had no effect”
Validate the JSON, confirm you edited the server’s active directory, and use the matching reload command. Changes to properties that do not have a reload operation may require a controlled restart.
“Everyone is locked out”
Use the server console or local host access rather than relying on an in-game operator. Restore the last known-good configuration backup, correct the allowlist or permission data, and reload it. Keep at least one trusted recovery administrator separate from ordinary helper accounts.
Bedrock and Java are different workflows
Do not copy the Bedrock commands in this article into a Java server guide without qualification. A Java server may be vanilla, Paper, Fabric, or another implementation with a permissions plugin. The correct allowlist command, role system, file format, and reload behavior depend on that exact stack. A Java setup needs its own implementation-specific procedure.
Quick Recap
Administrator checklist
- Identify the player’s exact authenticated Gamertag.
- Enable
allow-list=truewhen the server should be private. - Add the player and verify with
/allowlist list. - Assign Visitor, Member, or Custom before considering Operator.
- Use Custom controls for narrowly defined building, interaction, container, combat, or command needs.
- Use
oponly for trusted administrators and keepdeopavailable for immediate revocation. - Reload allowlist or permission data after external file edits.
- Test one required action and one forbidden action.
- Back up configuration and world data before broad permission changes.
- Review panel, host, operating-system, and backup access separately from Minecraft roles.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
