Cleaning Up Old Groups in Odoo
When migrating an Odoo project from an older version to a newer one, you may encounter groups that were used temporarily or are no longer relevant in the new version. Keeping these unused groups can cause:
- Confusing or overlapping user permissions.
- Orphaned record rules and access rights that no longer apply.
- Security misconfigurations that expose records unintentionally.
- Unnecessary clutter in the database that slows down maintenance and future upgrades.
To keep your environment clean and secure, remove deprecated groups during migration, unlink them from users, and delete their related record rules and access controls.
In this blog, we’ll walk through a post-migration cleanup script that does exactly that.
Why Cleanup Deprecated Groups?
- Security: Old groups may carry record rules that expose sensitive data.
- Clarity: Users should only see the groups they need.
- Maintainability: Removing unused configurations reduces complexity for future upgrades.
Post-Migration Cleanup Script
Below is a script example from the Numla project migration. It performs four actions in a safe order:
- Unlinks the group from record rules.
- Removes the group from assigned users.
- Deletes related access control entries.
- Deletes the group itself.
Step-by-Step Explanation
1. Find the Group
We locate the deprecated group using its XML ID:
2. Unlink Group from Record Rules
Any ir.rule tied to this group is updated to remove the relationship. This prevents hidden filtering or exposure of records after the group is gone.
3. Remove Group from Users
We do not touch user accounts. We only unlink the group, which preserves user access through other groups that remain valid.
4. Delete Access Control Entries
Any ir.model.access rows tied to the group are removed, so there are no stale allow rules floating around.
5. Delete the Group
Once nothing depends on it, the group can be safely deleted.
Practical Safeguards Before You Run This
- Run on a staging database first and validate critical user journeys.
- Back up the database so you can roll back if needed.
- Search for any implied groups, menus, or automated actions that still reference the group, and clean those up if found.
- Review server logs after migration to confirm there are no access errors.
Final Thoughts
Cleaning up deprecated groups is a small but critical step in Odoo migrations. By unlinking rules, removing access rights, and safely deleting unused groups, you keep your environment secure, maintainable, and ready for future upgrades. Following the safeguards above ensures you won’t disrupt live operations while running the script.