@philr75 I ran into this recently. The method described in Help wasn’t working for me either. What did work was actually simpler: Created one group for each combination. No Inverse group, just A type. For your example, create a type A group with account 0000 and subaccounts 10000-39999. Try and let me know. 

@jhouser thank you! I will try this and advise back.

I was still having issues and have opened a case with support. I’ll add what I learn here when we figure this out. But I’ve marked your reply as best answer @jhouser. I didn’t have issues creating customer groups for a client recently and thought it was fairly straight forward using A type restrictions. It seems like it should be very similar for this exercise. I’m not sure if there’s a build specific problem, or if it has something to do with the nature of system processing records (AR flows through that default subaccount). Any group, even just one, seems to restrict that subaccount or trigger errors, even if I make the group to specifically allow AR access to the subaccount. The only time I don’t have problems is if I turn off all GL groups (all my attempts). Then everything behaves the same as it does without ever trying to enable the groups.

@philr75 Okay, let me know what you can find, and if I can help further. 

@jhouser I just wanted to say thanks again for your help with this. We ended up discovering that the customer configuration is at times at odds with the rules I was trying to establish. Now I’m trying to convince the customer to allow me to clean up customer and vendor records where GL sub is trying to instruct the system to assign the very subaccount they want restricted. In testing it seems as if Acumatica first checks for GL restrictions regardless of what the masking rules are going to ultimately determine. I say this because when I shut the rules off, and run a transaction it didn’t ultimately use the default subaccount that the customer wants restricted. Yet with the rule on, I was getting errors that suggested the problem goes back to those customer GL subaccounts.

I’ve been looking for a simple visual that shows customers how the subaccount masking flows through the system, but I’ve been unable to locate anything useful. I know from the training materials that each module is looking to its preference section for direction but there isn’t anything I’ve found yet that defines an overall heirarchy and especially a visual. Do you know of anything helpful that I can put in front of a customer to help define how the process flows?