Available for the following plans: Employment Lite, Employment Plus, Employment Unlimited
Available for the following HR plans: Standard, Premium, Platinum
Available for the following User Access level: Admin
Platform admins automatically have access to all the features on the Employment Hero platform. Other user types, like employees and managers, do not have the same access to everything. Their default access is limited to the features that they have to use regularly.
Admins can grant custom access to certain features through Permission Settings. To do that, you have to create a custom security group, define who has access to what data, select the specific permissions needed, and assign the appropriate people. This article shows you how to do that. To learn which features you can give permissions to, please refer to this article: Features that managers and employees can be given access to.
Daily activities
Create a security group
Creating a security group is guided through a step-by-step process that makes it easier to understand what access you're granting and to whom.
- Click the Settings menu.
- In the Security & Access Control section, click Permissions.
- Click the Add Permission button to create a new security group.
-
Detail & Access: Complete the following fields:
- Group name: Give your security group a descriptive name that clearly explains its purpose (e.g., "Payroll Admins" or "HR Managers").
- Description: Add an optional description to provide more context about this group's purpose.
-
Whose data can this group access: Define the scope of employee and contractor data this security group can access:
-
Employee Access: Choose from All employees, Direct reports only, Teams, Locations, Worksites, or No employees.
- Teams, Locations, and Worksites employee access: Only available to Platinum, Employment Plus, and Employment Unlimited users.
- Contractor Access: Choose from All contractors, Reporting contractors, or No contractors.
-
Employee Access: Choose from All employees, Direct reports only, Teams, Locations, Worksites, or No employees.
-
Employee Permissions: Configure which actions this security group can perform on employee data. Permissions are organized by modules to make them easier to find:
- Use the search bar to quickly find specific permissions (e.g., search "leave" to find all leave-related permissions)
- For each module, select the appropriate access level: View, Modify, Delete, or Use
- Hover over the information icons to understand what each permission allows
- Contractor Permissions: If you selected contractor access in Step 1, configure the permissions for contractor data. Click Next to continue.
-
Step 4 - General Permissions: Select any platform-wide permissions that don't relate to specific employee or contractor files, such as:
- Leave calendar access
- Recruitment management
- API access
- Announcement posting
Click Next to continue.
-
Review: Review your security group setup before finalizing:
- Check the group name and description
- Verify whose data this group can access
- Review the permissions summary, which shows both full and partial permissions
- Use the Edit buttons to return to previous steps if changes are needed
- Select Members: Choose which users will be assigned to this security group. You can search for specific employees by name.
- Click the Save button to create your security group.
Understanding Permission Types
In the Review step, you'll see permissions categorized as:
- Full permissions: When you've selected all available actions for a specific module
- Partial permissions: When you've only selected some actions for a module (e.g., only viewing employee files but not modifying them)
Search which security groups a user is in
- Click the Settings menu.
- Under Security and Access, click the Permission Settings submenu.
- Click the search bar.
-
Type the name of the employee whose security group you want to see.
Important
You will only see the security groups where the employee was added as an individual. This search will not show security groups where an employee was added as part of "All Employees" or a team.
For example, in the image below, employee "Eren" was added as an individual to the Rosters and Recruitment groups. If he was added to another security group via the admin clicking "All Employees" or Eren's team, this security group will not show up in the search below.
Permission Settings Templates (Platinum Users Only - Open Beta Feature)
Platinum Plan Feature
The Permission Settings Templates are currently available in Open Beta for Platinum users only. If you're on a Standard or Premium plan, you can continue using the regular Permission Settings process as described in the sections above. Learn how to enable Open Beta features in this article.
Using Permission Templates to create security groups
Permission Templates make it faster and easier to create security groups by providing pre-configured permission sets for common organisational roles. This feature helps reduce setup time while maintaining the flexibility to customise permissions as needed.
- Click the Settings menu.
- In the Security & Access Control section, click Permissions.
- Click the Add Permission button to create a new security group.
- On the template selection page, choose from one of the available templates:
- HR Administrator: Pre-configured with permissions for HR-related functions and employee management.
- Payroll Administrator: Includes access to payroll and financial details, with relevant custom reports.
-
Recruitment Manager: Contains permissions specifically related to recruitment and hiring processes.
- Click Use Selected Template after selecting your desired template.
-
The template will pre-fill the security group creation process with:
- Group name (which you can edit)
- Description (which you can edit)
- Relevant permissions based on the selected role
You'll then go through the same step-by-step process as creating a group from scratch, but with the template's settings already filled in.
- Review the pre-filled permissions and modify them if needed. You can:
- Add additional permissions
- Remove permissions that aren't required
- Adjust access levels as necessary
- Complete the remaining steps to select members and save your security group.
Important Notes
- Templates apply permissions to "All Employees" by default. If you change this setting, the template's pre-configured permissions will be lost.
- You can still choose to skip templates and create a security group from scratch by selecting the appropriate option.
- Templates are designed to speed up the creation process, but you maintain full control to customize permissions before finalizing the group.
Data management
Edit a security group
You can make quick edits to basic details or use the step-by-step wizard to modify more complex settings.
Key things to note
Two Versions
There are two versions of this feature: Basic Security Access for standard and premium users and Advanced Security Settings for platinum users. Please refer to the Access Option premises in the Further Information section for more information.
Permission Templates Availability
Permission Settings Templates are currently available for Platinum users only. Standard and Premium users will continue to use the regular Permission Settings process. Templates are designed to make the creation of security groups faster and easier by providing pre-configured permission sets for common organizational roles.
Product Limitation
Due to product limitations, the Headcount, Termination, and Compliance reports include directly reporting employees only. While the Leave, Timesheet, and Shout Out reports include both directly and indirectly reporting employees.
Team Leaders
You can now set up Teams and Team Leaders to allow for more customisation around access and management. Click this link for more information on how to set up Teams and Team Leaders.
The Teams feature is only available on the Platinum and Unlimited plans. If you're on a lower plan and don't see this option, it is not included in your current subscription.
Location-Based Access
You can limit security group access to employees in specific locations, similar to how team-based access works. This allows you to grant permissions based on where employees are physically located.
The Locations feature is only available on the Plus, Unlimited and Platinum plans. If you're on a lower plan and don't see this option, it is not included in your current subscription.
Product terminology explained
Product Definitions
| Use. | Allows the user to use the feature. If the feature supports modifying and deleting, then the user will have access to that function. |
| View. | Allows the user to view the feature. |
| Modify. | Allows the user to modify the feature. |
| Delete. | Allows the user to delete the feature. |
| All staff. | The user can access this feature for all employees in their company. |
| Teams. | The user can access this feature for all members within their team. |
| Reporting Employees. | The user defined as a primary, secondary manager or indirect manager can access this feature for all employees directly under them, but not the user themselves. |
| All Contractors. | The user can access this feature for all contractors in their company. |
| Reporting Contractors. | The user can access the feature for all contractors under them. |
| Knowledge Base. | The use can access the HR Guides section of the platform. |
| Team Leader. | Allows the user to access and manage the details of users assigned to a team. See this article to learn how to create a team. |
Direct Relationships: These are straightforward, one-to-one connections.
- Direct Employee: A specific employee's profile you can directly access.
- Direct Manager: You are officially assigned as the primary or secondary manager of an employee.
- Direct Reporting Employee: An employee who directly reports to you as their primary or secondary manager.
Indirect Relationships: These are relationships derived from the organizational hierarchy, involving multiple levels.
- Indirect Employee: An employee whose profile you can access through the reporting structure, but not directly.
- Indirect Manager: A manager who is higher up in the organizational hierarchy, but not your immediate manager.
- Indirect Reporting Employee: Employees who report to your direct reporting employees, or further down the line. This is often referred to as "skip-level" reporting.
Visualising the Example
Let's use the example provided with Elizabeth, Grace, Jen, and Michelle.
- Elizabeth (You)
- '---> Grace (Direct Reporting Employee)
- '---> Jen (Direct Reporting Employee of Grace)
- '---> Michelle (Direct Reporting Employee of Jen)
- '---> Jen (Direct Reporting Employee of Grace)
- '---> Grace (Direct Reporting Employee)
Applying the Definitions
Direct:
- Grace is Elizabeth's direct reporting employee.
- Jen is Grace's direct reporting employee.
- Michelle is Jen's direct reporting employee.
Indirect:
- Jen and Michelle are Elizabeth's indirect reporting employees.
- Michelle is Grace's indirect reporting employee.
- Elizabeth is an indirect manager of Jen and Michelle.
Indirect Manager:
- Elizabeth is an indirect manager of Jen and Michelle, because she is a manager of Grace, who is a manager of Jen, who is a manager of Michelle.
Simplified Explanations
- Direct: "Who reports to me directly?"
- Indirect: "Who reports to the people who report to me, or to the people who report to them, and so on?"
Access options based on your plan
Access options: Employees
| Security group. | Access within the security group. | Standard. | Premium. | Platinum. |
|---|---|---|---|---|
| 360 Reviews. | ||||
| Documents. | ||||
| Custom Reports. | ||||
| Employee File (Financial details). | Banking Details. | You can grant access as a group. | You can grant access as a group. | You can grant access individually. |
| Tax Declaration Details. | ||||
| Superannuation Details. | ||||
| Employee File (Non-Payroll details). | Personal Details. | You can grant access as a group. | You can grant access as a group. | You can grant access individually. |
| Employment History. | ||||
| Uploaded Documents. | ||||
| Emergency Contacts. | ||||
| Work Eligibility. | ||||
| Management Notes. | ||||
| Audit Trail. | ||||
| Certifications. | ||||
| Medical Disclosure Statement. | ||||
| Employee File (Payroll details). | Employment Details. | You can grant access as a group. | You can grant access as a group. | You can grant access individually. |
| Employment History. | ||||
| Pay Details. | ||||
| Benefits (Allowances). | ||||
| Payroll Errors. | ||||
| Uploaded Documents. | ||||
| Leave Requests. | ||||
| Total compensation | ||||
| Goals and OKRs. | Company Level. | |||
| Team Level. | ||||
| Personal Level. | ||||
| Expense Claims (Expense Management). | ||||
| Leave Requests (Leave management). | ||||
| Reports (Engagement report). | ||||
| Reports. | ||||
| Reports (Assigned Learning report). | ||||
| Rostering Management. | ||||
| Timesheets. | ||||
| Safety module. |
Access options: Contractors
| Security group. | Standard. | Premium. | Platinum. |
|---|---|---|---|
| File details. | |||
| Document details. | |||
| Safety module for contractors. |
Access option: Other permissions
| Security group. | Standard. | Premium. | Platinum. |
|---|---|---|---|
| Post announcements to everyone. | |||
| Post announcements to teams. | |||
| API Access. | |||
| Manage asset register. | |||
| View asset register. | |||
| Knowledge base. | |||
| Leave calendar (My Leave Page HR web platform). | |||
| Leave Requests (Upcoming Events feature Swag app) | |||
| Offboarding. | |||
| One-on-one (1:1) | |||
| Onboarding (Onboarding employees). | |||
| Onboarding (Issue Employment Contracts). | |||
| Onboarding (Global teams) | |||
| Trigger Onboarding Checklists. | |||
| Re-activate employee. | |||
| Issue employee contracts. | |||
| Policies. | |||
| Recruitment settings (Hiring mangers can edit recruitment settings). | |||
| Recruitment (Manage all aspects of recruitment) | |||
| Review settings. | |||
| Template management. | |||
| Uploaded documents | |||
| Web Hooks. |
What happens to custom permissions when I downgrade my plan?
If you choose to downgrade your plan, you may lose access to some features available on the plan you have changed from. When this occurs, you will see a prompt for features that you previously set on your old plan that are not available to your new plan, requesting that you review your permissions.
On the Permission Settings page, you will also be notified of any groups affected by your plan downgrade, with a Revisions Needed status message.
Further information
Are any notifications triggered?
No, neither granting nor revoking Admin access will trigger an email notification to be sent to the affected user. The same goes for granting permissions via Permission Settings. Affected users will not be notified that their access has changed. They may just simply notice a difference in the appearance in the platform and the fields and features available to them when they next log in
Can I grant access to additional information tab?
No, only admins and the employee's managers will be able to access the employee's Additional Information tab.
Can I grant access to certification settings?
Yes you can grant access to certification settings. First go to the Permission Settings feature, and click the Other Permissions tab. Then if you scroll down to the General Setttings section you will see a Use option you can select for Certifciation Settings.
Can I grant access for employees to upload documentation?
Yes you can grant access for employees to upload documentation. First go to the Permission Settings feature, and click the Other Permissions tab. Then if you scroll down to the Uploaded Documents section you will see a Use option you can select, and then your employees can upload their own documents.
Can I grant access to employee requisitions?
Yes, you are able to give users access to View, Modify and/or Delete the employee requisition management workflows through your organisation's Permission Settings feature.
Explore related content
- Team Settings This feature allows you to create a new team when the need arises within your organisation, you can also edit existing information, disable a team, and delete an entry.
- Updating your company employment settings This feature allows you to customise your platform settings; for example, you can set what timesheet type you use.