{"article":{"id":360058295452,"url":"https://onpay.zendesk.com/api/v2/help_center/en-us/articles/360058295452.json","html_url":"https://help.onpay.com/hc/en-us/articles/360058295452-Permissions-Administrative-access-by-role","author_id":396747559011,"comments_disabled":false,"draft":false,"promoted":false,"position":10,"vote_sum":3,"vote_count":15,"upvote_count":9,"downvote_count":6,"section_id":36311104177563,"created_at":"2021-03-19T15:21:43Z","updated_at":"2025-10-20T14:42:44Z","name":"Permissions: Administrative access by role","title":"Permissions: Administrative access by role","source_locale":"en-us","locale":"en-us","outdated":false,"outdated_locales":[],"edited_at":"2025-04-21T17:13:13Z","user_segment_id":null,"permission_group_id":1360752,"content_tag_ids":[],"label_names":["b8vqjh4ghryo7nxw","3w7eqrx52cu557xg","aeqmg7vyq6yjbr35","cwpu2c5g9am79xyx","2gc72bbpyf28dvr6","d6gzack4v2hq4wg8","uejjnvy4rvqwc3rs","a45665qmmws3wjnw","h3hw72z8up5krevj","67tu3fcsqdncf599","knwx73rqu85546vb","qnukwrs4d6k38q75","2j4tsyps38fevz2u","9j7d838hnw5at262","tjs2f6zns3sfm4um","cvcpefg94c3ycjsn","geygwhzj3f7c2gt5","j6hssjz438rzeef3","8f2zk3w73vvx2rhv"],"body":"

Roles let you delegate parts — or all — of the payroll process to various administrators in your company without granting everyone full access to your OnPay account. Each role comes with a distinct set of permissions controlling what they can see and do in the company account.

\n

Roles for administrators

\n\n

This article details what each role can — and can't — do in OnPay.

\n

When adding company users in OnPay, they are granted instant access to all permissions associated with the role you choose. This lets you control some pretty important things, like who can see who's compensation information, or approve PTO, or run payroll. You can even hire outside accountants or consultants to collaborate in the payroll process.

\n

 

\n

Company Menu

\n

The Company menu is where you do things like add users and adjust company settings, or set up pay items, workplaces, accruals, and even integrations with accounting and timekeeping software.

\n

\"2024-08-13_14-50-43.jpg\"

\n

 

\n

Summary of Company permissions by role

\n

Owner

\n

An Owner has full view and edit access to the company profile. They can see the company bank account, verify test debits and credits, run payroll, and request support.

\n

HR Manager

\n

While an HR Manager doesn’t have access to the company section, they can still enter payroll for the employees they supervise. They cannot finalize payroll.

\n

Approver

\n

An Approver can do just about anything the Owner can do, except:

\n\n

Controller

\n

A Controller also has near-full access to everything, including entering payroll, but cannot:

\n\n

Outside Collaborator

\n

An Outside Collaborator is an administrative user who is not an employee of the company, but has access to manage payroll on the company's behalf. This is often a member of an accounting firm, but this role can be used for anyone who a company wishes to grant access to part or all of their company account. The Outside Collaborator's access will vary depending on how they are added to the company.

\n

If the company is enrolled in OnPay by the Outside Collaborator:

\n\n

See all Company permissions by role

\n
\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
\n

Role

\n		\n

Owner

\n		\n

HR Manager

\n		\n

Approver

\n		\n

Controller

\n		\n

Outside Collaborator

\n
\n

Company Menu

\n		\n

✓

\n		\n

No Access

\n		\n

✓

\n		\n

✓

\n		\n

✓

\n
\n

Add/Remove Users

\n		✓ No Access No Access \n

No Access

\n		\n

No Access

\n
\n

Integrations

\n		✓ \n

No Access

\n		✓ \n

✓

\n		\n

✓

\n
\n

Taxes

\n		✓ No Access ✓ ✓ ✓
\n

Pay Items

\n		✓ No Access ✓ ✓ ✓
\n

Worker Deductions

\n		✓ No Access ✓ ✓ ✓
\n

Loc/Dep/Pos

\n		✓ No Access ✓ ✓ ✓
\n

Request support

\n		✓✓✓✓✓
\n

 

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
\n

Role

\n		\n

Owner

\n		\n

HR Manager

\n		\n

Approver

\n		\n

Controller

\n		\n

Outside Collaborator

\n
\n

Workers' Comp

\n		✓ No access ✓ ✓ ✓
\n

Accrual Policies

\n		✓ No access ✓ ✓ ✓
\n

Payment History

\n		✓ No access ✓ ✓ ✓
\n

Bank Transactions*

\n		✓ No access ✓ ✓ ✓
\n

Company Preferences

\n		✓ No access ✓ No access ✓
\n

Payroll 

\n		✓ No access ✓ Enter Hours ✓***
\n

Payroll (Legacy)

\n		✓ Enter Hours** ✓ Enter Hours ✓***
\n

*Bank Transactions are the debits and credits resulting from payroll ACH. Once a company bank account has been verified, it can only be changed by contacting OnPay. This is to protect your account.
**HR Managers can only enter hours and earnings for workers assigned to them (Legacy pay run only)
***If allowed by the company Owner. See how→

\n

 

\n
\n

HR Menu

\n

In the HR menu, you can approve PTO requests, view the employee directory, create file checklists, and more.

\n

\"2024-08-13_15-06-26.jpg\"

\n

 

\n

Summary of HR permissions by role

\n

Owner

\n

An Owner has full view and edit access to the HR menu.

\n

HR Manager

\n

An HR Manager does not have access to the HR menu.

\n

Approver, Controller, Outside Collaborator

\n

These roles have full view and edit access to the HR menu.

\n

See all HR permissions by role

\n
\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Role\n

Owner

\n		\n

HR Manager

\n		\n

Approver

\n		\n

Controller

\n		\n

Outside Collaborator

\n
\n

HR Menu

\n		✓ \n

No access

\n		✓ ✓ ✓
\n

Approve PTO

\n		✓ No access ✓ ✓ ✓
\n

View Org Chart

\n		✓ \n

No access

\n		✓ ✓ ✓
\n

View Employee Directory

\n		✓ No access ✓ ✓ ✓
View Employee Offers✓ No access ✓ ✓ ✓
\n

Create File Checklists

\n		✓ No access ✓ ✓ ✓
\n

Edit File Audit

\n		✓ No access ✓ ✓ ✓
\n

Complete File Reviews

\n		✓ No access ✓ ✓ ✓
\n

 

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Role\n

Owner

\n		\n

HR Manager

\n		\n

Approver

\n		\n

Controller

\n		\n

Outside Collaborator

\n
\n

Create Personnel Task

\n		✓ No access ✓ ✓ ✓
\n

Onboarding Tasks

\n		✓ No access ✓ ✓ ✓
\n

Templates

\n		✓ No access ✓ ✓ ✓
\n

Task Templates

\n		✓ No access ✓ ✓ ✓
\n

Custom Forms

\n		✓ No access ✓ ✓ ✓
\n

Worker Files

\n		✓ No access ✓ ✓ ✓
\n

Company Files

\n		✓ No access ✓ ✓ ✓
\n

Engagement

\n		✓ No access ✓ ✓ ✓
\n
\n

 

\n

Reports

\n

With Reports, you can analyze expenses and make better business decisions. While our report designer lets you include any information you want, we also have all the built-in reports you need every day ready to go. Our reports even adapt automatically to include items that are specific to your business.

\n

\"2024-08-13_15-58-32.jpg\"

\n

 

\n

Summary of Reports permissions by role

\n

Owner

\n

An Owner has access to all reports.

\n

HR Manager

\n

An HR Manager will have limited reporting for assigned employees only, with no access to employee or location summaries, accrual listings and retirement exports. 

\n

Approver, Controller, Outside Collaborator

\n

These roles have access to all reports.

\n

See all Reports permissions by role

\n
\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Role\n

Owner

\n		\n

HR Manager

\n		\n

Approver

\n		\n

Controller

\n		\n

Outside Collaborator

\n
\n

Reports

\n		✓ \n

Assigned employees

\n		✓ ✓ ✓
\n

Payroll Listing

\n		✓ Assigned employees ✓ ✓ ✓
\n

Earnings Summary

\n		✓ \n

Assigned employees

\n		✓ ✓ ✓
\n

Payroll Register

\n		✓ Assigned employees ✓ ✓ ✓
Payroll Summary✓ Assigned employees ✓ ✓ ✓
\n

Employee Summary

\n		✓ No access ✓ ✓ ✓
\n

Loc/Dep/Pos summary

\n		✓ No access ✓ ✓ ✓
\n

 

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Role\n

Owner

\n		\n

HR Manager

\n		\n

Approver

\n		\n

Controller

\n		\n

Outside Collaborator

\n
\n

GL Summary

\n		✓ Assigned employees ✓ ✓ ✓
\n

Accrual Listing

\n		✓ No access ✓ ✓ ✓
\n

WC Listing

\n		✓ Assigned employees ✓ ✓ ✓
\n

WC Summary

\n		✓ Assigned employees ✓ ✓ ✓
\n

Retirement Listing

\n		✓ Assigned employees ✓ ✓ ✓
\n

Retirement Summary

\n		✓ Assigned employees ✓ ✓ ✓
\n

Retirement Export

\n		✓ No access ✓ ✓ ✓
\n

 

\n
\n

 

\n

Notifications

\n

Notifications keep everyone updated on things like the progress of tasks, new deadlines, or actions taken in OnPay by other users. What notifications you receive can depend on your role, managed settings, or the notification's relevance to your employees.

\n

\"2024-08-13_16-05-19.jpg\"

\n

 

\n

Summary of Notifications permissions by role

\n

Owner

\n

An Owner will receive all notifications.

\n

HR Manager

\n

An HR Manager will only receive paycheck confirmation notifications.

\n

Approver

\n

An Approver will receive all notifications, except for paycheck confirmation.

\n

Controller

\n

A controller will only receive paycheck confirmation notifications.

\n

Outside Collaborator

\n

An Outside Collaborator will receive almost all notifications. 

\n

Employee

\n

An employee will only receive paycheck notifications.

\n

See all Notifications permissions by role

\n
\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Role\n

Owner

\n		\n

HR Manager

\n		\n

Approver

\n		\n

Controller

\n		\n

Outside Collaborator

\n		\n

Employee

\n
\n

Payroll is due

\n		✓ ✗ ✓ ✗ \n

Limited

\n		\n

✗

\n
\n

Employee direct deposit is changed

\n		✓ ✗ ✓ ✗ \n

✗

\n		\n

✓

\n
\n

Employee address changed

\n		✓ ✗ ✓ ✗ \n

✓

\n		\n

✓

\n
\n

Employee Tax Withholding

\n		✓ ✗ ✓ ✗ ✓ ✗
Employee PTO request✓ ✗ ✓ ✗ ✓
✗
\n

Employee invitation is complete

\n		✓ ✗ ✓ ✗ ✓ ✗
\n

You’ve been paid!

\n		✓ ✗ ✗ ✗ ✗ ✓
\n

Login from  a new browser

\n		✓ ✓ ✓ ✓ ✓
✓
\n

 

\n
\n

 

\n

Employees

\n

Employee Portal permissions for employees

\n

Employees have a different dashboard than other roles in the company, called the Employee Portal. There, they can edit their personal info, see their paycheck and pay history, complete HR tasks assigned to them, even print their own W-2s. There are some things an employee can't do here, like change their own address without approval. These restrictions ensure employee tax withholdings and W-2s are processed correctly.

\n

\"2024-08-14_13-23-57.jpg\"

\n

Note: Employees have lifetime access to this portal, ensuring their year-end forms and documents available to them forever, so you don't have to.

\n

See Employee Portal permissions for employees

\n
\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Access\n

Employee can view

\n		\n

Employee can edit

\n
\n

View Pay Stub

\n		✓ Download and print only
\n

Assigned HR tasks 

\n		✓ Can mark as completed
\n

Personal Info

\n		✓ Name, number, birthdate, or SSN if approved by a supervisor
\n

Job

\n		✓ Changes to FIT or SIT must be approved by a supervisor
Bank Account✓ New bank accounts must be approved by a supervisor
\n

Request PTO

\n		✓ Time off requests must be approved by a supervisor
\n

Company Files

\n		✓ Can upload files
\n

W-2

\n		✓ Download and print only
\n

 

\n
\n

 

\n

Partner Dashboard

\n

The Partner Dashboard allows accountants to manage all their client's payroll in one place. There are two levels of access within the firm: Members and Administrators.

\n

\"2024-08-14_13-38-41.jpg\"

\n

 

\n

Summary of Partner Dashboard permissions by role

\n

Members

\n

A member is an employee of the firm who can only access the accounts they manage. They do not have the ability to add or change user access.

\n

Administrators

\n

An Administrator can view all accounts and manage user access in OnPay. There can be multiple administrators on a dashboard.

\n

See all Partner Dashboard permissions by role

\n
\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Access\n

Members

\n		\n

Administrators

\n
\n

Enroll new accounts in the dashboard

\n		✓ ✓
\n

Add and Remove client-level users

\n		Limited* Limited*
\n

Access companies they are assigned to

\n		✓ ✓
\n

Add/remove other firm-level members to an account as an outside collaborator

\n		✗ ✓
\n

Access to the FULL partner dashboard

\n		✗ ✓
Create offices for the firm dashboard✗ ✓
\n

Add/remove members to the dashboard

\n		✗ ✓
\n
\n

*Outside Collaborators:

\n\n
\n

 

\n
\n

 

\n

Employee information

\n

In OnPay, Employee information is used for everything from printing checks to withholding taxes, and includes private information like their home address, social security number, and pay rate. This means that access to employee information is restricted, based on your access level and your connection to the employee.

\n

\"2024-08-14_13-43-18.jpg\"

\n

 

\n

Summary of Employee information permissions by role

\n

Owner

\n

An Owner has full access to the profile

\n

HR Manager

\n

An HR Manager can only enter hours and earnings of the employees assigned to them (Legacy pay run only). They have no access to the email builder used to invite an employee to complete their onboarding process. However, they can manually hire employees. Note: HR Managers can not finalize payroll or view reports.  

\n

When viewing assigned employees, HR Managers can:

\n\n

Approver

\n

An Approver has full access to the profile

\n

Controller

\n

A Controller has full access to the employee profile except their bank account

\n

Outside Collaborator

\n

✱An Outside Collaborator can run and approve payroll if this access is granted by the Owner. All Outside Collaborators have full access to the employee profile, with the exception of their bank account.

\n

See all Employee information access by role

\n
\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Role\n

Owner

\n		\n

HR Manager

\n		\n

Approver

\n		\n

Controller

\n		\n

Outside Collaborator

\n
\n

Home Address

\n		✓ ✓ ✓ ✓ ✓
\n

Run Payroll

\n		✓ Enter hours only ✓ \n

Can't finalize

\n		\n

✱

\n
\n

Add Compensation

\n		✓ ✓ ✓ ✓ ✓
\n

Add Deductions

\n		✓ ✓ ✓ ✓ ✓
Withholding✓ ✓ ✓ ✓ ✓
\n

Bank account

\n		✓ ✗ ✓ ✗ ✗
\n

Emergency Info

\n		✓ ✓ ✓ ✓ ✓
\n

 

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Role\n

Owner

\n		\n

HR Manager

\n		\n

Approver

\n		\n

Controller

\n		\n

Outside Collaborator

\n
\n

Create a task for the employee

\n		✓ ✓ ✓ ✓ ✓
Assign Time off Policies✓ ✓ ✓ ✓ ✓
\n

Hire worker send an offer letter

\n		✓ ✗ ✓ ✓ ✓
\n

Add an employee

\n		✓ ✓ ✓ ✓ ✓
\n

Add a contractor

\n		✓ Invite only ✓ ✓ ✓
\n

View checks / w-2

\n		✓ ✓ ✓ ✓ ✓
\n

Audit Log

\n		✓ ✓ ✓ ✓ ✓
\n
\n

 

\n

v7.25

\n

 

","user_segment_ids":[]}}