Roles let you delegate parts — or all — of the payroll process to various administrators in your company without granting everyone full access to your OnPay account. Each role comes with a distinct set of permissions controlling what they can see and do in the company account.

Roles for administrators

• Owner
• HR Manager
• Approver
• Controller
• Outside Collaborator

This article details what each role can — and can't — do in OnPay.

When adding company users in OnPay, they are granted instant access to all permissions associated with the role you choose. This lets you control some pretty important things, like who can see who's compensation information, or approve PTO, or run payroll. You can even hire outside accountants or consultants to collaborate in the payroll process.

Company Menu

The Company menu is where you do things like add users and adjust company settings, or set up pay items, workplaces, accruals, and even integrations with accounting and timekeeping software.

Summary of Company permissions by role

Owner

An Owner has full view and edit access to the company profile. They can see the company bank account, verify test debits and credits, run payroll, and request support.

HR Manager

While an HR Manager doesn’t have access to the company section, they can still enter payroll for the employees they supervise. They cannot finalize payroll.

Approver

An Approver can do just about anything the Owner can do, except:

• Add or remove users
• See the company bank account
• Verify test debits and credits

Controller

A Controller also has near-full access to everything, including entering payroll, but cannot:

• Add or remove users
• Change company preferences
• Finalize payroll 

Outside Collaborator

An Outside Collaborator is an administrative user who is not an employee of the company, but has access to manage payroll on the company's behalf. This is often a member of an accounting firm, but this role can be used for anyone who a company wishes to grant access to part or all of their company account. The Outside Collaborator's access will vary depending on how they are added to the company.

If the company is enrolled in OnPay by the Outside Collaborator:

• Can add or remove other Outside Collaborators
• Can run payroll
• Can not add or remove company-level users

See all Company permissions by role

HR Menu

In the HR menu, you can approve PTO requests, view the employee directory, create file checklists, and more.

Summary of HR permissions by role

Owner

An Owner has full view and edit access to the HR menu.

HR Manager

An HR Manager does not have access to the HR menu.

Approver, Controller, Outside Collaborator

These roles have full view and edit access to the HR menu.

See all HR permissions by role

Reports

With Reports, you can analyze expenses and make better business decisions. While our report designer lets you include any information you want, we also have all the built-in reports you need every day ready to go. Our reports even adapt automatically to include items that are specific to your business.

Summary of Reports permissions by role

Owner

An Owner has access to all reports.

HR Manager

An HR Manager will have limited reporting for assigned employees only, with no access to employee or location summaries, accrual listings and retirement exports. 

Approver, Controller, Outside Collaborator

These roles have access to all reports.

See all Reports permissions by role

Notifications

Notifications keep everyone updated on things like the progress of tasks, new deadlines, or actions taken in OnPay by other users. What notifications you receive can depend on your role, managed settings, or the notification's relevance to your employees.

Summary of Notifications permissions by role

Owner

An Owner will receive all notifications.

HR Manager

An HR Manager will only receive paycheck confirmation notifications.

Approver

An Approver will receive all notifications, except for paycheck confirmation.

Controller

A controller will only receive paycheck confirmation notifications.

Outside Collaborator

An Outside Collaborator will receive almost all notifications. 

Employee

An employee will only receive paycheck notifications.

See all Notifications permissions by role

Employees

Employee Portal permissions for employees

Employees have a different dashboard than other roles in the company, called the Employee Portal. There, they can edit their personal info, see their paycheck and pay history, complete HR tasks assigned to them, even print their own W-2s. There are some things an employee can't do here, like change their own address without approval. These restrictions ensure employee tax withholdings and W-2s are processed correctly.

Note: Employees have lifetime access to this portal, ensuring their year-end forms and documents available to them forever, so you don't have to.

See Employee Portal permissions for employees

Partner Dashboard

The Partner Dashboard allows accountants to manage all their client's payroll in one place. There are two levels of access within the firm: Members and Administrators.

Summary of Partner Dashboard permissions by role

Members

A member is an employee of the firm who can only access the accounts they manage. They do not have the ability to add or change user access.

Administrators

An Administrator can view all accounts and manage user access in OnPay. There can be multiple administrators on a dashboard.

See all Partner Dashboard permissions by role

Employee information

In OnPay, Employee information is used for everything from printing checks to withholding taxes, and includes private information like their home address, social security number, and pay rate. This means that access to employee information is restricted, based on your access level and your connection to the employee.

Summary of Employee information permissions by role

Owner

An Owner has full access to the profile

HR Manager

An HR Manager can only enter hours and earnings of the employees assigned to them (Legacy pay run only). They have no access to the email builder used to invite an employee to complete their onboarding process. However, they can manually hire employees. Note: HR Managers can not finalize payroll or view reports.  

When viewing assigned employees, HR Managers can:

• Enter hours (Legacy pay run only)
• Update HR information in employee profiles
• Send email invitation to the Employee Portal
• Manage checklists
• File Audit - Create personnel task
• View personnel files and upload documents
• Create new Notes
• Start conversations 
• View custom forms

Approver

An Approver has full access to the profile

Controller

A Controller has full access to the employee profile except their bank account

Outside Collaborator

✱An Outside Collaborator can run and approve payroll if this access is granted by the Owner. All Outside Collaborators have full access to the employee profile, with the exception of their bank account.

See all Employee information access by role

v7.25