Permissions: Full list of administrative access by role

About roles and permissions

Roles let you delegate parts of the payroll process to administrative users in your company without granting everyone full access to the books. Each role has a distinct set of permissions — or points of systematic access to company information and administrative actions — that are either enabled or disabled in OnPay.

Administrative users in OnPay will have one of the following roles:

• Owner
• HR Manager
• Approver
• Controller
• Outside Collaborator

This article details what each role can — and can't — do in OnPay.

 

 

What we'll cover

• Company Menu
• HR Menu
• Reports
• Notifications
• Employee Portal
• Partner Dashboard
• Employee information

 

Company Menu

The Company menu is where you do things like add users and adjust company settings, or set up pay items, workplaces, accruals, and even integrations with accounting and timekeeping software.

 

Summary of Company permissions by role

Owner

An Owner has full view and edit access to the company profile. They can see the company bank account, and verify test debits and credits.

HR Manager

While an HR Manager doesn’t have access to the company section, they can still enter payroll for the employees they supervise. They cannot finalize payroll.

Approver

An Approver can do just about anything the Owner can do, except:

• Add or remove users
• See the company bank account
• Verify test debits and credits

Controller

A Controller also has near-full access to everything, including entering payroll, but cannot:

• Add or remove users
• Change company preferences
• Finalize payroll 

Outside Collaborator

An Outside Collaborator is a member of an accounting firm who is not an employee of the company, but has access to manage payroll on the company's behalf. The Outside Collaborator's access will vary depending on how they are added to the company.

If the company is enrolled in OnPay by the accounting firm, the Outside Collaborator:

• Can add or remove other Outside Collaborators
• Can run payroll
• Can not add or remove company-level users

See all Company permissions by role

 

HR Menu

In the HR menu, you can approve PTO requests, view the employee directory, create file checklists, and more.

 

Summary of HR permissions by role

Owner

An Owner has full view and edit access to the HR menu.

HR Manager

An HR Manager does not have access to the HR menu.

Approver, Controller, Outside Collaborator

These roles have full view and edit access to the HR menu.

See all HR permissions by role

 

Reports

With Reports, you can analyze expenses and make better business decisions. While our report designer lets you include any information you want, we also have all the built-in reports you need every day ready to go. Our reports even adapt automatically to include items that are specific to your business.

 

Summary of Reports permissions by role

Owner

An Owner has access to all reports.

HR Manager

An HR Manager will have limited reporting for assigned employees only, with no access to employee or location summaries, accrual listings and retirement exports. 

Approver, Controller, Outside Collaborator

These roles have access to all reports.

See all Reports permissions by role

 

Notifications

Notifications keep everyone updated on things like the progress of tasks, new deadlines, or actions taken in OnPay by other users. What notifications you receive can depend on your role, managed settings, or the notification's relevance to your employees.

 

Summary of Notifications permissions by role

Owner

An Owner will receive all notifications.

HR Manager

An HR Manager will only receive paycheck confirmation notifications.

Approver

An Approver will receive all notifications, except for paycheck confirmation.

Controller

A controller will only receive paycheck confirmation notifications.

Outside Collaborator

An Outside Collaborator will receive almost all notifications. 

Employee

An employee will only receive paycheck notifications.

See all Notifications permissions by role

 

Employee Portal

Employees have a different dashboard than other roles in the company, called the Employee Portal. There, they can edit their personal info, see their paycheck and pay history, complete HR tasks assigned to them, even print their own W-2s. There are some things an employee can't do here, like change their own address without approval. These restrictions ensure employee tax withholdings and W-2s are processed correctly.

Note: Employees have lifetime access to this portal, ensuring their year-end forms and documents available to them forever, so you don't have to.

See all employee Portal permissions for employees

 

Partner Dashboard

The Partner Dashboard allows accountants to manage all their client's payroll in one place. There are two levels of access within the firm: Members and Administrators.

 

Summary of Partner Dashboard permissions by role

Members

A member is an employee of the firm who can only access the accounts they manage. They do not have the ability to add or change user access.

Administrators

An Administrator can view all accounts and manage user access in OnPay. There can be multiple administrators on a dashboard.

See all Partner Dashboard permissions by role

 

Employee information

In OnPay, Employee information is used for everything from printing checks to withholding taxes, and includes private information like their home address, social security number, and pay rate. This means that access to employee information is restricted, based on your access level and your connection to the employee.

 

Summary of Employee information permissions by role

Owner

An Owner has full access to the profile

HR Manager

An HR Manager can only manage the payroll of the employees assigned to them. They have no access to the email builder used to invite an employee to complete their onboarding process. However, they can manually hire employees. Note: HR Managers can not finalize payroll or view reports.  

When viewing assigned employees, HR Managers can:

• Enter hours
• Update HR information in employee profiles
• Send email invitation to the Employee Portal
• Manage checklists
• File Audit - Create personnel task
• View personnel files and upload documents
• Create new Notes
• Start conversations 
• View custom forms

Approver

An Approver has full access to the profile

Controller

A Controller has full access to the employee profile except their bank account

Outside Collaborator

✱An Outside Collaborator can run and approve payroll if this access is granted by the Owner. All Outside Collaborators have full access to the employee profile, with the exception of their bank account.

See all Employee information access by role

 

v6.22