Manage user roles and permissions
Configure role access for subscribed applications and assign roles to employees.
This guide explains how to create and manage role access in the HRIS + Payroll system. It covers how to define roles, assign permissions, and map employees to specific roles to control system access based on job responsibilities.
Purpose
To help users:
- Create and manage roles in the system
- Assign access permissions based on job functions
- Control employee access to specific modules and features
- Assign one or multiple roles to employees
Prerequisites
- User must have access to the User Management module
- Admin privileges are required to create and modify roles
- Employee records must already exist in the system
Step 1: Navigate to the Employee Module
To begin, navigate to the HRIS + Payroll application.
Once inside the system, locate and click the Employee module.
Step 2: Open User Management Settings
In the upper-right corner of the Employee module, click the Settings button.
Inside Settings, select and open the User Management section.
Step 3: Select Subscription
Inside User Management, a Subscription Selection dropdown will appear. Select the subscribed application where you want to configure role access.
Below are the available subscriptions and their functions:
- HRIS + Payroll – Used for managing employee records, schedules, attendance, and payroll processing.
-
Employee Portal – Allows employees to view their own attendance, payslips, and personal information. Employees can also file requests, while approvers can approve or reject requests through the portal.
-
Daily Time Record (DTR) – A built-in web-based attendance module where employee punches automatically reflect in HRIS + Payroll. It is commonly used as a backup attendance method. Employees can create attendance logs using only their Employee Code. However, since punching can be done remotely and location tracking is not visible, it is not recommended to grant access to all employees to avoid possible misuse.
-
Mobile – This module is used for configuring geofencing and geotagging settings.
-
ZKTeco – This module contains the configuration settings for biometric devices connected to the system.
-
Workforce Management Applications – These applications are designed to manage employees within specific operational environments, including their workforce, attendance, and payroll. This includes Project Site Management (PSM), Manpower Management, and Restaurant Management.
-
Inventory – This module is used for inventory management and setup.
-
Accounting – This module is used for accounting-related processes and configurations.
Note: Only the subscriptions or modules you availed from SprintHR will appear in the Subscription Selection list.
Step 4: Customizing Role Access to HRIS + Payroll
Under the HRIS + Payroll subscription, the system contains two default roles: Super Admin and HRIS Payroll Admin.
Under each role, you will be able to view the currently assigned access permissions and accessible modules.
To create and customize a new role, click the Add New Role button.
Once clicked, a pop-up modal will appear. Before setting up the permissions, you must first enter the Role Name. It is recommended to use a role name based on the employee’s job function or access level to avoid confusion during role assignment.
After entering the Role Name, the Role Permission section will appear below where you can customize the employee’s role access and module permissions. If the Administrator Access option is enabled, the role will have full system access. Below the Administrator Access option, you will find the different modules available under HRIS + Payroll. Manage Employee This section controls access to the Employee Module. The permissions under this section determine which employee-related features the user can access.
It is important to always enable the Access Employee permission before granting other employee-related permissions. If Access Employee is not enabled, the user will still be restricted from accessing employee information even if other permissions are checked because most modules rely on employee access visibility. Manage Schedule This section controls access to employee schedules. Users with this permission can create schedules and assign schedules to employees.
Manage Attendance This section controls access to attendance logs, attendance processing, and attendance-related requests. Users may also process attendance and create requests on behalf of employees if permitted.
Before granting other attendance permissions, ensure that Access Attendance is enabled. Manage Timesheet This section allows users to access, view, and download timesheet reports after attendance processing. To fully access this module, both Access Timesheet and the specific Timesheet permissions must be enabled.
Manage Payroll This section controls payroll-related processes such as adding payroll data and processing payroll. You may customize which payroll modules the employee can access.
Manage Approval This section controls access to approval management. Users with approval access can approve, disapprove, or edit employee requests directly within HRIS + Payroll even if the assigned approver has not yet taken action in the Employee Portal.
Ensure that Access Approval is enabled before using this module. Manage Reports This section controls access to system-generated reports. Users can only access report modules if Access Report is enabled.
Manage Import This section controls access to system import modules and determines which users are allowed to import records into the system.
Salary Visibility This option allows you to hide employee salary information for the selected role. To enable this restriction, simply check the Hide Salary option.
After configuring the custom role and permissions, click the Submit button to save the role. Once the role is successfully created, you may assign employees under that role by clicking the Users button beside the role.
From the employee list, simply check the employee(s) you want to assign, then click Add Selected.
Step 5: Applying Role Access to Employee Portal
Under the Employee Portal subscription, the system contains 3 default roles: Super Admin, Employee, and Employee Staff
- Employee – This role is commonly assigned to employees who are configured as approvers in the system. Users under this role can access Employee Portal features and approval-related functions.
- Employee Staff – This role is assigned to regular employees who are not configured as approvers. Users under this role can access their own employee information, attendance, payslips, and request filing features only.
Step 6: Applying Role Access to Daily Time Record
Under the Daily Time Record subscription, the system contains two default roles: Super Admin and Daily Time Record.
- Daily Time Record – This role allows users to access and manage the Daily Time Record application.
Step 7: Applying Role Access to Mobile
Under the Mobile subscription, the system contains two default roles: Super Admin and Mobile Admin.
- Mobile Admin – This role allows users to configure mobile application settings such as geofencing and geotagging, and assign employees to these configurations.
Step 8: Applying Role Access to ZKTeco
Under the ZKTeco subscription, the system contains two default roles: Super Admin and Biometric Device Staff.
- Biometric Device Staff – This role allows users to manage biometric device settings, including synchronization of attendance data and user information transfer within the ZKTeco module.
Step 9: Applying Role Access to Workforce Management Applications
The Workforce Management Applications include Project Site Management (PSM), Manpower Management, and Restaurant Management. These applications are designed to manage employees within specific operational environments, including their workforce, attendance, and payroll. Each application contains two default roles: Super Admin and an application-specific role, such as PSM, Restaurant Management, or Manpower Management. If you want to customize a new role under this subscription, simply click the Add New Role button.
Within the role configuration, you may customize which modules and features will be accessible to the role under the selected Workforce Management application. To assign permissions, check the corresponding checkbox for each module. Select the checkbox under Access to allow the user to view the module, or select the checkbox under Manage to allow the user to view and modify records.
After configuring the required permissions, click Submit to save the role configuration.
Important Note: The permissions commonly use the terms Access and Manage:
- Access – Allows the user to view or access the module only without making changes.
- Manage – Allows the user to both view and modify records within the module.
Step 10: Applying Role Access to Inventory
Under the Inventory subscription, the system contains four default roles: Super Admin, Inventory Admin, Warehouse Staff, and Site Staff.
- Inventory Admin – Manages both inventory and purchase order modules.
- Warehouse Staff – Manages warehouse-related modules only.
- Site Staff – Manages site-related inventory modules only. You may also create and customize new roles under this subscription by clicking the Add New Role button. Inside the customization window, simply select the permissions that will be accessible for the customized role.
Step 11: Applying Role Access to Accounting
Under the Accounting subscription, the system contains two default roles: Super Admin and Accounting Admin.
Users may also create custom roles by clicking Add New Role to define specific access permissions based on their requirements. These access permissions are intended for use within the Finance Tracker application.
Expected result
- Roles are successfully created and configured in the system
- Employees are properly assigned to their designated roles
- Access permissions are correctly applied based on role configuration
- Users can only access modules and features allowed by their assigned roles
Troubleshooting
- Role not appearing after creation
- Verify that the role was successfully submitted and saved
- Unable to assign employees to a role
- Ensure employee records already exist in the system
- Verify that you have sufficient administrator permissions
- Assigned permissions are not reflecting
- Ask the user to log out and log back in to refresh permissions
- Verify that the correct subscription/module was configured
- Cannot edit or delete a role
- Check if the role is system-generated (e.g., Super Admin)
- Only custom-created roles can be modified or deleted
- User cannot access module despite assigned role
- Verify that the corresponding Access permission is enabled
- Check if the employee was properly added under the selected role
Notes
- Roles and permissions vary depending on the subscribed application/module
- Multiple employees can be assigned under one role
- Some subscriptions contain default system-generated roles that cannot be deleted
- It is recommended to use clear and descriptive role names based on job functions
- Always verify Access permissions before enabling module-specific permissions
- Only authorized administrators should manage roles and permissions to maintain system security
- Assigning the Super Admin role to employees is done through the Account module setting