This is step 1 of 2 of the implementation module Employee Roles & Approval Workflows.

This article explains what employee roles are in Personio, how they connect to access rights, and how to combine both to either extend or limit your employees' access to company information.

What are the benefits?

• Cover your organization's internal requirements regarding permissions and restrictions. The combination of employee roles and access rights allows you to limit your employees' access to certain areas in Personio so that they can only see and update what is intended for them.
• Configure very specific sets of access rights to support temporary needs. The combination of employee roles and access rights allows you to grant certain employees access to a specific section for a limited amount of time (for example, creating a temporary approver to look after a specific team's approval requests during a supervisor's absence).

Step 1: Add employees to an employee role

Your Personio account comes with two types of employee roles by default:

• Preset employee roles: 
  
  ▶︎ All employees role: This role includes all your active employees. Every new employee gets automatically added to this role, so you cannot manually add or remove any employees from this role. This role can be neither renamed nor deleted.
  
  ▶︎ Administrator role (or any role with Administrator rights): This role is the counterpart to the All employees role, and no employee gets automatically assigned to it. Therefore, you can manually add and remove employees from this role (we recommend that you add only a couple of employees). This role can be renamed, but cannot be deleted, as one employee will always need to remain added. 
  
  
• Custom employee roles:
  
  ▶︎ HR manager role, Management role, Intern role, etc.: These roles are not linked to other functionalities in Personio, and therefore can be freely edited. You can also create as many additional custom employee roles as you need.

  Note
  We recommend that you create as few additional custom roles as possible, to keep better track of your employees' access rights and also to avoid having duplicate custom roles.

To add employees to a custom employee role (or to the Administrator preset role), follow these steps:

1. Go to Settings > People > Employee roles.
2. Either click on an existing employee role under Employee Roles, or click Create new role to create a new custom employee role (in that case, also enter a name for the new custom employee role and click Create role).
3. The column Added employees will show all the employees who are currently added to the role. If you create a new custom employee role, this column will show 0 employees, as no employee has been added yet. 
4. Click on an employee under Available employees to add them to the employee role. The employee will change columns and will now appear under Added employees with a blue outline. 
5. Click on an employee under Added employees to remove them from the role. The employee will change columns and will now appear under Available employees with a red outline. 
6. If needed, click on the pencil icon next to the name of the employee role to rename it.
7. If needed, click on the three dots icon under Create new role to either copy (create a duplicate) or delete the employee role (only applicable to custom employee roles). To delete a custom employee role, you must first remove all employees from the role.
8. Click Save to implement the changes. 

Note
If you set an employee’s status to Inactive, the employee will no longer appear (either as an Added employee or as an Available employee) in the employee role.

Step 2: Set up access rights for the employee role

Access rights are divided into categories (People Data and Configurations), access rights (View, Propose and Edit) and access areas (Own, My reports, Custom, All). 

The combination of access rights and access areas allows you to either strengthen or weaken the access rights. This will also depend on the type of employee role:

• Preset employee roles: 
  
  ▶︎ All Employees role: As this role is automatically assigned to all new employees, it must contain a very basic set of access rights.
  ▶︎ Administrator role (or any role with Administrator rights): This role contains full access rights, and the level of access rights cannot be modified. 
  
  
• Custom employee roles:
  
  ▶︎ HR manager role, Management role, Intern role, etc.: As these roles are manually assigned to certain employees, they must contain a very specific set of access rights.

To configure the access rights for a specific custom employee role (or for the All employees role), follow these steps:

1. Go to Settings > People > Employee roles.
2. Click on the relevant employee role under Employee Roles and navigate to the Access rights tab.
3. Define the access rights for each section and subsection with the information that you will find in the articles Access rights and Best Practice: Employee Roles. 
4. Check the access rights configuration by logging into an employee's Personio account. To do so, navigate to the respective employee's profile and click on the Login as this employee icon in the top-right corner.
   
   

Step 3: Set up Company Calendar access for the employee role

We recommend that you also set up access to the Company Calendar for each specific employee role. Otherwise, Personio will automatically apply the default Company Calendar access from the All employees role.

To set up access to the Company Calendar for a specific custom employee role (or for the All employees role), follow these steps:

1. Go to Settings > People > Employee roles.
2. Click on the relevant employee role under Employee Roles and navigate to the Calendars tab.
3. Define the access to the Company Calendar and also to the different absence types. Learn more in the article Set up access to the Company Calendar.
4. Check the Company Calendar access configuration by logging into an employee's Personio account. To do so, navigate to the respective employee's profile and click on the Login as this employee icon in the top-right corner.

Note
Optionally, you can also set up reminders and enable 2FA authentication for each role. 

Next steps

Congratulations 🎉
You are ready to move on and Set up approval workflows in Personio.