This article explains how to set up permissions and employee roles. The two are closely linked in Personio, as permissions can’t be granted directly to individuals—they’re always managed through employee roles.

Tip:
If you're new to setting up employee roles and permissions, start by reading the Overview of permissions and employee roles article. It covers the basics of permissions and how employee roles function.

Before you start

• Permissions: You need to have an Administrator role to be able to set up permissions.

Set up the employee role's permissions 

To set up permissions for an employee role, follow these steps:

1. Go to Settings.
2. In the People section, click Roles & permissions.
3. Create a new employee role or choose an existing one.
4. In the Permissions tab, set up the necessary permissions. If you’re unsure which permissions are recommended for each employee role in your company, we recommend reviewing the following articles:
   - Grant permissions for everyday tasks in Personio
   - Overview of the most common employee roles and permissions
   - Summary of permissions
5. Once you have set up the permissions, you can verify that employees assigned to that role have the correct permissions. Go to an employee's profile and log in as that employee. This allows you to see exactly what they see, so you can verify that their access is correct.

Manually add employees to an employee role

To add employees to a custom employee role (or to the Administrator preset role):

1. Go to Settings.
2. In the People section, click Roles & permissions.
3. Create a new employee role or choose an existing one.
4. In the People tab, click Edit members.
5. In the Add people tab, under Select members, choose the employees to assign this role to and click their names. They will appear in the Members preview.
6. Save your edits.

Automatically add employees to an employee role

You can automatically add employees to roles by setting conditions based on system and custom attributes:

1. Go to Settings.
2. In the People section, click Roles & permissions.
3. Create a new employee role or choose an existing one.
4. In the People tab, click Edit members.
5. In the Add people tab, under People added based on conditions, click + Add rule to add an attribute and auto-filter employees matching that criteria. For example, adding "Office is Barcelona" will automatically assign both new and existing Barcelona-based employees to that role with its permissions.
6. Save your edits.

Tip:
You can automatically add employees to a role while excluding specific ones by selecting them in the Exclude people tab. If you select an employee as excluded and then add them to the role, the exclusion is overwritten.

You can use the following predefined attributes to set conditions:

• Department
• Team
• Employment type
• Legal entity
• Workplace
• Status
• Supervisor status (with this attribute, you can automatically add every supervisor to a role).
• Hire date
• Termination date

You can also use custom attributes that have a single selection, date, or numbers attribute type.

Note:
If you set a condition like “Attribute A is not Option 1”, then the following employees are included:
▶︎ All employees who have another option value, for example, Option 2, Option 3, etc.
▶︎ All employees with no assigned value for that attribute.

Remove employees from an employee role

To remove employees from an employee role:

1. Go to Settings.
2. In the People section, click Roles & permissions.
3. Create a new employee role or choose an existing one.
4. In the People tab, click Edit members.
5. In the Add people tab, under Select members, choose the employees from whom you want to unassign this role and click their names. They will appear in the Changes preview.
6. Save your edits.

Delete an employee role

You can employee roles you no longer need. Deleting an employee role is permanent. You can't undo this action. Employees in the deleted role lose the permissions from that role.

To delete an employee role:

1. Go to Settings.
2. In the People section, click Roles & permissions.
3. Click the role you want to delete.
4. In the top right, click the three-dots icon.
5. Click Delete role.
6. Confirm the deletion.

Next steps

After adding employees to a role and setting permissions, you can: 

• Set up access to the Team calendar for each employee role.
• Enable two-factor authentication (2FA) for each employee role. Employees in that role need a token from their mobile device, email address, and password to log in.
• Set up reminders for each role to simplify your employees' daily work. For example, you can set a reminder about the end of employees' probationary periods. Learn how to set up role-specific reminders with best practices.