Within Natural HR there are a total of 9 different User Groups available for you to choose from when setting up a User.  Each group gives the user a different set of permissions and access rights, and there are also a number of options available for users within those groups.  This article describes the different User Groups available, as well as a number of other options available for controlling access to the system.

The following are the User Groups available within Natural HR. 
Click on the links below for an overview of each: 

• Admin
• HR
• Manager
• Employee
• Approver
• Finance
• Trainer
• Recruiter
• Facilities

The following sections describe other options available for controlling access to the system:

• Marketing permissions
• Contractors permissions
• Module templates
• Restrict access to pay/benefits
• Reporting
• Global manager restrictions
• Global employee restrictions

User Groups

Admin

HR

Manager

Employee

Approver

Finance

Trainer

Recruiter

Facilities

Marketing permissions

Any user level can be given “Marketing permissions” which will allow them access to Branding settings, Pages (Intranet) and Announcements.

Click on the following link for further information on this topic:

• Marketing Permissions
  

Contractors permissions

Any user level can be given “Contractors permissions” which will give them full and unlimited access to all contractors. None of the other restrictions such as ability to access National Insurance numbers or the ability to edit/delete will be applied.

What is a contractor? In addition to “employees”, Natural HR can be used to store information on “Contractors” – a contractor is most often used for contractors, volunteers and the like where there is no concept of employment. This means there is no start date, no job title or manager etc and the contractor themselves cannot access self-service nor be referenced in any of the system modules (i.e. you cannot add time off, training, timesheets, expenses etc for them).

Click on the following links for further information on this topic:

• Contractors
• Contractor Module Access
• What is a contractor license?
• Contractor access by user

Module templates

From the above tables you can see the modules that an individual has access to – for example, an employee has access to all modules which means they can access any module you have enabled such as expenses.

A module template allows you to define a list of enabled modules which an individual user can access and then apply this to a user or group of users. This allows you, for example, to enable expenses but only allow specific users or groups of users to access expenses.

Restrict access to pay/benefits

In a number of the user groups above, there is reference to the ability to restrict access to pay and benefits. Whilst for some users, such as managers, this is a global option (i.e. once turned on it applies to all managers) there is the option to control what access is limited to.

The three options are pay/salary, benefits and payments. This means you could stop all your managers from seeing pay and benefits but still allows them access to payments, for example.

Reporting

By default, no user group (other than admin) has access to any dataset for reporting purposes and you must explicitly add access for each user group to each dataset.

Within that dataset, all the permissions applied against the user are carried through. This means that if a user is given access to employee dataset, for example, they will only be able to see the data of those whom they are allowed to see in the system. Additionally, if they are unable to access pay, date of birth, National Insurance and bank details then these fields will not be available to them in reporting.

Further, if you share a report to a user and that report has fields which they would not be allowed to see then we will prevent you from sharing and, if the permissions for the user change after you have shared, the user would be restricted from accessing the report if their current permissions mean they should not be able to access any of the selected fields in that report.

Finally, within reporting, the vast majority of the datasets are associated with an employee – when you give access to the training dataset to a Trainer user, for example, this means they also get access to the information about that employee. However, the employee information they have access to is limited to relevant “work” information so they do not see: Pay, Date of birth, National Insurance, Gender, Marital status, Nationality, Ethnicity, Disability, Sexuality, Religion, Any address/personal contact information, Emergency contact information and bank details.

Click on the following links for further information on this topic:

• Report builder permissions

Global Manager Restrictions

IMPORTANT: these restrictions are global and, once set, will be applied against ALL manager users. You can also, optionally, apply these same restriction sets to individual HR or Finance users.

There are four main areas where restrictions can be applied against manager users:

1. Pay and benefits – see Restrict access to pay/benefits
   
   
2. Manager employee permissions – this controls what managers are able to do relating to employees. The options are:
   
   
   1. Add employees
   2. Quick add employees
   3. Approve employees
   4. Edit employees
   5. Delete employees
   6. Employee benefits (access to the module – this can be used in conjunction with option 1)
   7. Change employees
   8. Make leaver
   9. Start new employee workflows
   10. View employee workflows
3. Manager module permissions – this controls what managers are able to do relating to system modules. The options are:
   
   
   1. Add, edit or delete time off
   2. Add or delete timesheet
   3. Add, edit or delete training
   4. Delete expenses
   5. Delete mileage
   6. Upload employee documents
      You can also specify “folders” with varying user group permissions such as only allowing the employee to access or only allowing the manager to access.
   7. Delete employee documents
   8. Access performance reviews
   9. Access warnings
   10. Edit performance goals
4. Restricted fields – this controls what fields managers are able to access against the employees they are able to see. The options are:
   
   
   1. Date of birth
   2. National insurance number
   3. Gender
   4. Marital status
   5. Nationality
   6. Ethnicity
   7. Disabled
   8. Registered disabled
   9. Sexuality
   10. Religion
   11. Address
   12. Home phone
   13. Home mobile
   14. Home email
   15. Emergency contact
   16. Bank details 

Note: as a manager user is also an employee, the Global employee restrictions below will also be applied against the manager user when administering their own account via self-service.

Global employee restrictions

There are three main areas where restrictions can be applied against employee users:

1. “Modules” – please note, you can prevent complete access to other modules not listed via Module templates.
   
   
   1. Show time off allowance
   2. Show Bradford Factor
   3. Upload documents – options are:
      1. No
      2. Yes - able to choose upload folder 
      3. Yes - not able to choose upload folder
   4.  Employee map visible
   5. Reviews visible – see forms below for additional considerations
   6. Goals visible – options are:
      1. No
      2. Yes - view only
      3. Yes - can update
      4. Yes - can add and update
   7. Competency chart visible – options are:
      1. No
      2. Yes - view only
      3. Yes - can update
      4. Yes - can add and update
   8. Warnings visible
   9. Show working pattern on calendar
   10. Payments visible
   11. Organisation chart visible
   12. Planner visible
   13. Vehicles module access – this allows employees to add, edit etc their own vehicles
2. Fields visible to employee about self:
   1. Works ID
   2. Job title
   3. Job description
   4. Salary
   5. Grade
   6. Department name and description
   7. Job attachment
3. Changeable fields:
   1. Profile photo
   2. First name
   3. Middle name
   4. Surname
   5. Known as
   6. Marital status
   7. National insurance number
   8. Date of birth
   9. Gender
   10. Ethnicity
   11. Disabled
   12. Registered disabled
   13. Nationality
   14. Sexuality
   15. Religion

Finally, in addition, you can give employees access to a “public” calendar. By default, the employee will only see their own data on the calendar - this will include all types of data including time off, training, meetings, reminders and so on.
There is an option to set the calendar public which means that, in addition to the above, the employee will also see the time off and training of those employees who match the specified cohort (based on manager, department or site).