Employment Hero Permissions Setup: Do It Before Go-Live

All blogs & guides

Checked against Employment Hero’s Help Centre and current Australian guidance on 13/08/2026.

The short version

1. Build and test least-privilege access before importing employees, because retrofitting permissions is slower and riskier.
2. Additional Information field access can override the broader Reporting Employees scope.
3. Contractors cannot be added to custom security groups, so their access needs a separate design.

Full detail below.

Get your Employment Hero permissions setup right before you add anyone

A rushed Employment Hero permissions setup creates avoidable work after go-live. At Payd Co, an Employment Hero Certified Partner, we check for three practical symptoms: managers with excessive access, employees missing the records they need, and too many people assigned as admins. Permissions are easier to test before rollout than to retrofit around live users.

The fix is sequencing, not software. Map roles to access levels, restrict sensitive data, and test the result, before a single employee record gets bulk-imported. Do that and there’s no shortcut back to granting everyone admin and fixing it later, because the groups already exist first.

What goes wrong when permissions are an afterthought

Employment Hero gives platform admins access to every feature by default. Employees and managers get a narrower default, limited to what they use day to day, until someone widens it. The problem starts when a business imports its whole team before the narrower groups exist, because making everyone admin is the fastest way to get people working.

That shortcut is where the three symptoms come from:

• Managers seeing data they shouldn’t, given broad access just to get them moving
• Employees who can’t see their own documents, because no group was scoped to cover it
• Everyone defaulting to admin, because building proper groups felt like a step that could wait

These symptoms point first to role, scope and group configuration. We verify the live permissions and product behaviour before deciding whether an issue needs vendor support.

The three checks to run before you add employees

Run these in order, before you bulk-import a single person. Each one closes off the shortcut that leads to the symptoms above.

1. Map real-world roles, admin, manager, employee, to access levels before bulk-adding people.
2. Restrict sensitive data, pay and performance information especially, to the smallest group that needs it.
3. Test by logging in as a sample manager and employee before anyone else goes in.

Check 1: map roles to access levels first

Employment Hero handles this through a security group. Name the group, then set its Employee Access, the scope of whose data it can see: all employees, reporting employees only, specific groups, locations or worksites, or none. Configure the permission levels, view, modify or delete, for each data area, then assign people last, once the scope is right.

Contractors cannot be added to custom security groups. Their access therefore needs to be designed separately, with only the tools and records required for the engagement. If a contractor needs an approval or notification that the group would normally provide, we use a Workflow or a named internal owner instead of widening access.

Scope most roles to a single location or team. Reserve all-employees access for those who need it, typically payroll and senior HR. Where a group needs broad access with one exception, the exclusions setting carves specific people out, useful for a regional coordinator who needs their location but not local leadership’s records.

Check 2: restrict sensitive data to the smallest group that needs it

Employment Hero treats what a person can do and what data they can see as two separate dials inside the same security group, both need setting.

For sensitive fields such as salary details, pay history, tax file number and termination details, Employment Hero also has Privacy Mode. This is a display control used by the person viewing profiles: when enabled, sensitive tiles are blurred or collapsed in that viewer’s session, and the viewer can reveal them with the eye control. It is not an admin-set restriction on a particular employee record. Security groups remain the control that determines whether a user is authorised to access the data at all.

Additional Information fields carry their own access controls and can override the broader Reporting Employees scope. Test those fields separately with the sample manager account, especially where custom fields hold medical, licence or pay-related information.

Check 3: test it before anyone else goes in

Building the group correctly on paper isn’t the same as confirming it works. Log in as a sample manager and a sample employee before the rest of the team is imported, and check what each can see. It’s a quick check, easy to drop in a rushed rollout, and it’s the only way to catch a scope that looks right on screen but leaks data in practice.

Default access by role, before any custom group is applied

Role	Default access	What that means day to day
Admin or account owner	Every feature, every employee record	Reserve for a small number of named people, not a default landing spot for new hires
Manager	Direct reports only: overview details, assigned assets, performance reviews, plus leave balances where payroll integration is connected	Fine unscoped for most managers, but pay and TFN data still need a deliberate decision
Employee	Their own record only	The baseline every new hire should land in until a role needs more

An employee’s primary manager, and a secondary manager where relevant, determines who receives their leave, timesheet and expense requests by default, and where they sit on the org chart. Set this alongside the security group, one employee at a time or via bulk CSV import, not as an afterthought.

When permissions are already tangled

Employment Hero lets you edit or reassign a security group at any time, so nothing here is permanent. The real cost is finding every group already granted, working out who has what, and correcting it once managers and employees have live logins and habits built around the wrong access. That’s a different job to building it right the first time, which is why a short configuration review, the kind Payd Co runs as implementation support work instead of a quick settings tweak, is what fixes permissions already tangled after go-live.

Getting your Employment Hero permissions setup right before import is one piece of a wider Employment Hero payroll and HR platform build. Our HR technology configuration includes audit trails and role-based permissions for governance as standard, one step in the implementation sequence from discovery to go-live. Where the rollout also creates duplicate records, we reconcile identities and access before changing the live groups.

Why this matters beyond the software itself

Fair Work is clear that employee records are private and confidential, accessible only to the employer, payroll staff, the employee and authorised individuals such as an accountant. The Privacy Act’s employee records exemption can apply to records directly related to a current or former employment relationship, but it does not extend to contractors or job applicants. Least-privilege access remains the sensible control for every personnel record regardless of whether the exemption applies.

The same logic applies to pay-related fields, which deserve the smallest audience of any data in the platform. Pay calculations are separate configuration territory, covered in our guide on superannuation calculating wrong in Employment Hero, but who can see and change pay data is decided here in the permissions structure.

What’s the difference between an Employment Hero admin and a manager?

An Employment Hero admin has access to every feature by default, which is why account owners and senior HR roles typically hold it. A manager’s default access is narrower, limited to their direct reports: overview details, assigned assets, performance reviews, and leave balances where payroll integration is connected. A manager only sees more once a custom security group extends their scope.

Can permissions be changed in Employment Hero after employees have already been added?

Yes, security groups can be edited or reassigned at any time, so nothing here is locked in. The harder part isn’t the software, it’s finding every group already granted and correcting the scope once managers and employees have live logins built around the wrong access. That’s why a short configuration review, not a quick settings change, usually fixes a tangled setup.

Does Employment Hero Privacy Mode remove a user’s access to salary and pay details?

No. Privacy Mode blurs or collapses sensitive tiles for the person who switches it on, and that viewer can reveal the information again. To prevent a user from accessing salary, tax or pay information, restrict the relevant permissions in their security group and test the result with a sample account.