An authorization role is a set of permissions that defines what a user can see and do in All Hours. Assign each user a role that matches their position in your company. We recommend starting with the predefined roles and adjusting them if needed.
Predefined roles
You can find the roles under Users › Authorization Roles. Your account includes three predefined roles:
Administrator – has access to all settings, edits the events and absences of all users and adds them without approval.
Manager – approves or rejects employees’ requests and can view and edit their events. Managers must request their own absences and cannot edit their own data.
Employee – sees only their own data, clocks working time and submits requests for absences and for clockings added later. Employees cannot edit their own data.
Important: A user with the Administrator or Manager role can see the data of all employees in the company until you limit them to selected departments. More: How to limit administrators/managers to departments.
Assigning a role to a user
Go to Users and select the user.
On the Login tab, select the role in the Authorization roles field.
Click Save.
To assign a role to several users at once, select them in the user list and choose the appropriate option in the Actions menu. You can also set the role when adding or importing users (Adding, importing and updating users).
Permissions in a role
Click a role name to open it. The permissions are divided into two groups:
Personal privileges – what the user can see and edit in their own data. The Employee role only has personal privileges turned on.
Administration privileges – access to other users’ data. They are turned on in the Manager and Administrator roles.
After every change, click Save at the bottom of the page. The change applies to all users with this role.
Views
In the Views section, select which views the user sees for their own data:
Home – the home page with the clocking buttons.
One person – the monthly timeline with daily records and balances.
Employee day – the daily timeline with individual clockings.
Calendar one person – the yearly calendar with an overview of absences.
Clocking and mobile rights
In this section, define where the user can clock:
Web clocking – the user can clock in the web application. With Web clocking IP lock, you limit it to a specific IP address (IP address lock set up).
Clocking on mobile app – the user can clock in the mobile app.
Require location before clocking an event – the location is recorded when the user clocks in the mobile app.
Geofencing on mobile app – clocking in the mobile app is only possible at approved locations (Geofencing or requiring location before clocking).
Adding and editing clockings, absences and adjustments
For Add clockings, Add absences and Add adjustments, define whether the user adds entries themselves and whether they need approval:
Allow and bypass approval workflow – the entry applies immediately and does not start the approval workflow. No trace of the manual entry is kept, so use this option only in exceptional cases.
Request approval (recommended) – the entry is recorded as a request and only applies once an approver confirms it.
Approve automatically – the entry is approved automatically, a trace of it is kept and the approver receives a notification.
Disabled – the user cannot add the entry. A manager or administrator enters a missed clocking or an absence for them.
You define who approves the requests in the approval workflow (Approval workflows).
With Edit/Delete clockings, Edit/Delete absences and Edit/Delete adjustments, you define whether the user may change and delete existing entries.
The Absences shown in Absence planner setting defines whose absences the user sees in the Absence planner view: those of the whole company or only those allowed by the department restrictions.
Presence rights
Here you define whether the user sees colleagues’ presence on the Home page and in the Presence view, and whether they also see details such as the last clocking and the name of the absence. More: How to hide Presence on the Homepage.
Administration privileges
Administration privileges define what the user can do with other employees’ data:
Events and approvals – viewing and managing approvals, and viewing, adding, editing and deleting other users’ clockings, absences and adjustments.
Lock and unlock employee calculations – permissions for users who lock calculation periods (Locking a user’s calculations).
Views – access to the One day, Calendar, Calculations, Events log and Audit log views, and to reports and payroll exports.
Identity – viewing, adding, editing and deleting users, identifiers and departments.
A user who approves requests or is set as a substitute approver must have administration privileges with approvals turned on (Substitute approver).
Adjusting and creating roles
To adjust a predefined role, click its name, change the permissions and click Save.
The quickest way to create a new role is to copy an existing one, so that you only change the permissions that differ:
Under Users › Authorization Roles, select the role you want to copy.
Click Copy.
Open the copy, rename it, adjust the permissions and click Save.
To create a role without any preset permissions, click + Add authorization role.
Example: Copy the Employee role and turn off clocking on the mobile app in the copy. This gives you a role for employees who only clock on a time clock.