Can I create an admin role that can manage employees but not assign admin privileges?

Yes, you can assign a custom admin role that allows access to Organization > Employee without granting the ability to modify or assign admin privileges.

To do this, follow the steps below:

1. Go to Security → Role Manager

2. Fill in the following fields:

   1. Name*: Enter a name for this role

      1.  For example, you could call it "Auditors" for the auditors.

   2. Operating Unit: If a role needs to be restricted to a specific operating unit, then select a value in this field. This will allow access to data related to the selected operating unit.

   3. Department: If a role needs to be restricted to a specific department, then select a value in this field. This will allow access to data related to the selected department.

   4. Group*: Select a group if the role needs to be restricted based on a group user is apart of. This only impacts the Expense and Time access and not the set up of the application. Make sure that the access list is restricted to avoid unwanted changes. 

      1. My Department - This only allows role user to view the users that are apart of the department that they approve for in the application. The approval has to be set up under Department →Approval Flow.

      2. My Reports/Timesheet - This only allows role user to view your own expense reports and timesheets.

      3. My Proxy - This only allows the role user to view the expense reports and timesheets related to those they have proxy access for in the application.

      4. My Team - This only allows role user to view expense reports and timesheets of those users that they approval for in the application.

   5. Default Flag: If "Yes" is selected, this role will be set as the default for users with admin access enabled. 

   6. Read Only: If "Yes" is selected, all access to Admin will be read only and will not allow editing of data. 

   7. Introduction: A brief description of the role.

3. Click Save to save this role. 

   • Notice that the split screen opens, and a new tab appears, called Accesses. 

   • Click on Accesses. This is where you will specify what access the role will have within Admin.

     1. Click on the Add button.

     2. Select the items that the user will be able to see from this list (Notice there is more than one page). 

     3. For this specific admin role you will need to add

   • Organization Employee Admin Role Read Only
     This role grants full administrative access to add, modify, and delete employee records. However, it restricts the user from assigning or changing anyone’s admin roles, ensuring they can't grant administrative privileges to others.

Open

4. Click OK

5. After the role is set up, you just need to assign it to the users that are going to be in that role.

For steps on how to assign a role to a user please refer to Guide to Create a Role and Assign to User - DATABASICS Product Guides - Confluence