Payroll User Access

What access is available for payroll information?

Purpose: This guide will explain how to set up payroll users, the differences in user roles, and how to grant payroll access in BambooHR. 

Table of Contents

Payroll users in BambooHR

The following payroll user roles are available to BambooHR Payroll customers. Some user roles are given automatic permissions, while others can be managed in Access Levels. See below for details:

Access Level User Definition
Account Owner Default access to all non-payroll and payroll-related employee information. The Account Owner has full payroll permissions, including running payroll, approving payroll, managing Payroll in Settings, and viewing Payroll Reports for the EINs they are assigned to in BambooHR.*
Full Admin Default access to all non-payroll and payroll-related employee information. The Full Admins have full payroll permissions, including running payroll, approving payroll, managing Payroll in Settings, and viewing Payroll Reports for the EINs they are assigned to in BambooHR.*
Payroll Admin Default access to most payroll-related employee information (see below). The Payroll Admins can run payroll, approve payroll, manage Payroll in Settings, and view Payroll Reports for the EINs they are assigned to in BambooHR.*
Payroll Admin (Non-Approver) Custom access to payroll-related employee information. Allows access to payroll permissions, including run payroll, but does not allow the user to approve payroll.
Payroll Reports Only Custom access to payroll-related employee information for the EINs they are assigned. Allows access to only view Payroll Reports in BambooHR—no access to payroll permissions.

*Users with access to run or approve payroll within the Payroll tab must be assigned to the correct EIN within Access Level Settings. See the Assigning EINs section below for more information. 

Payroll Admin users

The Payroll Admin access level includes access to the following information in BambooHR:

  • Payroll settings
  • Payroll tab
  • Payroll Reports tab
  • Payroll reports within Reports > Standard Reports (view and export access only) 
  • Extra Pay tab
  • Import Hours
  • Pay Schedules (Employee Fields)
  • Personal tab for all employees
  • Job tab for all employees
  • Pay Info tab for all employees
  • Timesheets tab for all employees
  • Timesheet approvals for all employees
  • Benefits settings
  • Benefits tab for all employees
  • Benefits reports (Benefit Summary, ACA Benefit History, and ACA Monthly Totals)
  • Time Off Used report
  • Additions & Terminations report
  • Payroll Hours report (This will only show if you are using BambooHR® Time Tracking)
  • Payroll Deductions Summary report
  • SSO into TRAXPayroll as an admin via the Open TRAXPayroll button on the Payroll tab*

If your company has opted into Early Access (EA), Payroll Admin users will be able to view the Early Access Hub and receive EA email notifications. 

To assign a user to the Payroll Admin access level, go to Settings and select Access Levels. Click +Add Employee.

Select the user* who you would like to assign to the Payroll Admin access level. After clicking Save, the user will be under the new access level.

*Depending on which access level the user previously had, there will be different options on what to do. You can either combine their permissions or assign them to the Payroll Admin access level.

Access settings for the Payroll Admin access level are automatic and include the information listed above. Clicking Access Level Settings will allow you to select what access the Payroll Admin user should have to their own information.

How does Payroll Admin access compare to Full Admin and Account Owner access?
Account Owners Full Admins Payroll Admins
View and edit all data for all employees. X X
Add and terminate employees. X X
Create (Advantage, Core, and Pro packages), delete (Advantage, Core, and Pro packages), and generate all reports. X X
Upload, rename, share, delete, etc. Files and Documents. X X
Create templates and request signatures (Advantage, Core, and Pro packages). X X
View and update job openings and candidates  (Advantage, Core, and Pro packages). X X
Utilize and make changes to certain features in Settings. X X
View and update widgets on Home. X X
Define access for and grant access to other users. X X
Edit timesheets after they have been approved. X X
Edit time off requests. X X
Payroll Settings X X X

Payroll tab


 X X X
Extra Pay tab X X X
Import hours in BambooHR X X X
Pay schedules (employee fields) X X X
Personal tab for all employees X X X
Job tab for all employees X X X
Pay Info tab for all employees X X X
Timesheets tab for all employees X X X
Timesheet approvals for all employees X X X
Benefits settings X X X
Benefits tab for all employees X X X
Benefits reports (Benefit Summary, ACA Benefit History, and ACA Monthly Totals) X X X
Time Off Used report X X X
Additions & Terminations report X X X
Payroll Hours report (This will only show if you are using BambooHR Time Tracking) X X X
Payroll Deductions Summary Report X X X
SSO into TRAXPayroll as an admin via the Open TRAXPayroll button on the Payroll tab* X X X
Processing late or missed payrolls in BambooHR X X X
Reopening approved payrolls in BambooHR X X X
Payroll Reports tab within Reports X X X
Delete an employee X
Changing the Account Owner X
Updating company credit card X
Adding/removing billing contacts X
History Settings X

Custom access payroll users

The Payroll Admin (Non-Approver) and Payroll Reports Only will appear under Custom Access Levels. 

You can manage these roles as you would a regular custom access level. Click on the name of the role and then click Access Level Settings. 

Payroll Admin (Non-Approver) will be automatically assigned to view payroll reports (checked within the Reports section) and run payroll (checked within the Payroll section) under What Can People With This Access Level Do? "Approve Payroll" is unchecked by default.

Payroll Reports Only will only have "View Payroll Reports" checked within the Reports section of What Can People With This Access Level Do? Users in this access level must also have an EIN assigned to view the Payroll Reports section under the Reports tab in BambooHR.  

By default, what is outlined above will be the only access selected in these users' custom access level settings unless you have chosen to combine an access level when adding an employee to a different custom access level. If the Payroll Admin (Non-Approver) or Payroll Reports Only user needs more access, you must adjust their custom access level settings accordingly. 

If you would like a custom access payroll user to have access to add and manage GL Codes within the Journal Entry section of Payroll settings, the user must have Payroll checked under Settings in Access Level Settings. 

Non-employee payroll users

When adding a non-employee user for payroll, you must assign them a payroll access level upon setup and then assign them to the correct EIN. Once you click Save, you can find the non-employee user within the access level you assigned them during setup. You can assign them to the correct EINs from there by clicking the hyperlink under the Payroll Access column. 

Granting users to a payroll access level will automatically create an admin user in TRAXPayroll, allowing the non-employee user to single sign-on (SSO) into TRAXPayroll. The following information will automatically get populated for the non-employee user in TRAXPayroll:

  • Work Email
  • First Name
  • Last Name
  • Notifications:
    • Send Time Off Reminder defaults to off
    • All other notifications default to on
  • Role set to Payroll & Remote Link
  • Allow Login set to Yes
  • Pay Group Security set to All Permissions

The TRAXPayroll user record will map to the non-employee user record ID in BambooHR. If the non-employee user gets deleted at some point in the future, the mapped TRAXPayroll user record will become inactive, and the user will no longer have access to SSO into TRAXPayroll.

Assigning EINs

Users with payroll permissions to run and approve payroll must also be assigned the correct EIN to manage payroll on the Payroll tab. Full Admins, Payroll Admins, and custom payroll users with payroll permissions will be able to assign EINs to the necessary users. 

To assign an EIN, navigate to the payroll access level of the user. Within each payroll access level, a table will display the users assigned to that access level and which EIN they are assigned to. If it is the first time you are assigning a user access to a company EIN, click on the No Access link in the Payroll Company Access column. If the user is already assigned, navigate to the dropdown menu upon hovering over the employee's name. Then, select Manage Payroll Company Access from the menu. 

A modal will appear for you to select which EINs the user can access when running payroll. Check the applicable EINs and then click Save. 

If your company only has one EIN, you will have the option to assign an EIN for the Full Admin. Payroll Admins and any user in a payroll custom access level with payroll permissions will automatically be assigned to your company’s single EIN. These users cannot be unassigned from the single EIN unless they are removed from the access level.

Note that assigning a user to an EIN gives users permission to view and manage the assigned company on the Payroll tab but does not grant them access to the employee records of those included in the payroll for that EIN. That will need to be set up separately in access levels.