Payroll User Access

This guide outlines the setup and management of payroll user access in BambooHR. It details various user roles, including Account Owner, Full Admin, Payroll Admin, and custom access roles. Each role has specific permissions for managing payroll-related tasks and accessing employee information. The document explains how to assign Employer Identification Numbers (EINs) to users and the implications of these assignments. It also provides instructions for adding non-employee payroll users and highlights the differences in access levels between payroll roles. Additionally, it emphasizes that custom access settings can be adjusted to meet specific user needs. Overall, this resource serves as a comprehensive reference for managing payroll access within BambooHR.

Jul 9, 2026
Knowledge

Title

Payroll User Access

Article Text

What access is available for payroll information?

Purpose: This guide will explain how to set up payroll users, the differences in user roles, and how to grant payroll access in BambooHR.

Table of Contents

Payroll users in BambooHR
Assigning EINs

Payroll users in BambooHR

The following payroll user roles are available to BambooHR Payroll customers. Some user roles are given automatic permissions, while others can be managed in Access Levels. See below for details:

Access Level User	Definition
Account Owner	Default access to all non-payroll and payroll-related employee information. The Account Owner has full payroll permissions, including running payroll, approving payroll, managing Payroll in Settings, and viewing Payroll Reports for the EINs they are assigned to in BambooHR.*
Full Admin	Default access to all non-payroll and payroll-related employee information. The Full Admins have full payroll permissions, including running payroll, approving payroll, managing Payroll in Settings, and viewing Payroll Reports for the EINs they are assigned to in BambooHR.*
Payroll Admin	Default access to most payroll-related employee information (see below). The Payroll Admins can run payroll, approve payroll, manage Payroll in Settings, and view Payroll Reports for the EINs they are assigned to in BambooHR.*
Payroll Admin (Non-Approver)	Custom access to payroll-related employee information. Allows access to payroll permissions, including run payroll, but does not allow the user to approve payroll.
Payroll Reports Only	Custom access to payroll-related employee information for the EINs they are assigned. Allows access to only view Payroll Reports in BambooHR—no access to payroll permissions.

*Users with access to run or approve payroll within the Payroll tab must be assigned to the correct EIN within Access Level Settings. See the Assigning EINs section below for more information.

Payroll Admin users

The Payroll Admin access level includes access to the following information in BambooHR:

Area	Feature	Access
BambooHR Settings	Payroll tab, including Extra Pay Pay Schedules	View and edit
	Open TRAXPayroll button	Single sign-on
	Benefits tab	View and edit
	Employee Fields tab	View and edit
	Time & Attendance tab (if enabled)	View and edit
	Account > Import Hours tab	View and edit
Reports Tab	Payroll Reports tab All reports	View and edit
	My Reports tab ACA Benefit History ACA Monthly Totals Benefit Summary Time Off Used Additions & Terminations Payroll Deductions Summary Payroll Hours (if using BambooHR® Time & Attendance) These reports appear on the My Reports tab for Payroll Admins, while Full Admins & Account Owners can access the same reports from the Standard Reports tab in their accounts.	View and export only
Employee Profile (all employees)	Personal tab Job tab Pay Info tab Timesheets tab Benefits tab	View and edit *Time Off tab is view only
Timesheet Approvals (all employees)	From the following locations: Email notification BambooHR inbox Timesheets tab Payroll Hours report	View and approve

If your company has opted into Early Access (EA), Payroll Admin users will be able to view the Early Access Hub and receive EA email notifications.

To assign a user to the Payroll Admin access level, go to Settings and select Access Levels. Click +Add Employee.

Select the user* who you would like to assign to the Payroll Admin access level. After clicking Save, the user will be under the new access level.

*Depending on which access level the user previously had, there will be different options on what to do. You can either combine their permissions or assign them to the Payroll Admin access level.

Access settings for the Payroll Admin access level are automatic and include the information listed above. Clicking Access Level Settings will allow you to select what access the Payroll Admin user should have to their own information.

Note: Payroll Admin access does not recognize all employee-level permissions from the selected employee access level. For example, Payroll Admins may not see the Announcements widget or other See on Home permissions. This behavior is expected. If a Payroll Admin needs these employee-level features, assign them to an additional custom access level with the appropriate employee permissions. The additional access level acts as a fallback for employee-level permissions that are not recognized by the Payroll Admin access level.

How does Payroll Admin access compare to Full Admin and Account Owner access?

	Account Owners	Full Admins	Payroll Admins
View and edit all data for all employees.	X	X
Add and terminate employees.	X	X
Create, delete, and generate all reports.	X	X
Upload, rename, share, delete, etc. Files and Documents.	X	X
Create templates and request signatures.	X	X
View and update job openings and candidates.	X	X
Utilize and make changes to certain features in Settings.	X	X
View and update widgets on Home.	X	X
Define access for and grant access to other users.	X	X
Edit timesheets after they have been approved.	X	X
Edit time off requests.	X	X
Payroll Settings	X	X	X
Payroll tab	X	X	X
Extra Pay tab	X	X	X
Import hours in BambooHR	X	X	X
Pay schedules (employee fields)	X	X	X
Personal tab for all employees	X	X	X
Job tab for all employees	X	X	X
Pay Info tab for all employees	X	X	X
Timesheets tab for all employees	X	X	X
Timesheet approvals for all employees	X	X	X
Benefits settings	X	X	X
Benefits tab for all employees	X	X	X
Benefits reports (Benefit Summary, ACA Benefit History, and ACA Monthly Totals)	X	X	X
Time Off Used report	X	X	X
Additions & Terminations report	X	X	X
Payroll Hours report (This will only show if you are using BambooHR Time & Attendance)	X	X	X
Payroll Deductions Summary Report	X	X	X
SSO into TRAXPayroll as an admin via the Open TRAXPayroll button on the Payroll tab*	X	X	X
Processing late or missed payrolls in BambooHR	X	X	X
Reopening approved payrolls in BambooHR	X	X	X
Payroll Reports tab within Reports	X	X	X
Delete an employee	X
Changing the Account Owner	X
Updating company credit card	X
Adding/removing billing contacts	X
History Settings	X

Custom access payroll users

The Payroll Admin (Non-Approver) and Payroll Reports Only will appear under Custom Access Levels.

You can manage these roles as you would a regular custom access level. Click on the name of the role and then click Access Level Settings.

Payroll Admin (Non-Approver) will be automatically assigned to view payroll reports (checked within the Reports section) and run payroll (checked within the Payroll section) under What Can People With This Access Level Do? "Approve Payroll" is unchecked by default.

Payroll Reports Only will only have "View Payroll Reports" checked within the Reports section of What Can People With This Access Level Do? Users in this access level must also have an EIN assigned to view the Payroll Reports section under the Reports tab in BambooHR.

By default, what is outlined above will be the only access selected in these users' custom access level settings unless you have chosen to combine an access level when adding an employee to a different custom access level. If the Payroll Admin (Non-Approver) or Payroll Reports Only user needs more access, you must adjust their custom access level settings accordingly.

If you would like a custom access payroll user to have access to add and manage GL Codes within the Journal Entry section of Payroll settings, the user must have Payroll checked under Settings, Run Payroll checked under Payroll, and View Payroll Reports checked under Reports in Access Level Settings > What Can People with this Access Level Do?

Please note that only the Account Owner, Full Admin(s), and Payroll Admin(s) will have access to all of the tabs in Payroll Settings including the Company Information, Company Bank Account, and Taxes tab. These tabs will not appear for non-admin users assigned to a custom access level with Payroll marked under Settings.

Non-employee payroll users

When adding a non-employee user for payroll, you must assign them a payroll access level upon setup and then assign them to the correct EIN. Once you click Save, you can find the non-employee user within the access level you assigned them during setup. You can assign them to the correct EINs from there by clicking the hyperlink under the Payroll Access column.

Granting users to a payroll access level will automatically create an admin user in TRAXPayroll, allowing the non-employee user to single sign-on (SSO) into TRAXPayroll. The following information will automatically get populated for the non-employee user in TRAXPayroll:

Work Email
First Name
Last Name
Notifications:
- Send Time Off Reminder defaults to off
- All other notifications default to on
Role set to Payroll & Remote Link
Allow Login set to Yes
Pay Group Security set to All Permissions

The TRAXPayroll user record will map to the non-employee user record ID in BambooHR. If the non-employee user gets deleted at some point in the future, the mapped TRAXPayroll user record will become inactive, and the user will no longer have access to SSO into TRAXPayroll.

Assigning EINs

Users with payroll permissions to run and approve payroll must also be assigned the correct EIN to manage payroll on the Payroll tab. Full Admins, Payroll Admins, and custom payroll users with payroll permissions will be able to assign EINs to the necessary users.

To assign an EIN, navigate to the payroll access level of the user. Within each payroll access level, a table will display the users assigned to that access level and which EIN they are assigned to. If it is the first time you are assigning a user access to a company EIN, click on the No Access link in the Payroll Company Access column. If the user is already assigned, navigate to the dropdown menu upon hovering over the employee's name. Then, select Manage Payroll Company Access from the menu.

A modal will appear for you to select which EINs the user can access when running payroll. Check the applicable EINs and then click Save.

If your company only has one EIN, you will have the option to assign an EIN for the Full Admin. Payroll Admins and any user in a payroll custom access level with payroll permissions will automatically be assigned to your company’s single EIN. These users cannot be unassigned from the single EIN unless they are removed from the access level.

Note that assigning a user to an EIN gives users permission to view and manage the assigned company on the Payroll tab but does not grant them access to the employee records of those included in the payroll for that EIN. That will need to be set up separately in access levels.

URL Name

1178931