Administration

Manage users, permissions, organisation settings, and system configuration.

Overview

The Administration module provides:

User and access management
Role and permission configuration
Responsibilities for the jobs people do on top of their role
Module switches for the whole business
Your business profile, locations, key dates and branding
Pilot rollout management
Data management

Owners and admins find these under Admin (Users, User Groups, Permissions, Roles, Modules and Rollout) and Business (Profile, Locations, Key Dates, Branding and Integrations) in the sidebar.

User Management

The Users List

Admin > Users lists everyone with access to your business:

Name, email, role, status and the date they registered
Status - Invited, Active, Suspended or Deactivated

Pending invitations, shown as Invited rows until they're accepted - or Invite not sent while a pilot is holding the email back

Search by name or email, and filter by role and status

Click a row to open that person's user page.

Adding Users

Inviting a New User

Navigate to Admin > Users

Click Add User

Enter user details:

First and last name
Email address
Role

Linked Employee (optional) - the employee record this login belongs to. If they aren't in People yet, switch on Create an employee record to add them there at the same time

Click Send Invitation

User receives email with setup link, which expires after 72 hours

Adding someone here is always an invitation. No account is created and they get no access to your business until they accept, and they choose their own password. Mployr shows you the same thing whether or not the address already has an Mployr login somewhere else, so the form never reveals who already uses Mployr. Someone who already has a login (with another business) accepts with that login rather than creating a second one, and chooses which of their details to bring with them. (Grant user access on People > Employees > Add Employee sends the same kind of invitation; see the People Management guide.)

You can give someone a role below your own, but not your own role or a higher one - so only an owner can make someone an admin.

If your business is running a pilot, the Invite User page warns you when the invitation email won't be delivered - because only the pilot group receives email, or because everything is on hold until you go live - and Mployr tells you when an invitation was held back. While everything is on hold the button reads Create Invitation, and the person shows as Invite not sent rather than Invited - once you're live, use Resend Invitation on their row (or invite them again if it has expired).

To follow up a pending invitation, use its row menu in the users list:

Resend Invitation - sends a fresh link and restarts the 72 hours; the old link stops working. It's only offered while the invitation is still open - once the link has expired, invite them again with Add User, which replaces the expired invitation

Withdraw Invitation - the link stops working immediately. You can invite them again at any time

User Setup Process

User clicks the invitation link
Someone new to Mployr sets a password, which activates their account, and then signs in
Someone who already has an Mployr login signs in with it instead, chooses which of their existing details to share, if any, and accepts (or declines)
They complete their profile information

Managing Users

The User Page

Each user has one page, opened by clicking their row in Admin > Users. The header shows their photo (or initial), name, email, the role they hold in your business, and when they registered. Everything on the page is edited in place:

Details - first and last name, email, their role in this business, and the Linked Employee record. Click Save changes to save

Responsibilities - switches for the jobs they do on top of their role (see Roles and Permissions below)

If their login belongs to another business - they work for you as well - their name and email are managed by that business. Their role in your business and their Responsibilities are still yours to set.

Editing Users

Click the user's row in Admin > Users (or choose Edit from its row menu)

Modify details as needed

Click Save changes

As when inviting, you can only give a role below your own - only an owner can make someone an admin. Nobody can change, reset, deactivate or delete the login of someone ranked above them, and below admin level nobody can do it to someone with the same role either.

Deactivating Users

In Admin > Users, open the user's row menu

Click Deactivate

Nominate an admin to take over their open work - tasks, automations, documents, leads and orders, projects, tickets, insurance policies, recurring billing and integrations. Closed and historical records keep their original names. If there's no admin to nominate, their active automations are paused and their open work keeps its current assignee
User loses access immediately
Their data is preserved

Suspend also blocks someone from signing in, without the handover - useful for a short-term hold.

Deactivating and suspending act on the login itself, so the person can't sign in to Mployr at all - including into any other business they work for. They're only offered for people whose login belongs to your business.

Reactivating Users

Filter users to show Deactivated or Suspended
Open the user's row menu

Click Activate

User can log in again

If they've never set a password, Mployr asks you to send them a password reset (or resend their invitation) first. Reset Password on the same menu emails the user a password reset link, which works for 60 minutes.

Deleting Users

Note: Deleting removes the person from your business. Consider deactivating instead.

In Admin > Users, open the user's row menu

Click Delete

Nominate an admin to take over their open work

Click Delete to confirm

Deleting removes the user from this business only. If they belong to another business on Mployr, their login and their access there are unchanged; if your business is their only one, their sign-in is deleted permanently. Historical references are preserved. People whose login belongs to another business can't be deleted from your users list - their account is that business's to manage. If they're on your People > Employees list, deleting them there removes only your business's record and access.

User Settings

Passwords

Passwords must be at least 8 characters. Each person changes their own under Settings > Security, and Reset Password on a user's row menu emails them a reset link. Changing a password signs the person out on their other devices; a reset signs them out everywhere.

Session Management

After a period of inactivity - 15 minutes by default - the screen locks and asks for the person's password before they can carry on
The lock holds if the page is reloaded or the computer goes to sleep

Sign out instead on the lock screen ends the session

If the session has ended while a page has unsaved changes, the lock reads Session Ended and asks the person to sign in again (with their code, if they use multi-factor authentication) over the page, so the changes are kept

Two-Factor Authentication

Each person turns on multi-factor authentication under Settings > Security:

Authenticator app - scan a QR code with an app such as Google Authenticator or Authy

Recovery codes - for when the phone isn't to hand

Where multi-factor authentication is required for your business, people can't switch it off.

Multi-factor authentication is also required for anyone who can see other people's pay or financial records - owners and admins, and anyone whose role or Responsibilities reach payroll, accounting, insurance, pay rates, or other people's bank or super details. Until they've set it up, opening those screens takes them to Settings > Security to do it. Access to only their own records, as an employee has, doesn't need it.

Roles and Permissions

Understanding Roles

What someone can do comes from four things, each covered below: the modules your business has switched on, the one role they hold, any Responsibilities switched on for them, and the records they're directly involved in.

Roles define what users can access and do:

Group permissions together
Assign to users - each person holds one role in your business
Set how far each permission reaches

Default Roles

Business Owner - Every permission in the business, including billing and closing the business

Business Admin - Day-to-day administrator with every permission apart from closing the business or transferring ownership

Manager - Team management, with people data limited to their team

Sales Manager - The sales team lead, with CRM settings and Marketing

Sales Rep - Employee self-service plus the CRM pipeline

Employee - Self-service access to their own pay, time, leave, profile and documents

Contractor - Assigned projects and tasks, their own time and their own profile

Inactive Employee - A former employee's read-only access to their own records, such as leave and personal documents

Managing Roles

Creating a Role

Go to Admin > Roles

Click Add Role

Enter role name and description
Select permissions

Click Create Role

Note: A role you create yourself can't currently be given to anyone - when you assign a role, Mployr only accepts its built-in roles, and choosing one of your own is refused. To change what a group of people can do, edit the built-in role they hold, or switch on a Responsibility for the job.

Editing Roles

Go to Admin > Roles and click Edit on the role

Modify its permissions and how far each one reaches - Own records, their Team's, or All records in the business

Click Save Changes

All users with this role are updated

Mployr's built-in roles can be edited directly. The first time you change one, Mployr takes a copy for your business and edits that, so your changes are yours and future updates to the shipped role can't overwrite them.

Responsibilities

Where one person does a job on top of their role - "does the payroll", "does the accounts" - switch on a Responsibility on their user page rather than creating a role for one person. Each switch adds a reviewed set of permissions for that job, on top of whatever their role already gives them, and saves as soon as you flip it:

Payroll - runs pay runs, pay categories, awards and pay rates

Accounts - everything in Bookkeeping, plus the chart of accounts, journals, budgets and assets, and approving expenses

Bookkeeping - invoices, bills, expenses, bank reconciliation and preparing the BAS

HR - the people directory, leave and timesheet approvals, recruitment, learning, performance and grievances

Work health & safety - incidents, hazards, inspections, corrective actions and return-to-work plans

Recruitment - opens jobs, works through every application and emails candidates. Hiring someone and changing the careers page stay with owners and admins

Training - courses, enrolments, quizzes, certifications and qualifications

A responsibility never changes the role itself - an employee who does the payroll still shows as an Employee. Owners and admins already hold everything, so their switches show Included in their role. A former employee can't hold a responsibility, and someone needs a role in your business before you can switch one on. Only the business's owners and admins can change responsibilities.

A shared mailbox can also be shared with everyone who holds a responsibility - see the Email guide.

The Permission Matrix

Permissions in Mployr are fine-grained. Rather than a single switch per module, each sub-resource within a module has its own permissions - so you can, for example, let a role view people but not their bank accounts or emergency contacts, or manage rosters without touching payroll.

How It Works

Edit a role in Admin > Roles and scroll to its Permissions. (Admin > Permissions lists every permission, grouped by module, so you can see what each one covers.)

Expand a module to see its resources down the side, and actions across the top
For each row, grant the actions the role should have:

View - see the records

Create - add new records

Edit - change existing records

Delete - remove records

Other - actions particular to that resource, such as approving or exporting

Many permissions also distinguish Own records from Team and All records - for example, an employee can view their own profile and leave, while a manager can view their team's or everyone's

Modules your business has switched off are left out of the matrix.

Default-Deny

Access is default-deny: if a role hasn't been granted a permission, it doesn't have it. This means new modules and sub-resources are safe by default - you opt roles in rather than scrambling to lock things down. Buttons and pages a person can't use are hidden from them.

Permissions are enforced on the server for every request, not only in the interface - so a page someone can't see is also a request they can't make. Lists are filtered to the records the viewer is actually entitled to, rather than showing everything and hiding the buttons.

Record-Level Access

Some records grant access through involvement rather than only through roles:

A lead's assignees count as co-owners - they can view and edit it and link activities to it

A project member gets access to the project when they're assigned to it

A task assignee can act on their task without broader project permissions

This is deliberate: the people doing the work shouldn't need an administrator to widen their role first.

User Groups

User groups collect people so you can work with them together - a group can be picked as an assignee, and a shared mailbox can be shared with a group.

Go to Admin > User Groups

Click Add Group and name it (e.g. "Site Managers", "Payroll Team")

Add people to the group under Members

Click Create Group

Groups are visible to everyone who can see the People directory, so they can be picked as an assignee. Switch on Private group to make a group visible only to its members and to the people who manage groups.

Module Access

Beyond individual permissions, you can switch whole modules on or off for the whole business under Admin > Modules. If your business doesn't use Recruitment or Accounting, turn those modules off and they disappear from everyone's menu, Reorder list and Quick Launch - keeping the interface focused on what your business actually does.

Modules are shown as a tree. Switching a parent on or off switches everything under it to match. A sub-module's own switch can only be changed while its parent is on, and switching off the last sub-module under a parent switches the parent off too

Sub-modules have switches of their own - for example Quotes and Orders under CRM, Site Records under Health & Safety, and Locations under Catalogue - so you can turn off the parts you don't use and keep the rest

Use Search modules... to find one, and the All switch to turn everything on or off at once

Only the modules included in your plan are listed

Permission Categories

Module Permissions

Control access to modules:

View - Can see the module

Create - Can add records

Edit - Can modify records

Delete - Can remove records

Other Actions

Specific actions, listed in the Other column of the matrix:

Approve requests
Export data
Publish or issue records
Manage settings

Data Permissions

Control data visibility:

All - See all records

Team - See team's records

Own - See only their records

Permission Inheritance

How permissions combine:

A person's role sets their baseline
Any Responsibilities switched on for them add to it
Where they hold the same permission more than once, the broadest reach wins

Organisation Structure

Business Settings

Company Profile

Go to Business > Profile

On the Entity Details tab, configure:

Legal name, ABN and ACN
Entity type (and the trustee, for a trust)
Trading names

On the Contact Details tab, configure:

Phone numbers and email addresses
Website and social links
Trading hours - when the business is open each day

Check ABN, in the Business Registration card on the Entity Details tab, asks the Australian Business Register whether your ABN is Active, Cancelled or Not on the ABR and whether you're registered for GST, and records the answer. If the register has your business under a different name you'll be told, and your legal name is kept. A mistyped ABN is caught when you save.

The profile also links to Your Service Providers, where you can invite your accountant, bookkeeper or BAS agent, see what they can reach and revoke their access, and to your Key Dates.

Enrich From the ABR and Your Website

Where Enrich is switched on for your business, click Enrich on the business profile to fill in the gaps automatically. It's off for new businesses and isn't on the Admin > Modules screen - ask Mployr support if you'd like it turned on. Mployr looks your business up on the ABR and reads your website (or the website your business email address points to), then shows what it found, where each value came from, and what it would replace. Tick the fields you want and click Apply Selected.

From the ABR - corrects your legal name, proposes a trading name, and fills in an ABN or entity type only where you don't have one

From your website - only ever fills a blank: email, phone, social links, favicon and trading hours. Trading hours are offered unticked, and only if you haven't set your own

Logo - offered only to a business without one

Brand theme - a light and dark theme built from your logo's colours (a black-and-white logo gets a monochrome theme), added to your theme list. Making it your active theme is a separate tick, pre-ticked only if you don't already have a theme of your own

Branding

Customise the system appearance under Business > Branding:

Upload your logo (and a version for dark mode)
Upload a favicon
Upload letterhead image
Create custom themes and choose the one your business uses
Preview how your branding will look

Locations

Adding Locations

Go to Business > Locations

Click Add Location

Enter:

Location name and type
Address (and a postal address, if it's different)
Phone and email
Social links
Primary location flag

Key Dates

Business > Key Dates keeps the renewals, registrations, deadlines and events your business can't miss, as a calendar and a list.

Go to Business > Key Dates and click Add Key Date

Enter a Title and Date, and choose a Category (Event, Operational, Renewal, Registration, Regulatory, Financial or Other), a Status and a Recurrence (None, Monthly, Quarterly or Yearly)

Click Create Key Date

The calendar can also show your people's birthdays, work anniversaries, probation end dates and terminations, insurance renewals, pay days and pay period dates, and Australian public holidays for the states you choose - switch each on or off from the calendar options in the toolbar. A Key Dates calendar also sits beside your details on Business > Profile.

System Settings

General Settings

Personal Preferences

Each person sets their own currency, time zone, date format and time format under Settings > System - see the Settings guide.

Feature Toggles

Enable or disable features for the whole business under Admin > Modules (see Module Access above), for example:

Recruitment module
Projects module
CRM module
Accounting module

Email Configuration

Mployr sends your business's mail - payslips, invoices, campaigns - through your own email accounts, so it arrives from your domain. Set these up under Email > Accounts and verify your sending domains under Email > Domains; see the Email guide for the full picture.

Email Settings

Go to Email > Accounts and click Add Account

Choose how the account sends:

Sign in with Microsoft - Microsoft 365 / Outlook, with no server settings

IMAP / SMTP - enter the server, port, encryption and sign-in details on the IMAP and SMTP tabs

For an IMAP / SMTP account, use Test Connection before you rely on it

Email Templates

Create and edit the templates your business's emails use under Email > Templates - see the Email guide. For how individuals control which notifications reach them, see the Notifications guide.

Integrations

Business-wide integrations are managed here; individuals manage their own connected apps and preferences in the Settings guide.

Available Integrations

Accounting and payroll - Xero

Email and calendar - Microsoft 365 / Outlook

Documents - SharePoint document libraries for the business (each person connects their own OneDrive on the Yours side)

Projects - Monday.com

Workforce data - foundU

Which integrations are offered depends on your plan; one your plan doesn't include is shown as Not included in your plan.

Setting Up Integrations

Go to Business > Integrations

Find the integration under Available Connections

Click it to connect
Follow authentication steps

Where the provider has more than one workspace - a Xero organisation, for instance - choose it explicitly. Mployr never guesses which one a business connects to

Configure sync options

Personal and Business Connections

Connections are scoped as either personal or business:

A business connection belongs to the business and keeps working regardless of who set it up. These are listed under Business > Integrations

A personal connection belongs to one person - their own mailbox or OneDrive, for instance - and is theirs alone. These are listed on the Yours side of Settings > Integrations

This matters when someone leaves: a business connection survives, a personal one doesn't. Connect shared services as business connections - a connection's menu has Move to Business (or Move to Personal) if it was set up in the wrong place.

Managing Connections

View connection status - Active, Inactive or Expired - and when it last synced

Test the connection

Sync it now

Configure its sync options, where the integration has them

Edit Credentials if they've changed, for a service you connected with a key. One you connected by signing in is reconnected from its own card instead

Rollout

Admin > Rollout lets you run a pilot with a group of early adopters before opening Mployr to everyone in your business.

Start a pilot - while it runs, only the people in the pilot group receive communications

Early adopters - click Add early adopters to choose who is in the pilot group

Withheld communications - a record of everything the pilot held back. It's a record, not a queue - none of it is sent when you go live

Pilot settings - choose what the pilot limits (Participants only, Hold everything or No restriction), whether to Keep everyone else out of the workspace, and Always allow these addresses for people such as implementation consultants

Go live - opens the workspace to everyone and sends communications normally. Return to pilot puts the limits back on if something starts mailing the whole business by mistake

The Business setup card on the same page shows how far through setup you are, with a button to continue or review it.

Data Management

Import Data

Importing Records

Go to the list you're importing into - for example People > Employees or CRM > Leads - and click Import (or Import CSV)

Select record type, if the list offers more than one

Click Download Template for the correct columns

Fill in your data
Upload file
Map columns to fields
Preview import
Confirm import

Import Tips

Use templates for correct format
Validate data before import
Start with small test batch
Check for duplicates

Export Data

Exporting Records

Go to Reports and run the report you need - start from a template or build your own

Click Export

Select format (Excel, CSV or PDF)
Download file

Some lists also have their own export, such as Export CSV on CRM > Leads and Catalogue > Products. See the Reports guide.

Scheduled Exports

Set up automatic exports from a report:

Run the report and click Schedule

Set the frequency (daily, weekly, monthly, quarterly or yearly) and the time
Choose the format (Excel, CSV or PDF) and who receives it

Mployr runs the report on that schedule and emails the file to the recipients you list.

Data Cleanup

Archive Old Data

Archive records you've finished with from their list - leads, quotes, orders, activities, projects, jobs, candidates and others can be archived. Click the archive button in a list's filter bar (Show archived ...) to see its archived records again, and unarchive any of them by hand.

Archiving takes records off the working lists without deleting them - they stay searchable and reportable. In CRM > Settings, the Auto-archive rules can also archive finished leads, quotes and orders, and completed activities, once they've sat untouched for the number of days you set - so lists stay tidy without anyone remembering to do it. Live work is never archived automatically.

Support and Help

Getting Help

In-App Help

Click Ask Jak to ask the AI help assistant

Open the Help Centre from Help & Support > Help Centre

View feature guides

Support Contact

For technical issues:

Go to Help & Support > Raise a Ticket

Enter a Subject and a Description of the issue

Add Screenshots if they help, and tick This is urgent only if the issue is blocking work

Click Create Ticket

Follow up your tickets under Help & Support > My Tickets.

Help Centre

Access documentation:

User guides
FAQs
Best practices

Best Practices

User Management

Use roles instead of individual permissions
Use Responsibilities for the jobs people do on top of their role
Review access quarterly
Deactivate rather than delete
Enable two-factor for admins
Document role purposes

Security

Use strong, unique passwords
Enable two-factor authentication
Limit admin access
Remove access promptly when someone leaves

Data Management

Archive old data annually
Clean up duplicates
Document data policies

Frequently asked questions

How are permissions structured - roles, permissions and Responsibilities?

In layers. First, the modules your business has switched on in Admin > Modules - a module that's off is off for everyone. Each person then holds one role in your business: a named set of permissions, where each permission has a reach of Own, Team or All records. Responsibilities switched on for a person add the access a particular job needs on top of their role, and being a project member or a task's assignee opens that record to them. Owners and admins already have full access. See the built-in roles under Default Roles above.

Someone can't reach a page they should be able to

Check three layers in order: whether the module is switched on for the business in Admin > Modules, whether their role has the specific permission for that sub-resource, and whether that permission's reach - Own, Team or All - covers the records in question; a manager scoped to their own team won't see another team's. A Responsibility switched on for them can also widen what they reach.

Can I edit Mployr's built-in roles?

Yes. The first time you change a shipped role, Mployr copies it for your business and edits the copy, so your changes are safe from future updates to the original.

One person needs a single extra permission - do I need a new role?

Not usually. If what they need is a job - running payroll, doing the accounts, HR, recruitment and so on - switch on that Responsibility on their user page rather than creating a role that only ever has one member (a role you create can't currently be assigned anyway - see Creating a Role).

I invited someone and they're not in the users list

They are - as an Invited row - until they accept. Nothing is created until then. If the email didn't arrive, use Resend Invitation on their row; the link lasts 72 hours. Once it has expired, Resend isn't offered - invite them again with Add User, which replaces the expired invitation.

Why can't I make someone an admin?

You can only give a role below your own, so an admin can't make another admin - ask one of the business's owners to do it.

Someone works for two businesses. If I delete them, do they lose both?

No. Deleting a user removes them from your business only. If they belong to another business on Mployr, their login and their access there are unchanged.

What happens to integrations when the person who set them up leaves?

Business-scoped connections keep working; personal connections don't. Connect anything shared - accounting, storage, shared mailboxes - as a business connection, or use Move to Business on a connection that was set up as personal. When you deactivate or delete someone and nominate an admin, the connections they set up pass to that admin - a mailbox may need signing in to again.

Tips

Start with default roles, customise later
Use user groups to assign work to a team
Switch off the modules you don't use
Run a pilot before opening Mployr to everyone
Keep contact info current
Prefer Responsibilities to single-member roles

In this guide

Administration

Overview

User Management

The Users List

Adding Users

Inviting a New User

User Setup Process

Managing Users

The User Page

Editing Users

Deactivating Users

Reactivating Users

Deleting Users

User Settings

Passwords

Session Management

Two-Factor Authentication

Roles and Permissions

Understanding Roles

Default Roles

Managing Roles

Creating a Role

Editing Roles

Responsibilities

The Permission Matrix

How It Works

Default-Deny

Record-Level Access

User Groups

Module Access

Permission Categories

Module Permissions

Other Actions

Data Permissions

Permission Inheritance

Organisation Structure

Business Settings

Company Profile

Enrich From the ABR and Your Website

Branding

Locations

Adding Locations

Key Dates

System Settings

General Settings

Personal Preferences

Feature Toggles

Email Configuration

Email Settings

Email Templates

Integrations

Available Integrations

Setting Up Integrations

Personal and Business Connections

Managing Connections

Rollout

Data Management

Import Data

Importing Records

Import Tips

Export Data

Exporting Records

Scheduled Exports

Data Cleanup

Archive Old Data

Support and Help

Getting Help

In-App Help

Support Contact

Help Centre

Best Practices

User Management

Security

Data Management

Frequently asked questions

How are permissions structured - roles, permissions and Responsibilities?

Someone can't reach a page they should be able to

Can I edit Mployr's built-in roles?

One person needs a single extra permission - do I need a new role?