Multi-User Access with Customizable HR Roles

1. Overview
   • HR.my is a true multi-user online HR Management system which fully supports role-based user access management. For starters, there are 2 user account types, which are Employer and Employee accounts. Each Employee account may be assigned one of the following HR Roles:
     • Employee (this is the default role, with NO ACCESS to the Employer account)
     • HR.my Manager
     • HR Role
   • Role-based multi-user access control refers to assigning multiple employees with different HR Roles to access your Employer account. Typically these will be the employees from the HR department.
   • Altogether, there are 4 roles on HR.my.
     • HR.my Administrator. When you sign up for an Employer account, you will be the owner of the Employer account. You may change the ownership of the account to other people by accessing the account icon on the upper right corner , then access Change Email menu. Employer Account Owner is also called HR.my Administrator.
       It is highly recommended to assign the account ownership to someone who will stay with the organization for as long as possible to avoid any potential disruption when someone holds the account ownership leaves. Alternatively, use email address where an Employer has complete control over the email domain to sign up.
     • Employee. When you sign up for an Employee Web Account with the invitation from your Employer, you will be the owner of the Employee Web Account. The same Employee Web Account could be used to sign up with multiple different employers. Similarly, you may change the ownership of the account to other people by accessing the account icon on the upper right corner , then access Change Email menu. By default, you will be assigned "Employee" role in the system, which means you WILL NOT be able to sign in your Employer account using your Employee Web Account credentials.
       There is no limit to the number of Employee Web Accounts for an Employer.
     • HR.my Manager. If you are the primary employee who manages the Employer account on behalf of the account owner, your employer may assign you the role of "HR.my Manager", which is the second most powerful role beside HR.my Administrator.
       An Employer can appoint as many HR.my Manager as necessary.
       To sign in as HR.my Manager role, you will need to access Administrator tab on the main login page at https://hr.my/go and select the HR Role option. Or you may also sign in from your Employer Portal via HR Role tab.
     • HR Role. In a relatively larger organization, where HR functions are divided clearly among HR staff, an Employer could customize different HR Roles to authorize or limit the access to different data segments. Even for the same data segments, you may grant different level of access to different HR Roles:
       • No Access
       • Read Only
       • Modify
       For instance, you may set up an HR Role for a group of HR staff to process payroll, another HR Role for view-only access to Leave Management records etc.
       To sign in as HR Role, you will need to access Administrator tab on the main login page at https://hr.my/go and select the HR Role option. Or you may also sign in from your Employer Portal via HR Role tab.
   • Before assigning an employee with a specific HR Role to access your Employer account, you will need to invite them to sign up for their Employee Web Account first.
   • You may invite your employees to sign up for their individual Employee Web Account after adding/ importing your employee details in the Employer account. An Employee Web Account serves 2 primary purposes:
     1. to allow an individual employee to sign into their account to perform Self-Service HR functions, such as to apply for leaves, check leave entitlements and balances, view payslips, provide feedback and suggestions in the discussion forums, update personal profile etc.
     2. to assign special HR Role to your employees, primarily those involved in Human Resources/ Human Capital management roles, such as HR Department staff, so that they could access the Employer account to perform necessary HR functions. By default, each Employee Web Account is assigned with the HR Role of "Employee", if you assign someone in the HR Department with the HR Role of "HR.my Manager" or Custom-Defined HR Role, you empower them to sign in the Employer account by using their Employee Web Account credentials. More about managing the Employer account with "HR.my Manager" HR Role in the section below.
2. Web Account Management
   • You may perform 4 actions (depending on the Web Account status you are viewing, as well as your HR Role) in Employee Web Account management, accessible via Employee ❯ Web Account. You may
     1. Invite an employee (or a batch of employees at one go) to sign up a Web Account
     2. Assign HR Role to Web Account
     3. Enable Web Account
     4. Disable Web Account
   • When you access Employee Web Account management, you will find employees in 4 tabs (which represent 4 different statuses).
     • No Email. Employees listed under this tab DO NOT have any Contact Email yet, you may click at any employee to add a Contact Email and invite them to sign up for a Web Account immediately.
       The email address to which you send out an invitation is not necessary the same email address that will be used to sign up for the Employee Web Account. This is to cater for the use case that in some environments, the HR personnels could send the invitation to a fixed email address so that they could help their employees sign up their Employee Web Accounts. The actual email address will be requried to sign up for the Employee Web Account.
       You will need to be an HR.my Administrator or HR.my Manager in order to invite an employee to sign up for the Web Account.
       An employee can only sign up his/ her Web Account by following the invitation link sent from an employer.
     • No Account. Employees listed under No Account tab in Employee ❯ Web Account has already got a valid Contact Email, but they DO NOT have a Web Account yet, you may click at any employee to send the invitation, or you may also send invitations to all the employees short-listed by current Search conditions at one go by clicking at the button.
       You will need to be an HR.my Administrator or HR.my Manager in order to invite an employee to sign up for the Web Account.
       An employee can only sign up his/ her Web Account by following the invitation link sent from an employer.
     • Enabled. Employees listed under this tab DO have an ACTIVE Web Account. You may click at any employee to change HR Role or to Disable the Web Account.
       You will need to be an HR.my Administrator in order to perform these 2 actions.
       Once disabled, the employee will no longer be able to access the Web Account that is associated with current Employer, hence the resources related to current employer, such as leave application, forum discussions etc. If the employee is previously assigned as "HR.my Manager" or any active HR Role, he/ she will also be forbidden to sign in the Employer account too.
     • Disabled. Employees listed under this tab DO have a DISABLED Web Account. You may click at any employee to change HR Role or to Enable the Web Account.
       You will need to be an HR.my Administrator in order to perform these 2 actions.
3. Signing in as HR.my Manager
   • "HR.my Manager" is in fact an Employee role, and it is not the same as HR.my Administrator, which is the super user and actual account holder of the Employer account. It is highly recommended that all Employers assign at least an "HR.my Manager" to the Employee Web Account, and use "HR.my Manager" role to perform usual HR operations, such as leave escalation, approval etc. However, since "HR.my Manager" is not the owner of the Employer account, as a security measure there are some critical functionalities that are off limits to "HR.my Manager" role (or other HR Roles). These include
     • changing the Employer account's registered email and password
     • closing the Employer account
     • changing the Employer Portal Name
     • assigning HR role to other employees
     • enabling and disabling Employee Web Accounts
     these functions are only accessible by HR.my Administrator. Note that "HR.my Manager" is able to invite employees to sign up for their Web Accounts.
   • As such, "HR.my Manager" (or other HR Roles) will need to sign in the Employer account from a different login page. Usually, an Employer or Employee will always sign in from the main login page at https://hr.my/go, however, "HR.my Manager" will need to sign in from "Employer Portal" page. When you assign someone with the role of "HR.my Manager" (or other HR Roles), you will be prompted with the "Employer Portal" URL. You may also retrieve "Employer Portal" URL from Employer ❯ Information. Typically, an "Employer Portal" URL has this pattern: https://hr.my/go/portal/your_customizable_portal_name.
   • On the "Employer Portal", there will be 2 login tabs, one for HR Role and another one for Employee. If an employee needs to perform his/ her duty as an "HR.my Manager" or HR Role, he/ she has to sign in via the HR Role tab on the "Employer Portal". When an employee needs to apply for leave, approve leaves as a Supervisor or join a discussion, he/ she will have to sign in via Employee instead.
   • As a sidenote, an Employer or HR.my Administrator will need to sign in from the main login page at https://hr.my/go
4. HR Role - Role Based User Access Management
   • Besides the built-in "Employee" and "HR.my Manager" roles, you may always define your own HR roles if you would like to split your organization's human resources management tasks into more specialized roles. In this case, you will need to access Employee ❯ HR Role. Note that you will need to sign in your Employer account as HR.my Administrator (account owner) in order to do so.
   • For instance, if you would like to assign someone in your HR team the role of Leave Administrator, you may create such a role with all other access rights turned off, except Leave Management related functions.
   • By the same token, if you need to assign someone for document sharing management, you may create such a role, say Document Administrator, by assigning Document & Form access rights.
   • Typically, each function will be presented with 3 possible access rights: No Access, View, Modify. If a user is assigned with the "View" right, he/ she will only be able to view the data without making any changes. If "Modify" right is granted, then the role will be able to make changes to pertinent data, including create new record, update and delete existing record.
   • If an HR role is set to be Inactive, it is in effect similar to assigning the users originally associated with the Inactive role to "Employee" role (thus disabling the users assigned with that Inactive role from signing in the Employer account). Note that this does not disable the relevant users' Employee Web Account access, which will need to be disabled in Employee ❯ Web Account Enabled.