Assigning a role to employees

A role’s authorized population is the set of people who hold it. A role can be held in three ways: by name, automatically when someone is named as a manager in a profile, or by meeting criteria. This article describes each of them, a role’s validity period and assignment from an employee’s profile. It is intended for administrators and HR staff who hand out roles.

Before you start #

• The authorized population is set in Settings › Manage Employees › Employee Roles: click the role’s card, then the Authorized population tab, which shows the total number of members in brackets.
• Permissions in the Roles & permissions section of the matrix: “View role members” (Access level) to see the tab; “Add an individual member” and “Remove a member” (Execute level); “Configure dynamic members (criteria pools)” (Execute level) for automatic members, dynamic members and member exclusions; “Configure temporary role (dates)” (Execute level) for the validity period.
• What the role allows, and on whom, is set elsewhere: see Setting permissions in the matrix and Defining a role’s target population.

Three ways to hold a role #

The Member exclusions block then removes people from this population. The Result block lists all members, with automatic and dynamic members in italics. Inactive employees never hold a role.

Adding individual members #

1. In the Individual members block, click + Add.
2. Choose people from the list, or click All employees to select every active employee.
3. If the role’s target population depends on the assignment (“My N-1”, “My team”…), Illizeo asks, for each person with several current contracts: “This role depends on the assignment — state which contract carries it.” Choose their contract in Choose a contract…. As long as a contract is missing, the button shows the number of contracts to state.
4. Click Confirm. The message “Member(s) added.” confirms it.

If the addition breaks a separation of duties rule, a window offers a justified override: see Governance & security.

The carrying contract #

For a role that depends on the assignment, each individual member is shown on a line with their contract. The selector lets you change it without removing the role: a current contract (the primary one is marked), or To the person. The “contract not stated” note flags a person with several contracts and none chosen: their population then follows their main assignment. A role carried by a contract is removed during the night after that contract ends.

Removing a member #

1. Click the cross next to their name.
2. Confirm with Remove in the Remove member? window.

The person immediately loses the access this role gave them. Illizeo refuses to remove the last active member able to administer the organisation’s permissions.

Automatic members #

Six switches make a member of anyone named to a manager position in a profile: Managers (Job Information), HR Managers (Job Relationship), Additional managers, Custom managers, Matrix managers and Second managers. An active switch shows the number of people found.

The Manager role is provided with Managers (Job Information) switched on: anyone who becomes an employee’s manager becomes a member of the role, with nothing else to do. The HR Manager role has no automatic members, because its population is global: being named HR manager of a single colleague would open up the whole company.

Dynamic members #

1. In the Dynamic members (by criteria) block, click + Add a group.
2. Add criteria: Sub-company, Office, Department, Team, Position, Directory group, or an organisational object type, then choose their values.

As for the target population, the criteria within a group are combined with AND, and groups with each other with OR. Choose at least one value per criterion: a criterion without a value does not count, and a group in which no criterion counts makes nobody a member. An employee who changes office or team joins or leaves the role with no action needed.

Directory groups #

The Directory group criterion makes members of the people in a Microsoft Entra or Google Workspace group. The Manage directory groups link opens the Directory groups window: choose the Directory, enter the Object ID (Entra) or the Group address (Google) and a Label, then click Add. Membership is read every hour, or on demand with Synchronise now. A group that has never been read cannot grant a role yet, and an employee without a linked directory account does not receive one. This criterion is not offered for an administration role.

Member exclusions #

“Members matching an exclusion group are removed from the authorized population.” Click + Add exclusion group, then add criteria: Employee, Sub-company, Office, Department, Team or Position. An exclusion overrides every way of holding the role, individual addition included.

Temporary role #

1. At the top of the tab, switch on Temporary role.
2. Enter the Start date and the End date (auto-deactivation). The number of days left is displayed.

The role only applies between these two dates, both included; without an end date, it grants nothing. The day after the end date, Illizeo deactivates it overnight. Seven days beforehand, a box above the role cards announces it.

From an employee’s profile #

The Roles tab of an employee’s profile shows the roles assigned to them individually, under Current roles. Each one shows its permissions per level and a summary of its target population.

• Remove takes a role away from the person; Add a role lists the other roles, to add in one click.
• Combined effective permissions gives the highest level of each permission among their roles; Show details lists them with the role that grants them.
• The add-employee wizard offers the same view at its Roles step.

Seeing the tab requires “View role members” and “View the permissions matrix”; changing it requires “Add an individual member” and “Remove a member” at Execute level. The roles of a person who has left cannot be changed.

Good to know #

• The profile’s Roles tab only lists roles assigned individually. A role held automatically or by criteria does not appear there, but its permissions count: check them in Effective permissions per employee (see Understanding roles and permissions).
• Every employee keeps the All employees role: removing it from their profile does not take it away.
• Adding yourself to a role, or adding someone to an administration role, requires Admin level on “Add an individual member”. Without it, Illizeo refuses with a message, for example “You are not allowed to assign a role to yourself.”
• A role cannot be deactivated or deleted while it has individual members.
• The groups in Settings › Manage Employees › Groups grant no role: see Creating employee groups.

FAQ #

A new manager does not have manager permissions. #

Check that they are named as manager in their team members’ profiles and that the Managers (Job Information) switch of the Manager role is on. Otherwise, add them as an individual member.

How do I give a role for the length of a cover period? #

Duplicate the role concerned, add the person to it as an individual member, then switch on Temporary role with the dates of the cover period.