---
title: Assigning a role to employees
description: "Give a role by name, automatically or by criteria, limit it in time, and manage a person's roles from their profile."
url: "https://illizeo.com/en/centre-aide/roles-assign-a-role/"
updated: "2026-11-05"
category: "Platform / Permissions & roles"
---

# Assigning a role to employees

A role’s authorized population is the set of people who hold it. A role can be held in three ways: by name, automatically when someone is named as a manager in a profile, or by meeting criteria. This article describes each of them, a role’s validity period and assignment from an employee’s profile. It is intended for administrators and HR staff who hand out roles.

## Before you start

- The authorized population is set in **Settings › Manage Employees › Employee Roles**: click the role’s card, then the **Authorized population** tab, which shows the total number of members in brackets.
- Permissions in the Roles & permissions section of the matrix: “View role members” (Access level) to see the tab; “Add an individual member” and “Remove a member” (Execute level); “Configure dynamic members (criteria pools)” (Execute level) for automatic members, dynamic members and member exclusions; “Configure temporary role (dates)” (Execute level) for the validity period.
- What the role allows, and on whom, is set elsewhere: see [Setting permissions in the matrix](https://illizeo.com/en/centre-aide/roles-permission-matrix/) and [Defining a role’s target population](https://illizeo.com/en/centre-aide/roles-target-population/).

## Three ways to hold a role

| Block on the tab | Who holds the role |
| --- | --- |
| Individual members | People added one by one |
| Automatic members | Anyone named as a manager (manager, HR manager…) in an employee’s profile |
| Dynamic members (by criteria) | Employees who meet criteria: sub-company, office, department, team, position, directory group… |

The **Member exclusions** block then removes people from this population. The **Result** block lists all members, with automatic and dynamic members in italics. Inactive employees never hold a role.

![The Authorized population tab of the Manager role: the Temporary role switch, then the Individual members block with the Add button and the first members, each with its To the person scope](https://i0.wp.com/illizeo.com/wp-content/uploads/2026/11/roles-assign-a-role-01.en_.png?resize=800%2C199&quality=80&ssl=1)
The authorized population: individual members.

## Adding individual members

1. In the **Individual members** block, click **+ Add**.
2. Choose people from the list, or click **All employees** to select every active employee.
3. If the role’s target population depends on the assignment (“My N-1”, “My team”…), Illizeo asks, for each person with several current contracts: “This role depends on the assignment — state which contract carries it.” Choose their contract in **Choose a contract…**. As long as a contract is missing, the button shows the number of contracts to state.
4. Click **Confirm**. The message “Member(s) added.” confirms it.

If the addition breaks a separation of duties rule, a window offers a justified override: see [Governance & security](https://illizeo.com/en/docs-category/platform-en/platform-governance-security/).

![The panel for adding individual members, open: All employees button with their number, employee selection list, then the Confirm and Cancel buttons](https://i0.wp.com/illizeo.com/wp-content/uploads/2026/11/roles-assign-a-role-02.en_.png?resize=800%2C199&quality=80&ssl=1)
Adding individual members: choose people, then Confirm.

## The carrying contract

For a role that depends on the assignment, each individual member is shown on a line with their contract. The selector lets you change it without removing the role: a current contract (the primary one is marked), or **To the person**. The “contract not stated” note flags a person with several contracts and none chosen: their population then follows their main assignment. A role carried by a contract is removed during the night after that contract ends.

## Removing a member

1. Click the cross next to their name.
2. Confirm with **Remove** in the **Remove member?** window.

The person immediately loses the access this role gave them. Illizeo refuses to remove the last active member able to administer the organisation’s permissions.

## Automatic members

Six switches make a member of anyone named to a manager position in a profile: **Managers (Job Information)**, **HR Managers (Job Relationship)**, **Additional managers**, **Custom managers**, **Matrix managers** and **Second managers**. An active switch shows the number of people found.

The Manager role is provided with **Managers (Job Information)** switched on: anyone who becomes an employee’s manager becomes a member of the role, with nothing else to do. The HR Manager role has no automatic members, because its population is global: being named HR manager of a single colleague would open up the whole company.

## Dynamic members

1. In the **Dynamic members (by criteria)** block, click **+ Add a group**.
2. Add criteria: **Sub-company**, **Office**, **Department**, **Team**, **Position**, **Directory group**, or an organisational object type, then choose their values.

As for the target population, the criteria within a group are combined with AND, and groups with each other with OR. Choose at least one value per criterion: a criterion without a value does not count, and a group in which no criterion counts makes nobody a member. An employee who changes office or team joins or leaves the role with no action needed.

### Directory groups

The **Directory group** criterion makes members of the people in a Microsoft Entra or Google Workspace group. The **Manage directory groups** link opens the **Directory groups** window: choose the **Directory**, enter the **Object ID** (Entra) or the **Group address** (Google) and a **Label**, then click **Add**. Membership is read every hour, or on demand with **Synchronise now**. A group that has never been read cannot grant a role yet, and an employee without a linked directory account does not receive one. This criterion is not offered for an administration role.

## Member exclusions

“Members matching an exclusion group are removed from the authorized population.” Click **+ Add exclusion group**, then add criteria: **Employee**, **Sub-company**, **Office**, **Department**, **Team** or **Position**. An exclusion overrides every way of holding the role, individual addition included.

## Temporary role

1. At the top of the tab, switch on **Temporary role**.
2. Enter the **Start date** and the **End date (auto-deactivation)**. The number of days left is displayed.

The role only applies between these two dates, both included; without an end date, it grants nothing. The day after the end date, Illizeo deactivates it overnight. Seven days beforehand, a box above the role cards announces it.

## From an employee’s profile

The **Roles** tab of an employee’s profile shows the roles assigned to them individually, under **Current roles**. Each one shows its permissions per level and a summary of its target population.

- **Remove** takes a role away from the person; **Add a role** lists the other roles, to add in one click.
- **Combined effective permissions** gives the highest level of each permission among their roles; **Show details** lists them with the role that grants them.
- The add-employee wizard offers the same view at its **Roles** step.

Seeing the tab requires “View role members” and “View the permissions matrix”; changing it requires “Add an individual member” and “Remove a member” at Execute level. The roles of a person who has left cannot be changed.

![The Roles tab of an employee's profile: Current roles with each role, its description, its permissions per level and the Remove button, the Add a role list, then the Combined effective permissions box](https://i0.wp.com/illizeo.com/wp-content/uploads/2026/11/roles-assign-a-role-03.en_.png?resize=800%2C284&quality=80&ssl=1)
The Roles tab of an employee's profile.

## Good to know

- The profile’s **Roles** tab only lists roles assigned individually. A role held automatically or by criteria does not appear there, but its permissions count: check them in **Effective permissions per employee** (see [Understanding roles and permissions](https://illizeo.com/en/centre-aide/roles-understanding-permissions/)).
- Every employee keeps the All employees role: removing it from their profile does not take it away.
- Adding yourself to a role, or adding someone to an administration role, requires Admin level on “Add an individual member”. Without it, Illizeo refuses with a message, for example “You are not allowed to assign a role to yourself.”
- A role cannot be deactivated or deleted while it has individual members.
- The groups in **Settings › Manage Employees › Groups** grant no role: see [Creating employee groups](https://illizeo.com/en/centre-aide/roles-employee-groups/).

## FAQ

### A new manager does not have manager permissions.

Check that they are named as manager in their team members’ profiles and that the **Managers (Job Information)** switch of the Manager role is on. Otherwise, add them as an individual member.

### How do I give a role for the length of a cover period?

Duplicate the role concerned, add the person to it as an individual member, then switch on **Temporary role** with the dates of the cover period.

### *Similaire*