One shared admin password is how small offices leak their own HR data. OrangeHRM's role system exists so that never has to happen — if you set it up the way this guide describes.
✍️ Technical Anshu🔑 Access Control👥 User Management
🎥 Watch the complete OrangeHRM server setup in the video, step by step
Every OrangeHRM login is one of a few kinds, and the kind decides what that person can see — from nothing but their own leave balance to every record in the company. Roles are cheap to set up and expensive to fix after a leak. Here is the honest map.
Admin — Users list with roles (illustration)
Admin > Users
Username Role Employee
------------ ---------- -----------------
manager Admin Office Manager
hr.assistant Admin HR Assistant
r.verma ESS R. Verma
s.khan ESS + Supervisor S. Khan
Example user list — note how few Admin rows a healthy system has.
1
The Three Levels of Power
Admin — full control: every employee record, all configuration, user management. This is the master key
ESS (Employee Self Service) — the ordinary employee login: own details, own leave, own timesheets. Nothing about anyone else
Supervisor — not a separate login type but a flag on an ESS user: it adds approval powers over the people who report to that person — their leave requests, their timesheets
Almost everyone in the office should be ESS. Supervisors are ESS plus the flag. Admins should be countable on one hand — usually on two fingers.
2
Who Should Get Admin — the Short List
The system owner (decides access, holds the recovery responsibility)
The person who maintains records daily — HR or office administrator
That is the list for most small offices. A second daily admin is a luxury; a fifth is a risk
Managers do not need Admin to approve leave — the Supervisor flag does that. The owner does not need to share their login "for convenience" — convenience is how the password ends up in a notebook in a drawer.
3
Link Every User to an Employee Record
Under Admin → Users, each ESS account is linked to an employee from PIM. This link is not decoration:
It decides whose leave balance and details the login sees
It decides whose requests a supervisor approves (via the reporting line in PIM)
An unlinked or wrongly linked account produces the classic complaint — "I logged in and saw someone else's leave" — which is a configuration error, not a software bug
Create the employee record first, then the login, then test the login yourself before handing it over.
4
Passwords and Account Hygiene
Set a temporary password, and have the employee change it at first login — never let the whole office run on passwords the admin chose and still knows
When someone leaves the company, disable their user account the same day — the employee record stays for history; the login must not
Review the Users list every few months: ex-staff logins and forgotten admin accounts are the doors nobody watches
Never create accounts "for the team" or "for the branch" — accounts are people, or they are holes
5
What ESS Users Honestly Cannot Do
Setting expectations prevents support tickets:
ESS users cannot see colleagues' salaries, records or leave balances
They can update only the personal details the admin allows — job details, pay and reporting lines stay admin-side
Supervisors approve for their own reports only — a supervisor in one branch cannot approve another branch's staff unless the reporting lines say so
If someone needs more than their role gives, that is a policy conversation with the owner — not a quiet upgrade to Admin.
🔴 The one rule that matters most: admin accounts are named people, never shared. The day two people use one admin login, you lose the ability to answer "who changed this record" — and with HR data, that question always eventually gets asked.
🎥 Watch the Complete Setup Video
See the full OrangeHRM server setup on screen — installation, configuration and the first login, step by step.
A supervisor sees and approves requests from employees who report to them, as set in each PIM record. Company-wide visibility is an Admin power. If a senior manager genuinely needs the full picture, the dashboard leave views and reports can be provided by an admin without handing over an admin login.
An employee left last month. Should I delete their record?
No — disable their user login so they cannot sign in, and mark the employee record as terminated. The record itself is history the company may need for years (service letters, disputes, rehire). Deleting destroys that; disabling the login closes the risk.
How many admin accounts should a 25-person office have?
Two is the healthy number: the owner and the person maintaining records daily. Each with their own login and a strong password. Everyone else works through ESS and Supervisor roles, which cover approvals and daily use completely.
This guide is based on the Technical Anshu OrangeHRM video • Stuck on a step? Ask in the video comments 🙏