Who can do this:
HR Manager
Administrator
Users with the Admin and HR Manager roles are able to assign different user roles to employees in order to have control over who has access to certain sections and features of the application. Roles determine access to data and to functions within the system. All users have the Employee role as standard and Admins/HR Managers can assign additional roles to any active employee.
Details of the user roles and defaults can be found here.
Administering changes to employees' roles
To change an employee's Role, go to Roles & Access from the main menu, then open the User Roles tab. Here, you can select which users have roles in addition to the standard Employee role (which is assigned to every active member).
As the Team Manager role is automatically assigned when a user is made the manager of a team, these boxes are greyed out.
Performance Manager is assigned in the Employee Admin section so these are also greyed out. (Go to Organisation > Employees > select employee > User, Login & Security > Performance Management to assign the Performance Manager role.

Select the access changes you wish to make on the Access tab clicking the check boxes and click Save Changes.
For organisations using username/password login, you can also see the status of 2 factor authentication on this page - who has it enabled it and set a prompt to those without it enabled, which takes them to the activation page on their next login.

NOTE: It is strongly recommended you check the Field Security configuration before you administer any role changes to ensure you are happy with the access for each role. For more info, see here.
Additional configurations for Restricted Staff roles
In addition to assigning employees different roles, it is also possible to configure the Leave and Company Documents access for each of the Restricted Roles.
In Leave security, there are three options:
Access to Leave Management - specify which users have access to view other employee's Leave Management sections of the application in addition to their own
Allow Submit Backfill - allow users to submit requests for others using the Backfill tool
Leave Reporting - allow users the ability to run Leave reports
Go to Leave > Admin & Config > Security.
Administer the access by selecting the tick boxes for the roles you want then click Save Changes.

If you have HR Essentials or HR Advanced, you can give access to users to edit, view & create Company Documents.
Go to Company Docs > Config > Document Types.

Click on the Document Type you wish to change the access for and then click Document Type Security. You can select which roles are able to create new Company Documents by using the tick boxes and you can change the access rights using the dropdowns.
When you are happy with the access, Click Save Changes.

NOTE: The Restricted Staff (Optional) roles column will still show in this view even if the roles are not assigned to any employee.