UKG Pro Role-Based Security: HR, Payroll and Manager Access
Role-based security in UKG Pro works when you design it around duties, not job titles. Give HR, payroll and managers separate roles, restrict sensitive fields such as SSN, bank and pay data to the few people who process them, keep payroll entry and approval apart, and treat UKG Pro WFM profiles as a second layer you design and review together.
Key takeaways
- A UKG Pro environment usually has two access layers: the HCM and payroll suite, and UKG Pro Workforce Management (WFM), which uses function access profiles and related assignments. Design both from one role catalog.
- Least privilege (NIST SP 800-53 AC-6) and separation of duties (AC-5) matter most around payroll changes, bank accounts and off-cycle payments.
- Treat SSN, bank details, compensation and benefits data as a separate sensitivity tier with its own short list of roles.
- Quarterly access reviews and same-day termination handling are what auditors test, so build evidence as you go.
How is access structured across UKG Pro and UKG Pro WFM?
Most UKG Pro customers run two connected access models. The HCM and payroll side controls who can view and change employee, compensation, tax, benefits and payroll records. The time and scheduling side, UKG Pro WFM, controls who can edit timecards, approve time, build schedules and run reports. Because they are configured separately, a manager can be tightly scoped in one and broadly scoped in the other.
On the WFM side, UKG's public help explains that function access profiles define the functions employees or managers can access, and that all functions are disallowed by default, with each one set to allowed or disallowed for actions such as add, edit, delete and view (see the UKG Pro WFM help on function access profiles). UKG's article on adding UKG Pro WFM settings for a new employee shows the other assignments that travel with a person: an access toggle, an employee template carrying function access and display profiles, a license template and an employee group. WFM help also describes separate report data access profiles.
For the HCM and payroll side, role names, field-level options and masking behavior depend on your configuration and release, so confirm them in your tenant documentation rather than assuming they mirror WFM. The design principles below apply either way. If you also run Workday somewhere in the business, our guide to designing Workday security groups covers that platform's domain and business process model, which works quite differently.
Which roles should HR, payroll and managers get?
Start with a role catalog of eight to fifteen roles built from duties. NIST SP 800-53 AC-2 (account management) expects you to define authorized users, their roles and the conditions of membership, so write each role down with an owner before you configure anything.
| Role | Typical scope | Sensitive data | WFM layer |
|---|---|---|---|
| Employee self-service | Own record | Own pay, tax and bank data | Own timecard and schedule |
| People manager | Direct and indirect reports | No SSN or bank; pay only if policy allows | Approve time and edit schedules for own group |
| HR generalist | Assigned locations or companies | Personal data; SSN masked or view only | View only, usually |
| Benefits administrator | All benefit-eligible employees | Dependents and elections; no bank edits | None |
| Payroll specialist | Assigned pay groups | Pay, tax, deductions; bank changes via approval | View timecards, no edits after sign-off |
| Payroll approver | Assigned pay groups | Review only | None |
| System administrator | Configuration | Ideally none in production employee data | Profile and rule setup |
Scope matters as much as permission. Tie scope to the organizational levels, locations or pay groups that mirror how work is actually divided, and keep your timecard approval chain consistent with the UKG timecard approval and payroll close workflow so approvers always have the access their step needs.
How do you protect SSN, bank and pay data?
Sort fields into tiers before you assign anything. Tier one covers government IDs, bank account and routing numbers, and full date of birth. Tier two covers pay rates, bonuses, garnishments and benefit elections. Tier three is everything else in the employee record. Then apply three rules:
- Edit is rarer than view. Route bank changes from anyone other than the employee through a second person.
- Mask by default. Where your configuration supports masking or partial display, use it for roles that only need to confirm identity.
- Watch the side doors. Exports, ad hoc reports, integrations and API accounts often bypass screen-level restrictions. Report access in UKG Pro WFM has its own profiles, and analytics tools carry their own permissions, so review them with the same tiering. Our article on UKG reporting with Data Hub and People Analytics covers the reporting side.
What does segregation of duties look like for payroll?
NIST SP 800-53 AC-5 asks organizations to identify duties that should be separated and to define access to support that separation. In payroll, the classic conflicts are easy to list and hard to enforce because small teams cover for each other.
| Duty A | Should not combine with | Compensating control if staff is small |
|---|---|---|
| Add or rehire an employee | Enter that employee's pay or bank data and release payroll | New hire report reviewed by HR before each payroll |
| Change pay rates | Approve the same change | Pay change audit report signed off each cycle |
| Edit direct deposit for others | Process or release the payroll | Bank change report compared to employee-initiated requests |
| Edit timecards after sign-off | Approve the resulting payroll | Post sign-off edit report reviewed by payroll lead |
| Configure security | Hold an operational payroll role | Change log reviewed by IT or internal audit |
When one person must hold conflicting duties, document the exception, name the compensating report, and have someone outside the role review it every cycle.
How to apply this: a worked example
Consider a hypothetical 300-person distributor with three warehouses, two payroll staff and one HRIS analyst. At go-live, everyone in HR received a broad admin role "to get through the first payroll," and warehouse supervisors were scoped to the whole company in WFM.
- Inventory. The HRIS analyst exports role and profile assignments from both layers and lists who holds tier one edit rights. Seven people can change bank details; only one processes them.
- Redesign. Supervisors move to a manager role scoped to their own warehouse. HR generalists lose bank edit rights. Payroll keeps pay entry, but a second payroll person approves rate changes and bank changes made on an employee's behalf.
- Handle the small team. Because two payroll staff cover for each other, the controller reviews a pay change and bank change report before each payroll is released.
- Test. In a non-production environment, the analyst signs in as test users for each role and confirms what each can and cannot see, following the same discipline used in a UKG go-live readiness checklist.
How should access reviews, terminations and audit evidence work?
AC-2 also expects you to review accounts on a defined frequency and to disable accounts promptly when people leave or change roles. In practice:
- Quarterly reviews: each role owner certifies who holds the role, with special attention to tier one edit rights, admin roles and integration accounts.
- Movers: when someone transfers, remove the old role before adding the new one. Mover gaps are where access quietly accumulates.
- Leavers: disable system access on the last day, and remove WFM access and approver assignments at the same time so approvals do not route to a former manager.
- Evidence: keep the review export, the sign-off and tickets for every change. If your auditors or customers rely on a SOC report, the AICPA SOC suite of services explains how CPA firms report on controls; logical access is usually among the first areas examined. Our SOC 2 guide for HR directors translates the terms.
Common mistakes
- Cloning an existing user's access for every new hire, which copies their exceptions too.
- Designing the HCM side carefully while leaving WFM manager scopes company-wide.
- Leaving implementation consultants and test accounts active after go-live.
- Granting payroll staff security administration so they can "fix things quickly."
Frequently Asked Questions
What is least privilege in UKG Pro?
Least privilege means each user gets only the access needed for assigned tasks, a principle described in NIST SP 800-53 control AC-6. In UKG Pro that means narrow scopes by company, location or pay group, view rather than edit where possible, and keeping SSN, bank and pay edit rights with the few roles that actually process them, in both the HCM and WFM layers.
Should managers see employee pay rates in UKG Pro?
It depends on your compensation policy. Many organizations let managers see pay for salary planning but not SSN or bank data. If managers should not see pay, check report access and WFM views as well, since cost or wage data can surface through scheduling and labor reports.
How often should UKG access be reviewed?
A common practice is a quarterly review of privileged and sensitive data roles and an annual review of the full role catalog, plus one after reorganizations. NIST SP 800-53 AC-2 leaves the frequency to the organization, so agree on it with internal audit and your external auditors, then document it in your access policy.
Can one payroll person enter and approve changes if the team is small?
It happens, but it should be a documented exception with a compensating control. The usual approach is an independent review of pay change, bank change and new hire reports by someone outside payroll, such as the controller, before each payroll is released. Record who reviewed, when, and what they found so the control can be evidenced in an audit.
Next steps for your UKG security model
Export current role and profile assignments from both UKG Pro and UKG Pro WFM, tier your sensitive fields, and draft a role catalog with an owner for each role. Build the payroll segregation of duties matrix, fix the highest-risk conflicts first, test with persona accounts and book your first quarterly review. For more admin guides, see our UKG guides hub.
Last reviewed: October 2026.
Comments
Post a Comment