> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hr-easy.nlead.ch/llms.txt
> Use this file to discover all available pages before exploring further.

# Settings and users

> Organization structure, user administration, integrations, branding, and menu configuration.

Administration is reached from **Settings**. What you see there depends on your role —
`ADMIN` sees everything, `SYSTEM_ADMIN` sees the technical surfaces without the people
data.

## Organization

<Columns cols={2}>
  <Card title="Locations" icon="location-dot">
    Standorte with their canton. The canton drives public holidays, the default sick-pay scale, and
    cantonal payroll parameters.
  </Card>

  <Card title="Teams and org graph" icon="sitemap">
    Who reports to whom. Manager scoping for absences, salary visibility and applications is derived
    from this — it is not a display hierarchy.
  </Card>

  <Card title="Legal entities" icon="building">
    Rechtsträger, where the installation employs through more than one. Flag-gated.
  </Card>

  <Card title="Positions catalog" icon="briefcase">
    Function definitions reused across recruitment, contracts and certificates.
  </Card>
</Columns>

## Users

Creating, editing and deactivating accounts, and assigning roles.

| Capability     | Roles                       |
| -------------- | --------------------------- |
| `users:view`   | `HR_STAFF`+, `SYSTEM_ADMIN` |
| `users:create` | `ADMIN`+, `SYSTEM_ADMIN`    |
| `users:edit`   | `ADMIN`+, `SYSTEM_ADMIN`    |
| `users:delete` | `ADMIN`+, `SYSTEM_ADMIN`    |

`SYSTEM_ADMIN` administers accounts but cannot escalate: it may not create, modify or
delete a user holding `HR_STAFF`, `MANAGER`, `ADMIN` or `SUPERADMIN`, may not assign
those roles to anyone, and may not change its own role. See
[Roles and permissions](/concepts/roles-and-permissions).

### Which domains may sign in

`ALLOWED_EMAIL_DOMAINS` lists the e-mail domains that may auto-create an applicant
account on first Microsoft sign-in. Leaving it unset falls back to the Entra tenant
boundary alone, which is logged as a warning.

<Warning>
  Production installations should set `ALLOWED_EMAIL_DOMAINS` to the customer's own domains. Relying
  on the tenant boundary alone is the legacy behaviour, not the intended one.
</Warning>

## Integrations

| Integration          | What it does                                          |
| -------------------- | ----------------------------------------------------- |
| Microsoft Graph      | Shared HR mailbox, calendar invitations, Teams posts. |
| Teams channel        | Pipeline and hiring notifications.                    |
| bexio                | Payroll employee, hours and payslip sync.             |
| DocuSign / SwissSign | Electronic contract signature.                        |
| SECO Job-Room        | Stellenmeldepflicht reporting.                        |
| Cloudflare Turnstile | CAPTCHA on the public DSAR endpoints.                 |

A read-only **mailbox diagnostic** (`mailbox:diagnose`) reports credential drift, an
unconfigured mailbox, or a Graph outage, with values masked. Administrators can
self-triage without server-log access.

## Branding

Logo, colours and typography for the careers page, the portal and generated documents.
A design extractor can derive a starting palette from an existing site, which you then
adjust.

Branding is `SUPERADMIN` and `SYSTEM_ADMIN` — it is visual identity, containing no
personal data, which is why the technical operator role holds it.

## Menu configuration

Which modules appear in the navigation, and in what order. This is how an installation
that does not use, say, budgeting keeps it out of the way — alongside the
[feature flags](/operations/feature-flags), which switch the module off entirely rather
than merely hiding it.

## System configuration

Mailbox connection, cron secrets, site verification tokens and similar operational
settings sit under `system:configure` (`SUPERADMIN`, `SYSTEM_ADMIN`).

Google Search Console verification is available as an administrator-configurable token
rather than only as an environment variable, so the person who owns the domain can
complete verification without a deploy.

## What is not in Settings

Payroll master data has its own surface — see
[Payroll master data](/guides/payroll/master-data) — because it is operated by the
payroll team rather than by whoever administers the installation.