The Users menu includes several options, including creating a User in the system, establishing Groups to link to the Group Chain workflow, API Access Tokens for third-party integration, and duplicate user/employee relations.

Users

Role: For users with the District Manager or Admin role. NOTE: The District Manager role cannot create, edit, or delete a user with the Admin role.

A "User" is a person for whom the software is designed and who uses the software. ESS users are assigned one or more roles. The roles assigned to the user determine the access that the user will have in the ESS system. Please refer to ESS Roles Crosswalk under More Information on Users for the list of available Roles in ESS and the Kiosk counterparts.

Create a User

An ESS user account may be created via the User menu, or a user may self-register via the login screen by clicking on Register User. The username entered when creating the user account is the same username used to log in to Employee Self Service.

From the Users menu, select 'Users'.
Click .
1. Enter/Select desired user information. Fields denoted with a ^. are required fields.
  1. If the user account is an employee of the district, select the employee by clicking the drop-down arrow under ‘Select Employee’ or enter a name to start filtering an employee. Once selected, it will auto-populate the full name and email address from the USPS Employee record. (Primary email address from USPS is pulled by default.)
  2. If the user is using Active Directory, enter their Active Directory username in the ‘Username’ field. Also, check the ‘External Authentication’ box.
  3. If the user is using DUO or miniOrange, check the ‘Two Factor Authentication’ box.
  4. For those users who want their ESS leave balances synced with Absence Management, check the ‘Sync to Absence Management’ box.
    1. NOTE: Both the ‘Enable Absence Management Integration' and 'Enable Leave Balance Sync (Push) to Absence Management’ must also be checked under System>Configuration>Absence Management District Configuration.
  5. The Password Expiration date and time is automatically set when the ‘change password’ option is used.
  6. The ‘User’ role will be added by default. If additional roles need to be added to the user, click on the dropdown to select additional role(s). User Roles are defined under ESS/Kiosk Roles Crosswalk under ‘More Information on Users’
Click on to create the user or to cancel without saving changes.
Click to close the view of the selected employee.

DUO/miniOrange and Active Directory Information

Additional information on configuring Active Directory and DUO/miniOrange is located in the Employee Self Service Installation Guide.

Users Grid Options

The User grid allows users to search for existing accounts by clicking in the filter row in the grid columns and entering the desired information. The user may use the more buttonto add or remove columns from the grid. The columns on the grid may be re-ordered, and the preference will be retained. Click the Reset button to return to the original column order on the grid.

View the user record. Click to view the record, Edit the record, or generate an Audit report on the record.
- - Audit Report allows an Audit report to be generated based on the defined start and end dates.
Edit the user’s record.
- Click to save the changes.
- Click to return without saving the changes.
- Click to close the Group’s window.
Change Password - change a user’s existing password. NOTE: This password option can only be used for local or Two-Factor authentication. If you are set up for external authentication, please contact your AD manager.
Deletes a user account. User accounts may be deleted. NOTE: We strongly recommend disabling a user account instead of deleting the record. To disable a user account, edit the record and deselect the ‘enabled’ button.
- NOTE: Deleting a user will not delete their existing leave requests or timesheets. If a user is part of a group, their user account cannot be deleted until they are removed from the group.
Lock Users - User accounts can only be locked via the grid by selecting one or more user accounts and clicking . Locking a user will prevent them from logging into the application. Only a user with the Admin or District Manager role can unlock a user’s account.
- Note that the Admin account cannot be locked. If the Admin account is accidentally checkmarked, the system will skip the Admin user and provide a notification.

Unlock Users - User accounts can only be unlocked via the grid by selecting one or more user accounts and clicking the button. Only a user with the Admin or District Manager role can unlock a user’s account.
Bulk Reset Passwords: Enables the mass reset of passwords for selected users. To do this, checkmark specific users or select all users by using the top checkbox on the grid. A pop-up window appears displaying a grid of the selected users and their password expiration dates (if applicable). Click ‘Confirm’ to reset their passwords. The Password Expiration date and time will automatically populate in the User’s account, requiring the user to reset their password at the ESS login page by selecting the ‘Forgot Password’ option.

Users with the ADMIN role and/or Externally Authenticated users will be excluded from the bulk reset password process. If selected, a warning message will appear stating ‘Cannot reset local passwords for external or admin users’ and those users will be excluded.

The default setting in System>Configuration>Forgot Password Configuration to change a password is 5 minutes. If using Bulk Reset Passwords and you prefer to extend the time, you may increase the ‘minutes until expiration’ setting to give users more time to reset their password. For example, if a Bulk Reset Password is performed at 1:00 PM, and the district’s ‘forgot password configuration’ is 30 minutes, the user will receive an automated email with a link to reset their password. The user has exactly 30 minutes from when the email was sent to change it to a permanent password. If a user does not reset their password in time, they can use the ‘forgot password’ link on the login page to change their password.

Export Grid Items: Checkmark specific users or use the top checkbox to select all users based on the filter you entered. Click to generate a CSV-formatted spreadsheet based on the users you filtered. For more information on updating user information via a spreadsheet, please refer to the System>Mass Load option.

Groups

Groups are made up of users in the ESS system who are responsible for approving and/or receiving notifications for leave requests or Timesheets. Once a group is created, it can be added to a Group Chain.

Leave Request Groups

Role: For users with the Leave Approval Workflow Manager, District Manager, or Admin role.

Create a Leave Request Group

From User>Groups, ensure the ‘Leave Request’ tab is selected.

Click . Fields denoted with a ^. are required fields.
Name: Enter the desired name of the Group and description.
Description: Enter a description for the Group.
And/Or: Select either And or Or.
1. AND requires all Approver Group Members to approve the leave request.
2. OR requires only 1 Approver Group member to approve the leave request.
Group Members: Select the group members to be included. The list to choose from will include all active ESS users as well as two additional unique users:
1. Supervisor - Selecting the Supervisor as a Group Member to approve will include the supervisor on the user's USPS Position record.
2. Manager - Selecting the Manager as a Group Member to approve will include users with the Leave Manager role in ESS.
  1. NOTE: When adding a Supervisor or Manager group member to a Group:
    1. You must use the OR option; otherwise, the approval workflow will attempt to flow to ALL supervisors or managers instead of the one specific to this position.
    2. Must ensure the Role of Supervisor and Manager are added to the applicable Users.
      1. Manager -Leave Manager role
      2. Supervisor:
        Leave Supervisor for the Staff role
        Leave Request Approver role
3. Group Members - The group member dropdown allows multiple selection. When one or more group members are selected, click to add them to the Group. The group will display the Username, Name, and the Group Member Type, which assigns their approval access.
4. Group Member Type
  1. Approver: The member is an approver and will be sent an email notification when the leave request needs approval.
  2. Read-only Access: The member is not an approver, but is allowed to view the leave request.
  3. Read-only Access with Notifications: The member is not an approver, but will be sent an email notification when a leave request is awaiting approval, and also when the Leave Request is approved, rejected, or cancelled.
Click on to create the leave request group or to cancel out of the window without saving changes.

Example: Brian Horn is the Transportation Supervisor who approves bus drivers' leave requests. Brandy French is the Transportation Secretary who can view bus driver leave requests and receive an email notification when a request is awaiting approval (from Brian), but she cannot approve the leave request.

Leave Request Groups Grid Options

The Groups grid allows the user to filter the Groups by clicking on the filter row in the grid columns and entering the desired search query.

View the Group record. When viewing a group, you have the options to Edit the group, Copy the Group to a Timesheet Group, and generate an Audit report of the Group’s record.
Edit the group record. Editing will allow you to add or remove group members and/or to update the Group Member Type on the Group member.
- Click Save to save the changes.
- Click to return without saving the changes.
- Click to close the Group’s window.
- - Audit Report allows an Audit report to be generated using the defined start and end dates.
Copy to Timesheet Group - allows the Leave Request Group to be copied to a Timesheet Group.
- NOTE: When copying leave request groups to timesheet groups and leave request Group Chain to timesheet Group Chain, the leave request groups must be copied before the leave request Group Chain.
Delete a group record. NOTE: If the group is attached to a Group Chain, you will not be able to delete the group.

Timesheet Groups

Timesheet Groups are made up of users within the ESS system who are responsible for approving and/or receiving notifications of submitted timesheets. Once a group is created, it can be added to a Timesheet Group Chain for the approval workflow.

Role: For users with the Timesheet Manager, District Manager, or Admin role.

Create a Timesheet Group

From User>Groups, ensure the Timesheet tab is selected.

Click . Fields denoted with a ^. are required fields.
Name: Enter the desired name of the Group and description.
Description: Enter a description for the Group.
And/Or: Select either And or Or.
1. AND requires all Approver Group Members to approve the Timesheet(s).
2. OR requires only 1 Approver Group member to approve the Timesheet(s).
Group Members: Select the group members to be included. The list to choose from will include all active ESS users as well as two additional unique users:
1. Supervisor - Selecting the Supervisor as a Group Member to approve will include the supervisor on the user's USPS Position record.
2. Manager - Selecting the Manager as a Group Member to approve will include users with the Leave Manager role in ESS.
  1. NOTE: When adding a Supervisor or Manager group member to a Group:
    1. You must use the OR option; otherwise, the approval workflow will attempt to flow to ALL supervisors or managers instead of the one specific to this position.
    2. Must ensure the Role of Supervisor and Manager are added to the applicable Users.
      1. Manager -Timesheet Manager role
      2. Supervisor - Position Supervisor
3. Group Members - The group member dropdown allows multiple selection. When one or more group members are selected, click to add them to the Group. The group will display the Username, Name, and the Group Member Type, which assigns their approval access.
4. Group Member Type
  1. Approver: The member is an approver and will be sent an email notification when the leave request needs approval.
  2. Read-only Access: The member is not an approver, but is allowed to view the leave request.
  3. Read-only Access with Notifications: The member is not an approver, but will be sent an email notification when a leave request is awaiting approval, and also when the Leave Request is approved, rejected, or cancelled.
5. Click on to create the leave request group or to cancel out of the window without saving changes.

Timesheet Groups Grid Options

The Groups grid allows the user to filter group information by clicking in the filter row in the grid columns and entering the desired search query

View the Group record. When viewing a group, you have the options to Edit the group, Copy the Group to a Timesheet Group, and generate an Audit report of the Group’s record.
Edit the group record. Editing will allow you to add or remove group members and/or to update the Group Member Type on the Group member.
- Click to save the changes.
- Click to return without saving the changes.
- Click to close the Group’s window.
- - Audit Report allows an Audit report to be generated using the defined start and end dates.
Copy to Leave Request Group - allows the Timesheet Group to be copied to a Leave Request Group.
- NOTE: When copying leave request groups to timesheet groups and leave request Group Chain to timesheet Group Chain, the leave request groups must be copied before the leave request Group Chain.
Delete a group record. NOTE: If the group is attached to a Group Chain, you will not be able to delete the group.

Group Chain

A Group Chain defines the leave or timesheet approval workflow by linking selected (approver) Groups with specified employees, groups, departments, etc. that are included in the workflow.

Leave Request Group Chain

Role: For users with Leave Approval Workflow Manager, District Manager, or Admin role.

Create a Leave Request Group Chain

From User>Groups Chains, ensure Leave Request is selected:

Click . Fields denoted with a ^. are required fields.
Name: Enter the desired name of the Group Chain and description.
Priority: Must be specified to determine the workflow order within each Group Chain. If two or more groups have the same priority number, the order is determined alphabetically by the Group Chain name.
Groups - Select and drag the Available (Approval) Groups from the left to the right to include in the Selected (approval) groups area.
Specific Leave Types - Once the approval groups are in the proper order, select the Specific Leave Types you want included in the Group Chain. One or more Leave Types may be specified. If left blank, all leave types will be included.
1. These include: Calamity, Comp Time, Dock, Holiday, Jury Duty, Military, Other, Personal, Professional, Sick, Vacation, and Unknown.

For each option below, use the drop-down arrow or enter search criteria to select from the options below. Click to choose your selection. Click ‘Add’ to add your selection to the grid. If you need to remove a selection, checkmark it and select ‘Remove from Grid’.sect one or multiple Employees under Employee using the dropdown. Each Position must be selected individually.

Specific Pay Groups - Select one or multiple by clicking on the desired Pay Groups.
Specific Department Codes - Select one or more by clicking on the desired Department Codes.
Specific Building Codes- Select one or more by clicking on the desired Building Codes.
Specific Sub Category (leave type sub-categories).

When specific employees are selected, this selection is mutually exclusive from all other criteria. The Group Chain can include either individual employee(s) or organizational filters such as pay groups, department codes, building codes, and subcategories—but not both simultaneously.

Once the Group Chain is set, click ‘Create’ to save it or click Cancel to return to the Group Chain grid.

Leave Request Group Chain Grid Options

The Groups Chain grid allows the user to filter Group Chain information by clicking in the filter row in the grid columns and entering in the desired search query. We recommend selecting the more button to add or remove columns from the grid.

View the Group Chain record. When viewing a Group Chain, you have the option to ‘edit’ the Group Chain, 'copy to timesheets’ to copy the leave request Group Chain record to a timesheet Group Chain record, or click on matched employees to produce a grid of employees (and their positions) who fall under that Group Chain (aka workflow). You can also generate an Audit report on that specific Group Chain when viewing the record.
- Audit Report allows an Audit report to be generated using the defined start and end dates.
Edit a Group Chain. NOTE: If you edit the original settings of the Group Chain so that it is no longer applies to any outstanding leave requests tied to this Group Chain, you will receive an error message and the changes will not take place. Otherwise, if the edit was successful, it will restart the workflow on the leave request and the leave request’s approval trail will display ‘Group Chain Edited’.
Matched Positions: Displays a grid of employees (and their positions) who fall under that Group Chain. Employees will continue to appear in the dropdown until their position is marked ‘Archived’ or ‘Inactive’ in USPS and synced with ESS.
or allows the reorder of the priority of the district’s existing workflows. Group priority can be shared (meaning you can assign the same priority number to multiple Group Chains. It will flow by priority first and then alphabetically by name of the Group Chain.)
Copies the leave request Group Chain to a timesheet Group Chain.
- NOTE: When copying leave request Groups to timesheet Groups and leave request Group Chain to timesheet Group Chain, the leave request Groups must be copied before the leave request Group Chain.
Delete a Group Chain. If you attempt to delete a Group Chain that contains outstanding leave requests, and there is another applicable Group Chain like a 'catch all' Group Chain), the workflow for the leave request will restart. Otherwise, an error message will be received, and you will not be able to delete the Group Chain.

Catch-All Group Recommendation – If a leave request does not match any existing workflows, it is recommended that the district create a “catch-all” group to ensure that any “orphaned” leave requests are not missed and are routed directly to a user with the Leave Manager role. This group should use the OR condition and include only the Manager group member.

Timesheet Group Chains

The Groups Chain grid allows the user to filter Group Chain information by clicking in the filter row in the grid columns and entering in the desired search query. We recommend selecting the MORE button to add or remove columns from the grid.

Role: For users with the Timesheet Manager, District Manager, or Admin role.

Create a Timesheet Group Chain

From User>Groups Chains, ensure Timesheet is selected:

Click . Fields denoted with a ^. are required fields.
Name: Enter the desired name of the Group Chain and description.
Priority: Must be specified to determine the workflow order within each Group Chain. If two or more groups have the same priority number, the order is determined alphabetically by the Group Chain name.
Groups - Select and drag the Available (Approval) Groups from the left to the right to include in the Selected (approval) groups area.
Specific Timesheet Options -Once the approval groups are in the proper order, select the Specific Timesheet Options to include in the Group Chain by Appointment Type and/or Daily/Hourly. If left blank, all appointment types will be included.

For each option below, use the drop-down arrow or enter search criteria to select from the options below. Click to choose your selection. Click ‘Add’ to add your selection to the grid. If you need to remove a selection, checkmark it and select ‘Remove from Grid’.

Specific Employees and Positions - Select one or multiple Employees under Employees in the dropdown. Each Position will need to be selected individually or use the option of ‘All Positions.’ If multiple specific positions are selected for a single employee, it will be displayed on the grid in a series.

Specific Pay Groups - may select one or multiple by clicking on the desired Pay Groups.
Specific Departments Codes - may select one or multiple by clicking on the desired Department Codes.
Specific Building Codes - may select one or multiple by clicking on the desired Building Codes.

When specific employees are selected, this selection is mutually exclusive from all other criteria. The Group Chain can include either individual employee(s) or organizational filters such as pay groups, department codes, building codes, and subcategories—but not both simultaneously.

Once the Group Chain is set, click ‘Create’ to save it or click Cancel to return to the Group Chain grid.

Timesheet Group Chain Grid Options

The Groups Chain grid allows the user to filter Group Chain information by clicking in the filter row in the grid columns and entering in the desired search query. We recommend selecting the more button to add or remove columns from the grid.

View the Group Chain record. When viewing a Group Chain, you have the option to ‘edit’ the Group Chain, 'copy to timesheets’ to copy the leave request Group Chain record to a timesheet Group Chain record, or click on matched employees to produce a grid of employees (and their positions) who fall under that Group Chain (aka workflow). You can also generate an Audit report on that specific Group Chain when viewing the record.
- Audit Report allows an Audit report to be generated using the defined start and end dates.
Edit a Group Chain. NOTE: If you edit the original settings of the Group Chain so that it no longer applies to any outstanding timesheets tied to this Group Chain, you will receive an error message, and the changes will not take place. Otherwise, if the edit was successful, it will restart the workflow on the timesheet, and the timesheet’s approval trail will display ‘Group Chain Edited’.
Matched Positions: Displays a grid of employees (and their positions) who fall under that Group Chain. Employees will continue to appear in the dropdown until their position is marked ‘Archived’ or ‘Inactive’ in USPS and synced with ESS.
or allows the reorder of the priority of the district’s existing workflows. Group priority can be shared (meaning you can assign the same priority number to multiple Group Chains. It will flow by priority first and then alphabetically by Group Chain name.)
Copies the timesheet Group Chain to a leave request Group Chain
- NOTE: When copying timesheet groups to leave request groups and timesheet Group Chains to leave request Group Chains, the timesheet groups must be copied before the timesheet Group Chains.
Delete a Group Chain. If you attempt to delete a Group Chain that contains outstanding leave requests, and there is another applicable Group Chain like a 'catch all' Group Chain), the workflow for the leave request will restart. Otherwise, an error message will be received, and you will not be able to delete the Group Chain.

Catch-All Group Recommendation – If a Timesheet request does not match any existing workflows, it is recommended that the district create a “catch-all” group to ensure that any ‘orphaned’ Timesheets not included in a Group Chain for approval are not missed and then routed directly to a user with the Timesheet Manager role. This group should use the OR condition and include only the Manager group member.

API Access Token

API Access Tokens inform the API that the bearer of the token is authorized to access ESS. It requires an existing ESS user account that needs to integrate with ESS, identifying the user (third party) using the application.

Role: For users with the District Manager or Admin role.

Employee Self Service is one-way integration with third-party vendors. Third-party data will flow into ESS.

Creating an API Access Token

From User>API Access token, click .
Created by, Created Date, and time will be auto-filled by the system.
Select the existing User account created for the third-party vendor, along with a description.
Enter the Expiration Date and time.
Click to create the API Access Token or click to cancel out of the window without saving changes.

API Access Token Grid Options

View the API Access Token for details. When viewing an API Token, you can Edit and generate an Audit report on that specific API Token.
- Audit Report allows an Audit report to be generated using the defined start and end dates.
- Edit an API Token. Only the grey-shaded areas can be edited. These fields include the User, Description, and the Expiration Date and Time.
- to save any changes to the API Access Token.
- to cancel without saving the changes.
- to close the View of the API Access Token record.
Renew an API Access Token.
Regenerate an API Access Token.
Delete an API Access Token.

Duplicate User/Employee Relations

The Duplicate Users/Employee Relations grid will display any ESS users who have the same (USPS) employee number. You have the option to export the grid information to a spreadsheet via the ‘Export to CSV’ option.

Example: In the image above, both ESS usernames ‘testdupblevins’ and ‘rblevins’ reported using the same Employee Number (ANON349). To confirm, in the User grid, filter for both users and review their employee numbers. If they both have the same employee number, determine which user account has the correct number and update accordingly.

review each user account

If the new User is created correctly using the drop-down option, there should be no need to use the duplicate user grid.

No two users can have the same USPS employee assigned to them.

More Information on Users

ESS Roles and Kiosk Crosswalk

Users may be assigned one or more roles. All users are assigned the ‘User’ role by default. Listed below are the available Roles in ESS, the definition, an example of the role, and the Kiosk counterpart. Please refer to the ESS Menu Options by ESS Role document in the appendix for an overview of the menu options available to a user based on their ESS role(s).

ESS Role	Kiosk Role	Definition	Example of who may be assigned the role

ESS Role	Kiosk Role	Definition	Example of who may be assigned the role
User