Portal Access

Portal Access is where you control the Employee Portal: the personal link each employee opens on their phone to check in and out, and to see their own leave, payslips, timesheets, policies, warnings, documents and profile behind a PIN. Employees do not need a Solavel account or a seat to use it.

On this screen you set the organization-wide portal rules, see every employee's portal state at a glance (link, protected access, device, PIN), copy or export links to send to staff, enable or disable access in bulk, reset devices, and approve or reject device-reset requests.

HR officers use it during onboarding (sending links), when someone changes phone (device resets), and when someone leaves (access is removed automatically, and you can check it here).

The employee's side of the portal (what the phone shows, the updates bell, device notifications, My Resignation) is described in Employee portal.

The Employee Portal is not the same as My Portal. My Portal is self-service inside SolaHR for people who sign in with a Solavel account (see My Portal). The Employee Portal works from a link, with no sign-in.

Where to find it

Sidebar: People → Portal Access. The page heading reads Employee Portal Access, with the subtitle "Manage unified attendance and protected employee self-service links for this organization."
URL: /employees/portal-access. Opening /employees/portal-access?status=reset_requested (for example from a device-reset notification) pre-selects the Reset requested view.
For one employee: the Employee Portal Access card on the employee's Overview tab (People → Employees → employee).

Who sees it	Condition
Menu item, page, and the card on an employee profile	Your role has Manage employee portal links, devices, PINs, and sessions (`hr.employee_portal.manage`).

By default only the Owner and SolaHR Administrator have this permission. It is not part of the default manager or member permissions, or of any scoped role. Without it the menu item is hidden, and opening the URL shows Access denied.

How the Employee Portal works

Part	What it is
Personal link	One link per employee, in the form `https://…/employee/portal/{organization number}/{token}`. Anyone who has it can open the employee's portal page, so treat it like a key.
Quick attendance	Check in / Check out from the link. No PIN is needed, but the employee must be at an allowed attendance location and on their bound device.
Device binding	One phone per employee. The first browser that records a successful attendance, or that taps Connect this phone at an allowed work location, becomes the employee's device. A different browser (even on the same phone) is a different device. A browser that is already the connected device of another employee is refused before anything is recorded: "This phone is connected to another employee. Each employee must use their own phone."
Protected self-service	The private area (leave, payslips, timesheets and so on), unlocked with a 6-digit PIN the employee creates.
Protected session	After unlocking, the private area stays open for the session length you set. On a trusted browser it stays unlocked across visits until a session is ended.

Screen tour

The page has two parts: a collapsible Organization portal settings card at the top (its header shows an Enabled or Disabled badge; click it to open the card), and the employee table below it. A line under the title explains: "Manage employee self-service links, PINs and trusted devices here. These links do not grant HR management access or change organization roles."

The settings are grouped under three headings.

Organization portal settings

Portal switches (each is a switch with a one-line hint):

Setting	Default	Hint shown / effect
Employee Portal enabled	On	"Gives every employee a personal link to the portal." Off blocks every employee link in this organization.
Quick attendance enabled	On	"Employees record check-in and check-out from their link." When an employee's portal is prepared or enabled in bulk, their link is switched on only if this is on.
Protected self-service enabled	On	"Leave, payslips and records open after the employee enters their PIN." Newly prepared employees get the PIN-protected private area.
Prepare new employees automatically	On	"New employees get portal access as soon as they are added." New active employees, and employees who become active again, get a link straight away. Enable in bulk also needs this to be on.
First-device binding enabled	On, locked (Always on)	"Each link works only on the first phone the employee connects, so nobody can check in for a colleague. This cannot be turned off."

Security — "How long a PIN session lasts and what happens after wrong PINs."

Setting	Default	Rules	Effect
Protected session (minutes)	30	5–1440	How long the private area stays unlocked after a PIN.
PIN retry limit	5	3–10	Wrong PINs allowed before the PIN locks.
PIN lockout (minutes)	15	5–1440	How long the PIN stays locked after too many wrong tries.
Link distribution	Manual copy and selected export	or Individual manual copy only	Records how your organization distributes links. Export selected links stays on the toolbar whichever you choose, so follow the policy you pick.

Sections employees can see — "Employees only see the sections you tick here." Check-box chips, all ticked by default: My Resignation, Attendance, Leave, Payslips, Timesheets, Policies, Warnings, Documents, Profile. Unticking one blocks that tab for every employee. My Resignation also needs end of service in your plan.

Changes are not saved until you click Save at the bottom of the card. You then see Organization portal settings saved. If a number is out of range, you get a validation error and nothing is saved.

Toolbar

Control	What it does
Search (Search employee or number…)	Matches name or employee number.
Status filter	All, Active (portal active), Not prepared (the employee has never had portal access set up), Bound (a device is connected), Not bound, Reset requested (a pending device-reset request).
Enable, Export selected links, Reset device, Disable	Appear only after you tick at least one row. See Bulk actions.

Employee table

All employees are listed, whatever their status, sorted by name, 25 per page. Use Previous / Next at the bottom. The page indicator reads like 1 / 4.

Column	Meaning
Checkbox	Select the row for bulk actions. The header box (Select all employees on this page) selects every row on the current page.
Employee	Name in bold, employee number underneath.
Department	The employee's department, or —.
Portal	Active (green) or Inactive. Employees who have never been prepared show Inactive.
Self-service security	Three short lines: Protected access: Enabled / Disabled (whether the PIN-protected private area is on); the device state Bound, Not bound, or an amber Reset requested badge when the employee asked HR to reset their device; and Set / Not set for the PIN.
Actions	Copy Link, which is disabled when the employee has no active link. When a reset is requested, Disconnect old device and Reject also appear.

Empty state: No employees match this view.

Send an employee their link

Go to People → Portal Access and search for the employee by name or number.
Click Copy Link in their row. You see Unified employee link copied.
Paste the link into a private WhatsApp, SMS or email to the employee.

If your browser blocks the clipboard you see Could not copy the link. Select it and copy it manually., and the link appears in a read-only box next to the button. Click into the box to select it.

Every copy is recorded in the employee's portal audit trail with your name.

Copy Link is greyed out? The employee has no active link. This happens when they have not been prepared, their access was disabled, or they are not active. Use Enable (bulk) or Enable protected portal on the profile first.

Export links for several employees

Tick the employees (up to 500 per export). Use the header box to select the whole page.
Click Export selected links.
A file employee-portal-links.csv downloads, with the columns employee_number, employee and portal_url. You see Export file is ready.

Rules:

Every selected employee must have an active link. If one does not, the export fails and no file is produced. Untick that employee, or enable them first.
Each exported link is recorded in that employee's portal audit trail.
The file contains working keys to your employees' portals. Send each link only to its owner, and delete the file afterwards.

Bulk actions

Tick one or more employees (up to 200 per action). Each button opens a confirmation first, and nothing changes until you confirm. After a successful action you see Employee portal access updated. and the selection clears.

Button	Confirmation (title — text → button)	Effect
Enable	Enable employee portal access — "Selected employees will be able to use their employee portal." → Enable access	Prepares each employee: creates a link if needed, turns the portal on, and sets Protected access from the organization setting. The link is switched on if Quick attendance enabled is on.
Export selected links	— (downloads directly)	See above.
Reset device	Reset employee devices — "Device bindings for selected employees will be reset. Their next authorized device can be linked." → Reset devices	Disconnects every bound device. The next browser that records a successful attendance becomes the device.
Disable	Disable employee portal access — "Selected employees will lose access to their employee portal." → Disable access	Turns the portal, protected access and link off, ends protected sessions and disconnects devices.

When a bulk action fails, it fails for the whole selection:

Message	Cause	Fix
Only eligible active employees may receive portal access.	Enable included someone who is not Active.	Untick resigned, terminated or contract-ended employees.
Automatic employee portal preparation is disabled.	Enable needs Employee Portal enabled and Prepare new employees automatically to be on.	Turn both on, click Save, then try again. Or enable employees one at a time from their profile.
A "not found" error	Reset device or Disable included an employee who was never prepared.	Filter Not prepared and untick them.

Device reset requests

When an employee opens their link on a new phone or browser, they see This link is registered to another device (or, if that browser already belongs to a different employee, This phone belongs to another employee, which only an HR device reset can clear). They have two choices:

Connect this browser with PIN: if they have a PIN, they enter it and the new browser is added ("Enter your 6-digit PIN. Your previous browser will remain connected too."). No HR action is needed.
Request device reset: sends a request to HR. Their button then reads Request pending with HR.

People who can manage portal access get a notification. The row shows Reset requested, and the Reset requested view lists everyone waiting.

Approve a reset

Filter the view to Reset requested.
Click Disconnect old device in the employee's row.
Confirm Approve device reset — "Approve this employee's request to reset their linked device." → Approve reset.
You see Device reset request updated. The old device is disconnected. When the employee next records attendance from the new phone, that phone becomes the device.

Reject a reset

Click Reject in the row.
Confirm Reject device reset — "Reject this request and keep the employee's current device binding." → Reject request.
You see Device reset request updated. The current device stays bound.

A request can be resolved only once. If someone else already handled it, you get an error. Refresh the page.

Manage one employee from their profile

Open People → Employees → employee. In the right-hand column of the profile, the Employee Portal Access card has a status badge (Active / Inactive) and the heading Attendance and employee self-service: "Share this personal link with the employee to record attendance, request leave and access their permitted records."

When the portal is active the card shows:

Button	What it does	Message
Show employee link	Reveals the link in a read-only box (Personal employee link).	—
Copy link	Copies the personal link.	Attendance link copied.
Open link	Opens the portal in a new tab (after the link is shown).	—
Enable protected portal	Shown when protected access is off: turns on the PIN-protected area.	Updated successfully

When the portal is not active the card says "Employee access is not active. Enable the portal to prepare a personal link." with Enable employee portal, or, for an employee who is not active, "Portal access is unavailable while this employee is not active."

Under the buttons a status block lists Protected self-service (Enabled / Disabled), Employee PIN (Configured / Not configured), Connected device (the device name, or Not connected yet) and Last used. The folded section Link and security settings ("One personal link provides quick attendance and protected employee self-service. Attendance stays device-bound and location-restricted.") contains:

Button	What it does	Message
Generate new link	Asks you to confirm "Generate a new link? The old link will stop working and the connected device will be reset." The dialog uses the generic Delete button, but it replaces the link and does not delete anything else.	Attendance link updated.
Reset device	Asks you to confirm "Reset the connected device? The employee can connect this link from a new device." (same generic dialog)	Attendance link updated.
Reset PIN	Clears the PIN and failed attempts and ends protected sessions. The employee creates a new PIN next time.	Updated successfully
End protected sessions	Locks the private area on every browser. Attendance still works.	Updated successfully
Disable all access	Turns off the portal, protected access and link, and ends sessions.	Updated successfully

The card only appears for people who hold the manage-portal permission. The same profile page also holds the Allowed attendance locations card for the employee (Attendance locations).

What the employee sees

A short summary; the full tour is in Employee portal.

They open the link. The portal shows the organization's logo and name, "Welcome", and their name and employee number, in Arabic or English.
Today's attendance shows Not checked in yet, You are checked in or Today complete, with the times and today's schedule. Before their start date it says "Attendance opens on date".
On a phone with no connected device, the box Connect your phone to your account asks them to tap Locate (at a work location) and Connect this phone; a PIN can only be created after that.
They tap Locate, then Check in or Check out. Once a phone is connected it is theirs alone.
Below attendance: "Your private information is locked". They tap Create PIN (six digits, entered twice), or Unlock with their existing PIN. Protected access unlocked.
The private area shows the sections you allowed, My Resignation (after Documents), a bell with unseen updates and a count badge on each tab, and an optional Turn on device notifications button. Device notifications work only while the portal is open in a browser tab; true background push is not built.
The lock button locks the area again: Private data locked. Attendance remains available.

Too many wrong PINs lock the PIN for the lockout time you set. If a protected session ends mid-task, the employee is asked for the PIN again.

Status and lifecycle

Portal state	How it gets there	What works
Not prepared	The employee has never been prepared. For example, they were added while Prepare new employees automatically was off.	Nothing. Copy Link is disabled.
Active, PIN Not set	Prepared or enabled.	Attendance from the link. Private area after the employee creates a PIN.
Active, PIN Set	The employee created a PIN.	Attendance and the private area.
Active, Reset requested	The employee asked for a new device.	The old device keeps working until you decide.
Inactive	Disabled by HR, or switched off automatically.	Nothing. The link shows an error.

Automatic changes, from employee lifecycle events:

Event	What happens to portal access
New active employee created	Prepared automatically, if Employee Portal enabled and Prepare new employees automatically are on.
Status changes from Active to Resigned, Terminated or contract ended	Access is revoked immediately: portal off, link off, sessions ended, devices disconnected.
Status changes back to Active	A new link is issued, if auto-prepare is on, and the old link stays dead. Copy and send the new link.
Employee deleted	Access is revoked.

Permissions

Role	Portal Access page	Profile card	Notes
Owner	Yes	Yes	Full access.
SolaHR Administrator	Yes	Yes	Full access.
Manager-level SolaHR role (default)	No	No	Unless an Owner adds Manage employee portal links, devices, PINs, and sessions.
Member-level SolaHR role (default)	No	No	—
HR Manager, Department Manager, Attendance Recorder, HR Viewer	No	No	Scoped roles never include portal management.
Employees (through the link)	—	—	See and change only their own data.

Every admin action (copy, export, enable, disable, PIN reset, session end, device reset, reset decision) is written to the employee's portal audit trail with the admin's user ID.

Worked examples

Example 1 — send a new starter their link

Al Noor Trading LLC hires Sara Khan (EMP-0021, Sales Associate) on 3 November 2026. The organization settings are at the defaults.

HR adds Sara in People → Employees. Because Prepare new employees automatically is on, her portal is prepared at once.
On People → Portal Access, HR searches 0021. Sara's row shows Portal Active, Protected access Enabled, Device Not bound, PIN Not set.
HR clicks Copy Link (Unified employee link copied.) and sends it to Sara on WhatsApp.
On her first morning at Dubai Main, Sara opens the link, taps Locate, then Check in. Her row now shows Device Bound.
She taps Create PIN. Her row shows PIN Set.

Example 2 — a rollout, a lost phone and a leaver

Al Noor has 40 staff who were added before the portal was switched on. Ten of them show Not prepared.

Settings. HR sets Protected session (minutes) to 60, PIN retry limit to 5, PIN lockout (minutes) to 30, unticks Warnings (the company does not want warnings shown in the portal yet), and clicks Save → Organization portal settings saved.
Enable in bulk. HR filters Not prepared, ticks the header box (10 rows), clicks Enable → Enable access. The 10 rows move to Active.
Export. Still on All, HR ticks those 10 people and clicks Export selected links. employee-portal-links.csv downloads with 10 rows. HR sends each link to its owner and deletes the file.
Lost phone. A week later Omar Haddad (EMP-0007) loses his phone. On the new phone he has not set a PIN yet, so he taps Request device reset. HR receives a notification, filters Reset requested, clicks Disconnect old device → Approve reset. Omar checks in from the new phone, which becomes his device.
Leaver. On 30 November HR marks Ahmed Saleh as Resigned on his profile. Ahmed's row immediately shows Portal Inactive and Device Not bound, and his link stops working. No action is needed on Portal Access.
Rehire. In January Ahmed is rehired, and HR sets him back to Active. SolaHR issues him a new link. HR copies it from Portal Access and sends it. The old link from November still does not work.

Result: 40 employees on the portal. Warnings are hidden from everyone's private area. The lockout after five wrong PINs lasts 30 minutes.

How it connects

Screen	Connection
Employees	Status changes there prepare or revoke portal access automatically. The profile card manages one employee.
Attendance	Check-ins from the link create attendance records. Allowed locations and schedules are set there.
Leave	Requests from the portal go into the normal leave approval; the portal previews the days that will be deducted.
Resignations	My Resignation submissions arrive here for review.
Timesheets, Payslips	Shown in the private area when those modules are allowed.
Policies, Warnings · End of Service, Documents	Employee-visible policies, warnings and documents appear in the private area.
My Portal	Separate self-service for people who sign in to SolaHR.

Tips and common problems

Problem	Cause	Fix
Copy Link is disabled	No active link: not prepared, disabled, or the employee is not Active.	Enable the employee (bulk) or Enable protected portal (profile).
Bulk Enable fails with Automatic employee portal preparation is disabled.	Prepare new employees automatically or Employee Portal enabled is off.	Turn both on and Save, then retry.
Bulk Enable fails with Only eligible active employees may receive portal access.	The selection includes a non-active employee.	Untick them.
Export fails with no file	One selected employee has no active link.	Untick or enable that employee.
The employee sees This link is registered to another device	A new phone or browser.	They connect it with their PIN, or you approve their reset, or click Reset device.
The employee forgot their PIN	—	Reset PIN on their profile. They create a new PIN next time.
A rehired employee's old link doesn't work	Reactivation issues a new link.	Copy and send the new link.
A module is missing in the portal	It is unticked in the settings or not in your plan.	Tick it and Save.
You can't find Portal Access	You lack the manage-portal permission.	Ask the Owner.