1. In a nutshell

Bookings offers five types of roles, each with predefined permissions. These permissions can be modified to suit your preferences and ensure privacy by defining their access levels and responsibilities.

2. Feature availability

• Available for paid plans.

• Roles

• Super admins and admins can manage roles. 
  
• Workspace admins and managers can view roles and permissions settings, while staff  will not be able to modify the information.

3. Overview 

Roles

Zoho Bookings has five types of predefined roles: super admin, admin, workspace admin, manager, and staff. These roles can perform the below operations by default.

• Super admins and admins can perform all configurations and integrations.
• Workspace admins can perform all configurations like an admin for the assigned workspaces alone except integrations. 

• Managers can only view all the configurations except for integration for the assigned workspaces.

• Staff can only view their appointments, add external calendars, and add appointments, and cannot view the configurations.

Permissions

Whether it's a small business managing a handful of appointments or a large enterprise coordinating complex schedules, defining and implementing proper permissions for employees is a critical aspect to ensure secure operations and maintain confidentiality. It not only ensures what actions employees are allowed to perform, but also what they are restricted from accessing. The above roles are defined with a different set of permissions, which can be referred to in the below table.

3.1. Default permissions for different roles

3.2 Setting permissions 

Super admins and admins can modify the default permissions for the Staff role through the Roles and Permissions feature. 

By default, users with the Staff role can

• Edit their profiles except working hours
• View all booking page links
• View all customers

These default access can be modified by providing additional access or restricting the access like 

• Allowing them to edit their own working hours
• Restricting them to view only the booking pages that they are related to.
• Allowing them to access only those customers' details who've booked with them. 

Note: The ability to configure permissions is presently available only for the Staff role. This feature will be extended to other roles in the future.

4. Steps to set permissions

1. Click the Admin Center icon  in the top-right corner of the Bookings menu bar. 
2. Select Roles and Permissions under Product Customizations. 
   
   

3. By default, the Staff role is selected in the dropdown. You can set the following permissions for this role:

• My Profile:

• View: Allows staff to view their own profile

• Edit: Allows staff to edit their own profile, including their working hours
• Add/Delete/Export: Not Applicable

• Booking Page:

• View:

• All Booking Page: Allows staff to view all the booking page links

• My Booking Page: Restricts staff to only view the booking page link of the event types that the staff member is involved in.

• Edit/Add/Delete/Export: Not Applicable

• Customer

• View:

• All Customers: Allows staff to view all customers

• My Customers: Restricts staff to view only customers who have booked with them.

• Edit: Allows staff to edit customer information.

• Add: Allows staff to add new customers.

• Delete: Allows staff to delete customers.

• Export: Allows staff to export customer information.
  Note: The above Edit, Delete, and Export access depends upon the option chosen in View permission. If the All Customers option is chosen, then they can perform the actions on all the customers. If the My Customers option is chosen, then they can only perform the actions on their own customers.  

If the above permissions are enabled and then later disabled, then the respective permission will be restricted. 

5. Points to note 

• If the Edit option is enabled for My Profile, it allows staff to set their own working hours.
• If a staff attempts to add an existing customer who hasn't booked with them, and their view permissions are set to My Customer, then the customer details will be populated automatically. Let's assume that the staff can only view their customers. In this case, if the staff adds a customer who is already present in the org, but is not assigned to them, then the customer they are trying to add will be populated automatically once they enter the email and contact number. 

• The booking page link is a public URL. Even if the staff is restricted to viewing only their booking page link, this restriction will be applied only within the Bookings application. If the staff has other booking page links that they are not involved in, they can still access the booking page. 

6. Related links

• Add users 
• Manage users
• Delete user