Gusto holds pay rates, bank accounts, tax identifiers and benefits data for every person on payroll, so a single over-permissioned admin, an unprotected sign-in or a loosely managed integration can expose the whole workforce or move money to the wrong account. Most of the protection sits in settings the customer controls: who is Primary admin, which admins hold Full Access, how each person signs in, which apps are connected and how pay changes are checked before a run. This guide covers how identity and access work in Gusto, the administrator types and limited permissions, 2-step verification and passkeys, provisioning apps and API credentials, what to monitor, and a hardening baseline aimed at payroll diversion. It is written for business owners, finance and HR operations leads, IT administrators and security teams who run a Gusto account.
This is an independent guide from NHI Mgmt Group, based on Gusto's public documentation as of November 2026. It is not sponsored or reviewed by Gusto. Product features change, so confirm settings against Gusto's current documentation.
Key takeaways
- Treat Primary admin as the root account. Gusto's Primary admin is the only admin who can add, remove or change other admins' permissions, so it needs the strongest sign-in you can give it and a documented succession plan.
- Keep Full Access small. Bank account management, third-party integrations, plan and billing and payroll suspension are Full Access areas; give everyone else Limited Access permissions where your plan offers them.
- Use an authenticator app or passkey. Gusto asks most users for 2-step verification at every sign-in and recommends an authenticator app; passkeys can replace the code once set up.
- Govern integrations as non-human identities. Only Primary or Full Access admins can approve an OAuth app, each token is limited to one company, and access tokens last two hours; review what you have connected every quarter.
- Verify pay changes out of band. Payroll diversion depends on a convincing request, so confirm any change to an employee's bank details with a known contact before the next run.
How identity and access work in Gusto
A Gusto account serves three populations: admins who run payroll, HR and settings; managers with permissions over their reports; and employees and contractors who manage their own profile, documents and pay details. An employee who is made an admin gets a separate admin profile and switches between profiles from the name menu in the top-right corner, which keeps personal and administrative actions apart.
Sign-in is per person. Gusto's 2-step verification article says most users must complete 2-step verification every time they sign in, because Gusto stores a lot of personal information. Gusto's security page also states that multi-factor authentication and single sign-on options are available. As of November 2026, Gusto's Okta integration page describes account provisioning from Gusto into Okta; confirm the current single sign-on options for your plan in Gusto's documentation before you design around them.
2-step verification methods
| Method | What Gusto's documentation says | How to treat it (NHI Mgmt Group recommendation) |
|---|---|---|
| Authenticator app | Recommended by Gusto because it avoids text message delivery problems; desktop authenticators work by copying the setup key | Minimum for every admin and manager |
| Passkey (Face ID, Touch ID, PIN or security key) | Offered after a code has been entered at least once; replaces the code at sign-in, while password sign-in and first passkey set-up still use 2-step verification | Preferred for Primary and Full Access admins |
| Text message, phone call or WhatsApp | A code is sent to the phone; Gusto notes it can be delayed when travelling or with poor signal | Acceptable for employees only where an app is not possible |
| Remember this device | Skips the code for 30 days on that device; managed under Security, Trusted devices | Avoid on shared or unmanaged devices; admins should clear trusted devices after a role change |
Users set this up from their name or the You icon, then Settings, then Security under Personal (admins use Settings, then My profile), then Set up next to Authenticator app or Text message. Gusto does not offer backup codes; it suggests adding a passkey and photo ID verification alongside the main method to avoid lockout. Recovery without the phone uses a government-issued photo ID and a selfie. See the Passwordless and Passkeys Guide and the SIM Swap Fraud Guide for why app and passkey methods matter for finance roles.
Admin roles and privileged access
Gusto documents five administrator types. The split between Full Access and Limited Access is the main privilege boundary in the product.
| Administrator type | What Gusto's documentation says | How to treat it (NHI Mgmt Group recommendation) |
|---|---|---|
| Primary admin | The only admin who can add, remove or change other admins' permissions; Full Access admins are notified when the Primary admin adds a new admin | One named owner or senior finance lead, passkey sign-in, succession plan written down |
| Full Access admin | Everything the Primary admin can do except manage other admins; Full Access only areas include company onboarding, HR setup, bank account management, plan and billing, payroll suspension, third-party integrations, assurance information and company signatory | Two or three people at most, reviewed quarterly |
| Limited Access admin | Access depends on the permissions granted; available on the plans Gusto lists for it | Default for payroll processors, HR and bookkeepers |
| Signatory | Handles signing documents | Match to the person legally authorised to sign |
| HR Resource Center Admin | Access to the HR Resource Center and Speak to HR Pros; defaults to the Primary admin, who can reassign it | HR lead only |
Limited Access permissions
Gusto's limited permission categories are Pay people, View payroll reports and tax filings, Manage accounting integrations, Manage people, Manage PTO, Manage Team Insights and Manage benefits. Gusto notes that these permissions apply to all employees and cannot be narrowed to specific groups or locations, and that selecting every limited permission is not the same as granting Full Access. That makes the choice of category the main lever:
- Separate running from approving: a person with Pay people can run payroll; keep bank account management and admin changes with a different Full Access admin so no single person can change where money goes and then pay it. See the Segregation of Duties Guide.
- Give bookkeepers reports, not people management: View payroll reports and tax filings plus Manage accounting integrations usually covers an external accountant.
- Use separate admin profiles: employees who become admins already get a separate profile; make sure they use it only for admin tasks.
Changing and removing admins
Only the Primary admin can add admins, edit their permissions or remove them, and each change triggers an email to the affected admin. To change an admin's email address, Gusto says to remove the admin and add them again with the new address. If the Primary admin has left or is the person to be removed, Gusto directs customers to contact support through the Help or Priority support section of the account. Plan for that before it happens: record who the Primary admin is, who would take over, and how you would prove authority to Gusto. See the Joiner-Mover-Leaver Guide and the Account Recovery and Help Desk Security Guide.
Integrations, API tokens and service accounts
Every connected app holds a token that can read, and sometimes change, payroll and employee data. Treat each one as a non-human identity with an owner, a purpose and a review date.
Provisioning apps
Gusto's provisioning apps feature lets admins automatically create and remove third-party app accounts, such as Slack and Zoom, from Gusto. Gusto lists it for Plus and Premium plans, with Google Workspace and Microsoft 365 work email provisioning available on all plans. The Okta integration creates Okta accounts for employees from Gusto and removes them, and needs a paid Okta plan plus Gusto Plus or Premium. Used well, this ties account removal to the termination you already record in payroll. Confirm in Gusto's documentation what each app does at termination and test it with a leaver before relying on it. See the SCIM Provisioning Guide.
OAuth apps and API credentials
| Item | What Gusto's developer documentation says | What to do (NHI Mgmt Group recommendation) |
|---|---|---|
| Who can authorise an app | Only Primary or Full Access admins can approve access for a company during the OAuth flow | Require a short written request naming the app, owner and data needed before any approval |
| Company scope | From API version v2023-05-01 each access token is limited to one company; multi-company admins authorise each separately | Keep an inventory per company, not per vendor |
| Access token | Expires after 7,200 seconds (two hours) | No action for customers; developers refresh before expiry |
| Refresh token | No expiry time, but invalid after one use | Developers store it encrypted and replace it on every refresh |
| Authorisation code | Expires in 10 minutes; the state parameter must be checked | Developers validate state on every callback |
| Redirect URI | Must match the registered URI; use exact URIs without wildcards or fragments | Developers register exact production URIs only |
| Scopes | Pair a resource and action, for example employees:read; assigned by Gusto during app review and enforced in production | Ask vendors which scopes they hold and why |
| Organisation API token | Issued from the Developer Portal at organisation level, separate from company-level OAuth tokens | Developers keep it in a secrets manager, never in code |
Gusto's scopes guidance tells developers to limit scopes to the bare minimum. For customers, the practical controls are approval, inventory and removal: know which apps a Full Access admin has approved, confirm each still has a business owner, and disconnect unused ones. Bank account changes and integrations are both Full Access areas, so an approved app with write access deserves the same scrutiny as a new admin. See the OAuth Refresh Token Rotation and Expiry Guide and the Consent Phishing and Illicit OAuth Grants Guide.
Logging and detection
Gusto sends emails for admin changes: the affected admin is told when permissions or roles change, and Full Access admins are notified when the Primary admin adds a new admin. Gusto's security page also states that it monitors accounts to help prevent fraudulent transactions. Build your own detection around those signals and around payroll reports. Confirm in Gusto's current documentation which activity reports and change histories your plan provides.
| Signal | Where it comes from | Why it matters |
|---|---|---|
| New admin added or permissions changed | Gusto emails to the admin and to Full Access admins | Privilege change is the first step in most payroll account takeovers (ATT&CK T1098 Account Manipulation) |
| Employee bank details changed close to a pay date | Payroll preview and reports before approval | The classic payroll diversion pattern |
| Several employees moved to the same bank account | Payroll reports exported to a spreadsheet or finance system | Points to a single fraudulent destination |
| New app connected | Integrations list reviewed by a Full Access admin | Token theft or an unapproved app (ATT&CK T1528) |
| Sign-in recovery by photo ID for an admin | The admin reports it or the identity team is told | Recovery is a target for social engineering |
| Phishing that imitates Gusto emails | Email security and user reports | Credential capture leads to cloud account misuse (ATT&CK T1566.002, T1078.004) |
Route admin-change emails to a shared, monitored mailbox as well as to individuals, so one compromised inbox cannot hide the alert. See the Payroll Diversion Fraud Guide for the wider process.
Metrics that show it is working
- Full Access count: number of Primary and Full Access admins, target three or fewer for a small company (our recommendation).
- Strong sign-in coverage: percentage of admins using an authenticator app or passkey, target 100%.
- Verified bank changes: percentage of bank detail changes confirmed out of band before the next run, target 100%.
- Integration review: percentage of connected apps with a named owner reviewed in the last 90 days.
- Leaver lag: time from termination in Gusto to removal of the person's admin profile and third-party accounts, target same day.
Hardening baseline
These are customer-side settings and processes. Rotation periods, counts and timings are NHI Mgmt Group recommendations, not Gusto requirements.
- Inventory first: list every admin, their type and permissions, every manager, and every connected app. Record the Primary admin and a named successor.
- Reduce Full Access: move anyone who only runs payroll, approves PTO or reads reports to Limited Access with only the categories they need. Keep bank account management and integrations with a small Full Access group.
- Strengthen sign-in: ask every admin to add an authenticator app and a passkey, and to set up photo ID backup so recovery does not depend on SMS. Pilot with the finance team for a week, then extend to managers.
- Clear trusted devices: ask admins to review Trusted devices and remove any they do not recognise or no longer use.
- Review integrations: disconnect unused apps, confirm scopes with each vendor that has write access, and assign an owner to each remaining app.
- Turn on provisioning where it fits: connect provisioning apps so termination in Gusto removes app accounts, then test with a leaver.
- Write the bank change procedure: no change to an employee's bank details is accepted by email or chat; the employee makes it in their own account and a payroll lead confirms it by calling a number already on file. Hold the first payment to a new account for review if your process allows.
- Review quarterly: re-run the inventory, compare with HR records and remove leavers. See the Access Reviews Guide.
Rollback: permission changes take effect immediately and the admin is emailed, so tell people before you reduce access. If a change blocks a payroll run, restore the single missing permission rather than reverting to Full Access.
Small and larger organisations
A business with one owner and a bookkeeper may only have two admins; there the priorities are passkeys, a written successor for the Primary admin and the bank change call-back. A larger company with HR, payroll and finance teams should map each team to Limited Access categories, use provisioning apps, keep an integration register and send admin-change alerts to the security team.
Framework mapping
| Control area | Gusto setting or process | NIST SP 800-53 Rev 5 | NIST CSF 2.0 |
|---|---|---|---|
| Account management | Admin inventory, provisioning apps, leaver removal | AC-2 | PR.AA-01 |
| Least privilege and separation of duties | Limited Access categories, small Full Access group | AC-6, AC-5 | PR.AA-05 |
| Authentication | Authenticator app, passkeys, trusted device review | IA-2 | PR.AA-01 |
| Monitoring | Admin-change emails, payroll report review | AU-2, AU-6 | DE.CM-03 |
Common misconfigurations
- Everyone is Full Access: small teams often give every admin Full Access for convenience, which puts bank account management and integrations in many hands. Use Limited Access categories instead.
- No plan for the Primary admin: when the only Primary admin leaves, nobody can change admin permissions until support verifies a replacement. Name a successor and keep the evidence of authority ready.
- SMS-only 2-step verification for admins: text codes are the method most exposed to SIM swap and delivery problems. Move admins to an authenticator app or passkey.
- Bank changes accepted by email: a request from a lookalike address to update direct deposit is the most common payroll diversion route. Require the employee to make the change in Gusto and confirm by phone.
- Forgotten integrations: apps approved years ago keep their access. Review them quarterly and disconnect what nobody owns.
- Trusted devices that outlive the role: a remembered device skips the code for 30 days. Clear trusted devices when someone changes role or leaves.
Practitioner checklist
- Record the Primary admin, a named successor and how you would prove authority to Gusto.
- Keep Primary and Full Access admins to a small named group and review them every quarter.
- Give payroll processors, HR and bookkeepers only the Limited Access categories they need.
- Require an authenticator app or passkey for every admin and manager, with photo ID backup set up.
- Clear trusted devices after role changes and on leavers' devices.
- Keep an integration register with owner, scopes and review date; disconnect unused apps.
- Connect provisioning apps so termination removes third-party accounts, and test it.
- Confirm every bank detail change out of band before the next pay run.
- Send admin-change notifications to a monitored shared mailbox.
- Track the five metrics above and report them to the finance lead monthly.
Standards and references
- Gusto: Types of administrators
- Gusto: Manage administrator permissions
- Gusto: Set up and manage 2-step verification
- Gusto: Set up provisioning apps
- Gusto Developer Documentation: OAuth2
- Gusto Developer Documentation: Scopes
- Gusto: Payroll security features
- NIST: SP 800-53 Rev. 5 Security and Privacy Controls
Related NHI Mgmt Group resources: Payroll Diversion Fraud Guide · Segregation of Duties Guide · SaaS Security Guide · Phishing-Resistant MFA Guide