Every employee ID in the attendance roster gets a login: the ID is both the username and the first password. These accounts open Staff SOP only — no other section, regardless of what is ticked anywhere else. Only section heads and managers can actually sign in (someone reports to them in Create SOP, or their designation is Section Head / Head Cashier / Store Manager / Manager / Partner); sales staff are refused at the login screen. Syncing adds new joiners and disables anyone who has left; it never unblocks somebody you have deliberately shut out.