We've set it up so our HR admins are the only ones that access and configure HR side of things. IT administrators can't do anything on the HR side.