We are experiencing something very similar where we just migrated from QB Desktop to QBO and set up our users logins. One of the users was assigned the role of "Standard all access without payroll". We tested their login to make sure that the user could not access QBO Payroll, which they could not, however, the user could access individual payroll info by way of Expenses. They could click on each record and see exactly how much each employee was paid. If they tried that same method using DT, they would get a warning saying that they needed permission to perform that action. What are we missing here with QBO?