SAP EHS Incident Management uses a role-based authorization model for access control. This model ensures that users can perform their jobs, a principle known as "least privilege."
In a typical implementation, several functional and technical roles work together. For example, business roles handle the daily tasks of reporting and managing safety incidents, while technical roles ensure that the system runs smoothly.
In SAP Incident Management, a role refers to a defined set of permissions that determine what a user can do within the system. The following table provides an overview of common roles.
| SAP Fiori Launchpad | Role | Role Description |
|---|---|---|
| Report Incident | SAP_BR_INDUSTRIAL_HYGIENIST | Industrial Hygienist |
| Manage/Report Incidents | SAP_BR_HAZMAT_MANAGER | Hazardous Materials Manager |
| Manage/Report Incidents | SAP_BR_EHS_ENV_MGMT | Environmental Manager |
Note
Distinguish technical system roles from functional roles within an incident, such as the injured person, the reporter, or a witness. Find more information on the authorization concept in the course Configuring Roles and Authorizations in SAP EHS Management, Environment Management under Introducing the Authorization Concept as used in SAP S/4HANA Cloud Public Edition.
Roles
While business roles focus on process execution, the Administrator role (also referred to as the ER role) is a central technical role. It is intended for users with technical knowledge and encompasses both functional and system administration activities.
The Administrator role is essential because it provides the technical foundation for all other roles to function correctly. Without an administrator, user access cannot be granted, background jobs can fail, and system security could be compromised.
The Administrator Role
The Administrator (SAP_BR_ADMINISTRATOR) business role is a specialized role within the system. Unlike most business roles, it is not designed for operational business tasks such as processing sales orders or managing inventory. Instead, it is purpose-built for Identity and Access Management (IAM) activities.
Core Responsibilities
The Administrator role provides the necessary permissions to manage the foundation of user access and system organization. Key activities include:
- User Management: Creating and maintaining Business Users and managing the workforce via the Manage Workforce app.
- Role Definition: Defining and assigning Business Roles to users.
- Access Control: Maintaining specific restrictions within roles to ensure data security.
- User Experience: Managing SAP Fiori launchpad Spaces and Pages to determine how apps are displayed to users.
Technical Components
To support these activities, the role includes specific Business Catalogs that grant access to administrative applications:
- SAP_CORE_BC_IAM_RM: Used for maintaining Business Role metadata and restrictions.
- SAP_CORE_BC_IAM_UM: Used for the maintenance of Business Users.
- SAP_BUM_BC_MNG_WORKFORCE_PC: Provides access to the Manage Workforce application.
Caution
The Standard Role
While the Administrator role focuses on system setup, a Standard Business Role (for example, SAP_BR_INDUSTRIAL_HYGIENIST) is designed to reflect the specific job tasks of a professional business function. These roles ensure that employees can perform their daily work.
Core Purpose and Access
Standard business roles bundle all the necessary components for a specific functional area:
- Operational Access: Grants access to the SAP Fiori apps, dashboards, and data required for day-to-day business tasks.
- Functional Tasks: Depending on the role, this might include posting journal entries, managing purchase orders, or processing invoices.
- Targeted Content: Users only see the tiles and information relevant to their specific department or job description.
Organizational Restrictions
To ensure data security and process integrity, standard roles use restrictions to define the scope of what a user can see or do:
- Read/Write Access: Controls whether a user can only view data (Read) or also modify it (Write).
- Organizational Scope: Access can be restricted by specific organizational levels, such as Company Code, Plant, or Controlling Area
The key distinctions are summarized in this table:
| Aspect | Administrator Role | Standard Business Role |
| Primary Purpose | IAM administration — manage users, roles, and authorizations | Operational business tasks aligned to a specific job function |
| Key Apps Granted | Maintain Business Roles, Maintain Business Users, Manage Workforce | Function-specific Fiori apps (e.g., Manage Incidents) |
| Business Catalogs | IAM-specific catalogs (SAP_CORE_BC_IAM_RM, SAP_CORE_BC_IAM_UM) | Function-specific catalogs (e.g., EHS) |
| Restrictions | Controls which business roles an admin can manage (via Business Role Groups) | Controls which organizational data (company code, plant, etc.) the user can read or write |
Distinguishing the Administrator from Other Roles
To maintain a secure system, it is important to understand how the Administrator role differs from other specialized roles:
- Standard Business User vs. Administrator: Business users (like the Dispatcher or Controller) focus on business data. The Administrator manages the technical infrastructure and configuration that supports that data.
- Key User vs. Administrator: The Key User is responsible for functional "customizing" (shaping how the business process works). The Administrator focuses on the technical system layer, such as user maintenance and system performance.
- Configuration Expert: Business Process Configuration (BR_BPC_EXPERT) is the prerequisite role for performing preliminary configuration for the system setup before operational users (such as incident reporters and incident managers) can begin using the system.
- Read-Only Role vs. Administrator: (SIE_GLX_IVC_READONLY_<BUKRS>) A Read-Only role is strictly for displaying data without the ability to make changes. The Administrator has full write and configuration rights to maintain the system environment.
Key-user Extensibility in SAP S/4HANA Public Cloud
With the role of an Extensibility Specialist (BR_EXTENSIBILITY_SPEC) assigned to a key-user, he or she can adapt the user interface of SAP Fiori apps directly in the SAP Fiori launchpad.
For example, key users can use the Adapt UI feature in the Workplace Safety Overview app to modify the Potential Serious Injury and Fatality Rate (PSIF) threshold.
Summary
- SAP EHS Incident Management utilizes a role-based authorization model to enforce the principle of least privilege.
- Business roles like the Industrial Hygienist focus on operational tasks, while technical roles maintain the system foundation.
- The Administrator role (SAP_BR_ADMINISTRATOR) is specifically designed for Identity and Access Management (IAM) and user maintenance and should be used as a template for custom roles.
- Standard business roles use organizational restrictions, such as plant or company code, to control data access and security.
- Key users assigned the Extensibility Specialist role can use "Adapt UI" functionality in the SAP Fiori launchpad to modify app interfaces, such as adjusting threshold values in the Workplace Safety Overview app.