Role-Based Permissions (RBP) is a security model that allows you to restrict and grant access to your SAP SuccessFactors HCM Suite. RBP control access to the applications and data that employees can see and edit.
Watch the video to get an overview of Role-based Permissions.
RBP is a dynamic method of assigning permissions. Role-Based Permission is comprised of several elements.
- Permission Roles: Contain a set of permissions and role assignments
- Permissions: A set of transactions or tasks that employees perform in your organization (e.g., edit job title, create reports, reset passwords)
- Role Assignment: A relationship containing the granted and target population assigned to a permission role
- Granted Population Group: Users who are granted the permissions
- Target Population Group: Users whose data can be accessed or managed by the granted group
You can group employees with similar tasks to perform and create a Granted Population Group. This group typically consists of employees who share certain attributes, such as Job Code, and require access to similar tasks in the system.
For some permissions, you need to define a Target Population. A Target Population is a group of users that need tasks to be performed on their behalf.
For example, you could group all US-based HR Talent Managers as the granted population who will manage the employment records of US-based employees – the target population.
Role-Based Permissions are designed so that users will match more than one role. As a best practice, we recommend configuring roles by starting with the most generic role, as in All Employees Role, and casting the net as wide as possible to include all of the permissions given to everyone.
Permission Roles
A Permission Role is a collection of specific permissions that determine what actions a person can perform. For example, the HR-Talent Manager Role consists of the following permissions:
- Edit Compensation
- Edit Job Title
- Hire Employee
- Reset Passwords
- Terminate Employee
This set of permissions can be assigned to different groups using Role Assignment.
Administrators can define the permission roles by navigating to Manage Permission Roles using the Action Search.
In Manage Permission Roles, you can review, copy, and edit existing roles or create new roles. You can review and edit the list of permissions and the assignment for each role.
Note
For permission role changes that impact a large number of access users, you can enable double-confirmation popups and e-mail notifications for RBP administrators. Go to Manage Role-Based Permission Access to set the notification settings.
Standard Role Types
SAP SuccessFactors delivers standard role types. These are default roles that are similar across all organizations.
- Employee – all employees that work for an organization
- Manager – an employee that has employees directly reporting to them
- Matrix Manager – dotted-line manager; a larger manager group that spans similar groups, like managers within the same department.
- HR Manager – a human resources representative with direct reports
- Custom Manager – additional special manager relationship
- Second Manager – alternate manager used for salary planning
These standard role types can be used when assigning permission roles. For example, when assigning the Manager Self-Service Role, you won't need to group all the managers to create a Manager Permission Group; the standard role type Manager is used instead.
Permission Level for Different Administrator Roles
Not all administrator roles are created equal. Even admins have different levels of permissions.
The lowest administrator role level is a Local Admin. A local admin is an optional level that is set up using RBP. The local admin typically has access to administrative functionality for a specific group of users. For example, you can set up a USA administrator who resets passwords for users in the USA.
The next level is an Admin User. An admin user is anyone with access to any administrator tool. For example, you can set up an admin user who just launches forms.
The third level is a Security Admin. A security admin manages permission roles and groups in the RBP framework. A security admin has access to Manage Permission Roles and Manage Permission Groups.
The fourth and highest level is a Super Admin. The super admin is set up in Provisioning or added to the system by another super admin. A super admin creates security admins in the Manage Role-Based Permission Access page. Super admins are typically created by consultants at the beginning of implementation so they can log in to the front-end and starts the configuration.
To learn more about Role Based Permissions, visit the Explore SAP SuccessFactors Platform course.