Getting Started with Administration

SAP SuccessFactors offers different levels of administration to manage the amount of control each user has in the system. There are three basic levels of system administration:

• Super Administrator

  The Super Administrator is created initially in Provisioning. This administrator grants permission to others so that they can become a Super Administrator or Security Administrator.

• Security Administrator

  The Security Administrator is responsible for managing all security through roles and permission groups in the Role-Based Permission framework.

• Administrator

  An administrator is a user who has access to the Admin Center page in SAP SuccessFactors, granted by the Security Admin, that granted administrative permissions to this user.

When the Super Administrator logs in for the first time, only one link on theAdmin Center page is visible. This is Manage Super Admin Access. Choose this tool to assign an employee the permission to function as a Security Administrator.

The page displays a list of Super Administrators in two categories based on their permission levels:

• Super admins: a broad-scope administrative role with permission to access the tool Manage Super Admin Access, Manage RBP Admin Access, User Search, and Manage Provisioning Access
• Admin overseers: a high-privilege oversight role with permission to access the tool Manage Super Admin Access, Manage RBP Admin Access, and User Search.

You can add, modify, or remove super admin access as needed in this tool. The system prevents deleting yourself as a super admin. We recommend revoking super admin permissions when an employee terminates their employment or leaves the company. You can access audit logs for super admin and admin overseer data through the Viewer for SAP Audit Log service and Audit Log Search API.

Use the Manage RBP Admin Access tool to:

• Add, update, and remove RBP admins.
• Grant View Role, View Group, Edit Role, Edit Group, and Notify this user of RBP Changes access to the RBP admins.
• Configure notification settings for RBP admins using the RBP Notification Settings capability.

To access the tools Manage Permission Groups, Manage Permission Roles, and RBP Troubleshooting, users must at least be granted the permissions View Group and View Role from the tool Manage RBP Admin Access. If they also should be able to change Permission Groups and Permission Roles, users must be granted the permissions Edit Group and Edit Role from the feature Manage RBP Admin Access.

For permission role changes that impact many access users, you can enable double-confirmation popups and e-mail notifications for administrators. You can also set a threshold for triggering these notifications. For example, you can set the threshold to 80%, and notifications will be triggered if 80% or more employees are impacted by a permission role change.

To access the features Manage Permission Groups, Manage Permission Roles, andRBP Troubleshooting, users must at least be granted the permissions View Group and View Role from the tool Manage RBP Admin and Super Admin Access available from theAction Search. If they also should be able to changePermission Groups and Permission Roles, users must be granted the permissions Edit Group and Edit Role from the feature Manage RBP Admin and Super Admin Access available from the Action Search.

You can also use the Manage RBP Admin and Super Admin Access admin tool to manage both Role-Based Permissions (RBP) admins and super admins directly in the system. You can add, modify, or remove super admin access as needed.

When selecting Add User and granting the permission, the new user will be in the list with the permissions "Edit Group" and "Edit Role" box checked.

If you select the check box for Allow Access to This Page, then the users will be able to add or remove other users from the group with access to the feature. As a security precaution, the recommendation is to have at least two users with access to this page.

The Super admin is not able to uncheck their own access to the page (since it will forbid them to view this page, thus not able to grant the access back). The checkbox needs to be always checked and not able to change (marked in gray).

For permission role changes that impact a large number of access users, you can enable double-confirmation popups and e-mail notifications for administrators. You can also set a threshold for triggering these notifications. For example, you can set the threshold to 80%, and notifications will be triggered if 80% or more employees are impacted by a permission role change.

You can manage RBP administrator access under Admin Center Manage RBP Admin and Super Admin Access. Existing RBP administrators have both the Role-Based Permission Admin (View) and the Role-Based Permission Admin (Edit) access by default. You can review and update their access accordingly.

Some RBP administrators only need view access but not edit access.