Managing Group to Child Group Mappings

• Standard system groups grant users access to specific functionality.
• Each system group description provides a list of actions that members of the group are able to perform.
• The specific permissions associated with each group cannot be modified.

Example: Users who belong to the Reporting Manager group have permissions to access and manage reporting related functionality.

• Can be created to organize users by various logical divisions.
• Custom groups themselves have no direct permissions.
• Can be added as a child of a system group, allowing custom groups to inherit system group permissions.

Example: A commodity approval group can be created to organize users who need to approve transactions containing specific commodity codes.

Groups can be added to other groups, taking on a parent to child relationship

• Child groups will inherit permissions from one or many parent groups
  • A child of a child will also inherit permissions from the parent groups
• Users assigned to groups indirectly (via subgroups) also impact approval routing and notifications

In the default configuration, some SAP Ariba system groups are already assigned out-of-the-box child groups, which inherit all the privileges of the parent group. For example:

• Members of the Purchasing User group can create requisitions.
• The Legal Entity User group is a child group of the Purchasing User group.
• Members of the Legal Entity User group can also create requisitions because the Legal Entity User group inherits all the privileges of the Purchasing User group.

The complete list of SAP Ariba Procurement solutions group descriptions table for SAP Ariba Procurement and Invoicing Solutions can be found in the product documentation at https://Help.SAP.com

The table below describes some of the group-to-child group mappings in the default configuration.

System groups provide functional area, and access level permissions.

Each access level grants a unique set of permissions, which does not necessarily grant all permissions of "lesser" access levels.

For example, an Invoice Manager may not automatically be granted access to purchasing.

You use the Import Group to Child Group Mapping data import task to define child groups for your custom groups.

The Import Group to Child Group Mapping data import task reads data from the following CSV files:

In these examples, Custom Group B inherits permissions from CustGroup_A and the Purchasing User group.

In the user interface, the Defined By field identifies:

for SAP Ariba standard out-of-the-box system groups

for custom groups created directly in the UI

for custom groups created by data import

When assigning child groups, keep in mind the following restrictions:

• You cannot assign a group to itself, either directly or indirectly.
• If Group B is a child group of Group A, you cannot assign Group A as a child group of Group B.

SAP Ariba recommends you do not assign a system group as a child group to a system group because you might inadvertently remove the system group and child group relationships. If you need to assign a system group as a child to a system group, contact SAP Ariba Customer Support.