Maintaining Workforce Analytics Users

Before users can access the Workforce Analytics portal they must first have user accounts. Administrators have the ability to edit or delete these accounts at any time. Each user account has a variety of fields that are required, such as username, full name, and role.

Users access WFA after logging into SAP SuccessFactors HCM by the drop-down menu. The integration provides the following benefits:

• Single Sign On (SSO) access for production users to SAP SuccessFactors modules including WFA.

• Automated management of user accounts and role-based security. This significantly reduces the administration burden of managing user accounts and security.

• Nightly sync job to capture changes to personal data.

SAP SuccessFactors HCM user accounts are linked to the WFA user accounts. Authentication to WFA is provided via Single Sign On (SSO), so the user does not have to know or maintain their WFA account. In this case, the WFA users can be created via bulk upload or automatically via WFA Automated Management.

After the SAP SuccessFactors HCM user and WFA user accounts have been created, administrators must make sure that the user has the necessary permissions in SAP SuccessFactors to access WFA. To do so, you must grant the user account the Analytics Permission: Show Analytics.

The User Maintenance functionality supports the introduction of new users and the specification of the WFA roles to which they are assigned. Through this feature you can assign certain users to predefined WFA roles.

Only users who have the Edit Users action/Manage Users functional permission active for the user role to which they are assigned, will be able to see the User Maintenance option from the Administration menu.

To access the User Maintenance page, navigate to Admin and select User Maintenance.

The User Maintenance page lists the current users.

When editing or deleting user accounts, the account must first be selected from the accounts list at the bottom of the page. This list can run over many pages for organizations with large user populations. You can search the user account list by name or partial name. You may also use Wildcard Search to find a particular name.

A nightly user sync process runs to ensure that the personal data fields on the Workforce Analytics User are kept up to date with the SAP SuccessFactors HCM user account. The personal data fields First Name, Last Name, Email address, Language, Accessibility and Active Status are kept up-to-date on the synced user.

The Sync button in User Maintenance allows for a manual sync of the user details.

If a Report Distributor bundle is distributed via email, the email address will be synced from SAP SuccessFactors prior to sending the bundle. Users that have been deleted from SAP SuccessFactors will be set as "inactive" in WFA.

You have the ability to update user accounts, to alter their role, or to delete a user account. To edit an existing user, perform the following steps:

To edit an existing user, perform the following steps:

1. Select the name of the user account from the User Maintenance page. User accounts can be selected from the list by using the keypad on the left or by entering the name in the Wildcard Search field.

2. Select Edit User to open the Edit User Details form.

3. Change any details on the form including the user’s full name, email address, which role is assigned to the user, and the user’s active status. Note that a user can only belong to one WFA role.

4. Select Save. A confirmation message will appear in red to verify the edit.

To delete an existing user, perform the following steps:

1. Select the name of the user account from the User Maintenance page.

2. Select Delete User.

3. A confirmation dialog box will appear asking if you are sure you want to delete this user account. To continue with the deletion, select OK.

To support read access logging, WFA administrators might need to mark WFA fields as storing sensitive data. WFA will log accessing sensitive data via the Drill to Detail functionality. Metrics are aggregated data which is not considered personal sensitive data.

Whenever a user views the data contained in a sensitive field, this will be indicated in a read audit report.

As a general best practice, SAP SuccessFactors strongly recommend that you do not expose any sensitive fields in a drill-to-details list.

To mark WFA fields as sensitive, perform the following steps:

1. On the Workforce Planning and Analytics Administration page, choose Cube Read Logging Configuration.

2. Mark all the drill-to-details fields that should be considered sensitive.

3. Choose Save.

You can mark fields as sensitive instances that use WFA on SAP HANA in the WFA on HANA Admin tool. Review the information in the Administering WFA on SAP HANA in this guide for usage of the tool.

For complete details on Read Access Logging, review the Data Privacy and Protection information on the SAP Help Portal.

Tree Security can be configured on a user account. Any configuration of tree security at the user level overrides the tree security from the role associated with the user. User accounts created by the automated management process have their tree security assigned at the user level.

To modify the tree security, perform the following steps:

1. Click Tree Security to open the Security Tree Editor form.

2. Change the tree security to your requirements.

3. Select Return.

Often customers of the SAP SuccessFactors site need to create a large number of user accounts. To streamline this process it is possible to generate many user accounts at the same time. Through a spreadsheet template provided by SAP SuccessFactors it is possible to upload a number of new users and assign them to various existing roles.

Often customers of the SAP SuccessFactors site need to create a large number of user accounts. To streamline this process it is possible to generate many user accounts at the same time. Through a spreadsheet template provided by SAP SuccessFactors it is possible to upload a number of new users and assign them to various existing roles.

SAP SuccessFactors provides Excel templates to facilitate the creation of multiple users at once. Templates include the following fields:

• User Identifier: The identifier of the user. All user identifiers must be unique.

• Email Address: The user's email address. The User Identifier and the Email Address may be the same.

• User Name: The name of the user

• Site Identifier: This will be the organizations name or acronym. This field is primarily useful for members with multiple SAP SuccessFactors sites. In these instances this field can be used to restrict users to a particular site. If member users only maintain one website with SAP SuccessFactors this field may be left blank.

• Role Identifier: The WFA role identifier that the user will be assigned to. This field is case sensitive.

• User active: If the new users are to be immediately active upon bulk uploading enter ‘TRUE’ in the sixth column. If user accounts are to be created but administrators do not wish them to be active at the time of generation type ‘FALSE’ in this column.

• Returned Message/Password: Contains the processing information. If successful, import a password or message will appear here. If there is a problem with the import, an error message will appear here. Assigning a password is no longer applicable as WFA uses SSO.

• SFCompany ID: This is the SAP SuccessFactors HCM instance ID the user links back to. Example: ACESB190. SFSysUserId:This is the users internal User Sys ID for the SAP SuccessFactors HCM user. Example: cgrant1.

• SFSysUserId: This is the users internal User Sys ID for the SAP SuccessFactors HCM user. Example: cgrant1.

Often the templates can be populated by exporting the data from existing account lists.

After the template file has been configured, the next step is to perform the bulk import. During the import process, two options need to be considered.

In the How should the application deal with existing users field, selections can be made between the following options:

• Maintain the user record unchanged. This will ignore any changes made within the bulk upload template spreadsheet to existing user accounts. That is, if a user account already exists and details of that account are different to that entered within the upload spreadsheet then the existing details will remain the same.

• Overwrite user record but maintaining the user’s password. This will update existing accounts with the information provided in the bulk upload template spreadsheet.

In the How should the application deal with generated passwords field, selections can be made between the following options:

• Add the users’ passwords to the returned Excel spreadsheet. This will generate passwords and enter them into the final column of an Excel spreadsheet that is created when the program is finished.

• Email the password to users. This will send an automatic email to the new users (using the specified email account in the Bulk Upload Template spreadsheet) with the generated password.

If the ‘Email the password to the users’ option is selected the email template can be customized. In the Email Subject and Email Message fields enter the desired email message, which will appear to all created user accounts. Note that it is essential to leave the "[%USERNAME%]" and "[%PASSWORD%]" text in the message as the email generator will update this text with the unique username and password for each account.

To perform a bulk import, perform the following steps:

1. Navigate to the Bulk User Load tool in Admin.
2. Ensure the correct Org Id is selected.
3. Browse to your configured template file.
4. Select the appropriate option for existing users.
5. Select the appropriate password distribution option.
6. If you selected email, adjust the email template as necessary.
7. Select Upload Users.

After uploading the users, you should test your results. You can verify the creation of the accounts in User Management. You can also examine the output file for users that the import might have failed. Finally you should log in with a few accounts to make sure they work.