Managing Workforce Analytics Permissions with SuccessFactors Role Based Permission Roles

Role based security allows administrative users to determine what data individual users can access when they are logged into the website. WFA utilizers users and roles to accomplish this. Using this model, roles ranging from the simple to the complex may be defined allowing a modified view of the portal to be constructed to suit specific groups of users.

When granting access to users, a company might want to restrict access to different information for a number of reasons:

• A company will naturally not want all users to be able to view all of the information held on the portal. A specific group of users may need to be restricted to a defined portion of corporate information whereas another group of users may be given much wider access.
• Selected groups of users may not need to have access to the full information the site can provide to perform their job function. The additional information presented may only serve to complicate and confuse the search for relevant information
• An executive user group may wish only to view higher level summary information and may not need to navigate to the lower levels of detailed data.

Workforce Analytics (WFA) permissions, including measure, dimension, and tree security permissions can be created and maintained with SAP SuccessFactors RBP Roles or WFA Roles.

The biggest difference in configuring RBP Roles versus WFA roles is that a user can be a member of multiple RBP roles, but only a single WFA Role. This has significant impact on planning role assignments.

When using WFA roles, a user is assigned to a single role, and the role must contain all the permission the user requires. You must create a separate role for each collection of unique permissions and individual may need.

When using RBP roles, a user can be assigned to multiple roles. The user receives all the permissions from all the roles they are a member of. This can lead to designing RBP roles for different permission groups, then assigning a single user to multiple RBP roles. See a later in the course section for more detail.

For new implementations of Workforce Analytics, SuccessFactors always recommends utilizing Role Based Permission Model

Using RBP roles for permissions is opt-in and requires customers to perform pre-planning steps before opting in. Using RBP roles provides a simplified administration experience for role administrators that does not require them to visit multiple tools to manage permissions.

Most components of WFA roles fit into the SAP SuccessFactors RBP Role Framework, however, some components behave differently. SAP SuccessFactors recommends that current customers carefully consider all variances and implications before implementation, which is why the functionality is designed in a way that allows customers to test various configurations comprehensively before adopting them in productive environments. New WFA instances do not require the same planning for migration of existing permissions.

The WFA permissions can be used to customize virtually all aspects of a user’s portal experience. This includes what options appear on the Admin menu, access to tools, which reports users have access to, which measures they can see, which analysis options they can use and which data they are permitted to access.

Due to the nature of the RBP role, users can be granted multiple SuccessFactors RBP roles and WFA will work with the union or super-set of all the user’s permissions across these roles. Therefore, the most effective way to assign these permissions using one or more roles needs to be planned. One method may be that the most commonly assigned permissions can be grouped onto one role granted to most users. Then multiple specific use roles can be created for each of the required tree security profiles and these granted to permission groups as appropriate.

Example 1:

The most efficient way to grant User Australian Sales Manager, the appropriate Permissions and Tree Security may be to grant her 3 specific-purpose roles. These permissions can be chunked and setup over multiple roles to be granted to users or Permission Groups as appropriate.

Example 2:

The most efficient way to grant User HR Analyst the appropriate Permissions and Tree Security may be to grant her 3 specific-purpose roles.

The high-level configuration steps for configuring WFA permissions with SAP SuccessFactors role-based permissions are the following:

1. For the appropriate role(s) enable and set the Functional and Option permissions.
2. For the appropriate role(s) enable and set the Analysis Dimension and Measure security.
3. For the appropriate role(s) enable and set the Structural Dimension (tree) security.
4. Enable the enforcement of WFA permissions with SuccessFactors RBP.

To configure the functional and option permissions, perform the following steps:

1. In the Admin Center navigate to Manage Permission Roles
2. Create a new role or select the appropriate existing role.
3. Configure the permissions.

4. 1. Select the Next button.

   2. Select the Permission Group: Analytics Permissions.
   3. Enable the permission checkboxes.
   4. Select the appropriate entries for each permission group.

   5. Select the Next button.

   6. Select Save.

5. If necessary, adjust the Grant this role to entries to include the appropriate target group.
6. Select Save Changes

The following table summarizes the Functional/Action Permissions available for WFA. It includes:

• Functional Permission (RBP): name as it appears in Role Based Permission interface.
• Action (WFA): name as it appears in the WFA Role Permission tool.
• Description: brief Description of the permission.
• Available on menu/page: high-level location/item the permission effects.
• Option: more detail on the item that is affected, in conjunction with Available on menu/page column.

Changing the Options permissions will limit what features of the portal users in this role can access.

• Reporting allows access to Report Menu (obsolete).
• Metrics allows access to Metric Pages.
• Questions allows access to Question Pages (obsolete).
• Resources allows access to the Help & Resources link.

Dimensions grant the user the ability to view these dimensions as Analysis Options or Filters. Turning dimension access off does not restrict access to the data, but rather restrict the ability to analyze the data by these dimensions.

You can also limit the measures that individual users are allowed to see. Changing this setting controls which measures appear in the Metrics menu for this role. Note that the measures displayed here will vary from customer to customer.

To configure the dimension and measure security, perform the following steps:

1. In the Admin Center choose Set User Permissions → Manage Permission Roles.

2. Create a new role or select the appropriate existing role.

3. Choose Edit.

4. Configure the security:

   1. Select the Next button.

   2. Select the Permission Group: Analytics Permissions.

   3. Enable the permission checkboxes.

   4. Choose the appropriate entries for each permission group.

   5. Select the Next button.

   6. Select Save.

5. If necessary, adjust the Assignments to include the appropriate target group.

Once all permissions are configured, enable the enforcement using RBP.

Additional detail on permissions is supplied in the following sections.

1. In Admin Center choose navigate to Manage Workforce Analytics.

2. Enable the following:

   1. Functional and Option Permissions

   2. Measure and Dimension Permissions

3. Select Save.

When you enable RBP integration with WFA permissions, there can be a delay between a change in RBP taking effect. Normally a user can expect to wait 30 minutes for the change in permissions to take effect in the Workforce Analytics application. The use of the Refresh Analytics Permissions tool will avoid this delay.

You can access the tool via WFA Admin → Refresh Analytics Permissions.

The Refresh User button will refresh the Workforce Analytics permissions for the logged in user only and log them out of the application.

The Refresh Org button will be available only to users who have been granted the Role Maintenance functional permission and this will refresh the Workforce Analytics permissions for all users in the organization (effectively a Purge Cache on the organization).