SuccessFactors: Employee Central – Role based permissions
In any Employee Central Implementation project, it is must to meet the minimum requirement of designing permissions for following Roles:
- Employee self-service
- Manager self-service
- HR Business Partner
In this blog I am going to demonstrate step by step process for setting up RBP for above mentioned 3 Roles
Here I will take a different approach about RBP design framework, helps consultants in designing the permissions in any EC project.
Permission Group | Group of Users with similar employment characteristics |
Permission Role | A list of permissions / transactions |
Granted users | Group of users for whom the permission role is to be granted |
Target users | Group of employees that the permission role is to be executed by Granted users |
Remember above four elements throughout the RBP configuration, there you go..
Now let’s look at how to configure the 3 roles and related permissions in 3 steps
Employee self-service | Enable employees to perform self-service tasks for example – View People profile, edit address details and apply for Time-off etc. |
Manager self-service | Allow managers to manage tasks related to his team for example – View org chart, approve workflow requests, run team reports etc. |
HR Business Partner | Allows HRBPs to manage employee related transactions in their area of responsibility for example – perform new hires, maintain data, edit company structure and create and edit Foundation objects etc. |
Scenario 1 – RBP Configuration for ‘Employee self service’
Step1: Define Permission Group
Goto Admn Center–> Manage Security–>Manage Permission Groups
Click on “Create New” button and create the Group
Step2: Define Permission Role
Goto Admn Center–> Manage Security–> Manage Permission Roles
Click on Permission Settings Button
Select the relevant sections and fields. Click on Done
For ESS role, typically following permission settings are required to be enabled under “User Permissions”
- Employee Data
- Employee Central Effective Dated Entities
- Employee Views
- Miscellaneous Permissions for any Custom MDF Objects
Step3: Assign Permission Role to Permission Group
On the Permission Role Details screen, add this role to permission group
Click on Done
Save your changes
Scenario 2 – RBP Configuration for ‘Manager Self-service’
Step1: Define Permission Role
Goto Admn Center–> Manage Security–> Manage Permission Roles
Click on “Create New” button and create a Permission Role
Click on Permissions button to select required permissions
For MSS role, following permissions are typically required under User Permissions with permission level is View only
- Employee Data
- Employee Central Effective Dated Entities
- Employee Views
- Miscellaneous Permissions for any Custom MDF Object
Step2: Assign Permission Role to Permission Group
On the Permission Role Details screen, add this role to permission group
Click on Done
Save your changes.
Important to Note – For MSS permissions I did not create a new Permission group, instead I used existing group i.e Employees – Germany.
Scenario 3 – RBP Configuration for ‘HR Business Partner’
Step1: Define a Permission Group
Goto Admn Center–> Manage Security–> Manage Permission Groups
Click on “Create New” button and create the Group
Step2: Define Permission Role
Goto Admn Center–> Manage Security–> Manage Permission Roles
Click on “Create New” button and create a Permission Role
Click on Permission Settings Button
Select the relevant sections and fields. Click on Done
For HRBP role, typically following permission settings are required to be enabled
User Permissions
- Employee Data
- Employee Central Effective Dated Entities
- Employee Views
- Reports Permission
- Miscellaneous Permissions
Administrator Permissions
- Manage User
- Mange Time
- Manage Time Off
- Manage Mass changes
- Manage Foundation Object types
- Meta Data Framework
- MDF Foundation Objects
- Manage Position
- Company Structure Overview
- Manage Workflows
Step3: Assign Permission Role to Permission Group
On the Permission Role Details screen, add this role to permission group
Click on Done
Save your changes.
!!
This is how we create EC Roles and permissions.
Enjoy Reading:-)
Really well Documented Gita! Cleared concepts on Role Based Permissions.
Thanks Much!
Good blog. Readers might also like this blog:
https://blogs.sap.com/2014/02/27/successfactors-all-you-need-to-know-about-authorizations-and-security/
Hello Team,
How we can activate the inactive roles in SF please?
I was searching for this kind of example ... Now i total understand RBP. ESS/MSS/HR specific way RBP.
very nice
Thanks for these tips.
Short question: how are the "manager's direct reports" derived?
Based on person-to-person relationship in EP or Job Info or via the Position Hierarchy?
Thanks and best regards,
Philipp