How to automatically grant permissions to a substitute employee during the replacement period
Very often we hear the requirement ‘How to automatically grant the substitute permissions during a replacement period in SuccessFactors’? We know that currently there is no standard solution for this, but there are alternatives and that is what this blog is about.
In this blog, you will find effective ways to accommodate this requirement using standard SuccessFactors functionalities.
A customer tells us that when, for example, a manager is on leave, there is usually a need to assign a replacement to carry out his/her activities, not only approve workflows (as this functionality does exist through ‘Auto delegation’) but rather to carry out promotions, transfers, etc, during a specific period.
In SAP On-Premise, the customers use the Substitution functionality to record when this manager is on leave and who will replace her/him. This blog will provide two possibilities to assign the necessary permissions to substitutes considering two scenarios: 1. Create the substitution process in SuccessFactors and control it all in the platform, or 2. Maintain the current ERP configuration and create integration between ERP and SuccessFactors.
- Recreate the Substitutions form in SuccessFactors
The proposal here is for customers that require to maintain/control everything in Successfactors once Employee Central becomes the Primary data source. From this perspective, a custom object needs to be created to accommodate customer requirements. Is a must to create a ‘From parent’ object because each employee can substitute more than once during her/his employment time. Also, a UI will be required to organize the fields/sections as per the customer requirement and to be added to the ‘Configure People Profile’ later. For all details about how to create ‘From Parent’ objects and UIs, please refer to the Employee Central Implementation Guides.
Below there are two Custom MDF Object samples of how this Substitution portlet can look like (The fields, rules, etc will depend on your customer’s requirements, so please see this image as a sample only).
Example 1: More complex requirement with several fields
Example 2: Simple requirement, only a few fields to allow us to control the permissions assignment/removal
After we have the objects and UI created, we need to go to the next steps that will be how to capture this data and use it to automatically assign the permissions to the substitute.
Here we are proposing the use of the standard functionality Proxy.
Currently, there is an option to import massively all proxy assignments/deletions and this can be achieved under the ‘Proxy Import’ transaction.
From this page, you can download the template and import the filled file.
The problematic point here is data customers do not want to perform this manual task every time that there is a new proxy (substitution) assignment/deletion and because of this we are proposing to use the same option available but under-provisioning ‘Manage Schedule Jobs’*.
Before we check the provisioning job settings, let’s talk about how to extract the data in this ‘Proxy Import’ template format. For this, we will use the Integration Center, described in the steps below.
STEP 1: Create a new ‘Scheduled Simple File Output Integration, as per the image below.
STEP 2: Search for the ‘child’ object that you create and select all the fields that you may need to do the mapping.
STEP 3: In the ‘Options’ tab, give your Integration template a name, description, and define the output file type equal to ‘CSV’ and the Header type equal to ‘Simple Header’. Do not forget to save your template.
STEP 4: In the ‘Configure Fields’ tab, you will see a template with the fields that you selected before, but now we need to create it in the same format as the ‘Proxy Import’ template. An easy way to do it is to click in the ‘+ Add’ icon and select ‘Destination from Sample CSV File’.
Select the downloaded template from the ‘Proxy Import’ transaction and click ‘Upload’.
The result will be the imported template showing as below, without any value for now:
STEP 5: Switching to the ‘Mapping View’, you will need to do the mapping between your template and your Custom MDF. To do this, just drag and drop the fields from the left able to the central table and the results will show on the right side.
Here I am mapping only the needed fields that are:
USERID: The user ID of the user who you are proxying in ON BEHALF OF;
PROXYID: The user ID of the user who will PROXY AS the column A’s user;
STEP 6: The other 2 important fields in this blog scenario that needs to be mapped are: ‘All’ and ‘Remove All’. These fields will grant full proxy permissions or remove it completely. For these two fields, we will use the calculated option to define the permissions. In the ‘Detail View’ tab, select each field at once and click in the ‘Set as Calculated Field’ icon.
Here we are using the ‘Active’ field from the Custom MDF, so if it is equal to Yes (1) it will populate ‘YES’ in the ‘All’ column, else it will be empty.
This following calculated field is the mapping for the ‘Remove All’ column, so if the ‘Active’ field is equal to No (0) it will populate ‘YES’ in the ‘Remove All’ column, else it will be empty.
STEP 7: Go to the ‘Detail View’ tab to see the results of your columns (in the example below we have values because it was previous created for some employees in the People Profile).
In case the customer requirements are to assign only specific permissions as performance, recruiting, etc, you will need to adjust the calculated fields to consider it depending on each case (maybe additional fields will be required in your custom object to record it and be used as criteria in the Integration Center).
STEP 8: Now that the template is created, and you got the expected result you just need to jump to the ‘Destination Settings tab and define the SFTP information.
STEP 9: Finally, the last step is to schedule the job, under the ‘Scheduling’ tab, based on your customer requirements.
Below is a sample of how this job export result will look like:
For now, we have our Custom MDF created, the Integration export job set up and we just need to create the Provisioning ‘Proxy Import’ job to complete our configuration. Below are the steps to do it.
STEP 1: In the Manage Scheduled Jobs, you will need to click in ‘Create New Job’:
STEP 2: Define the Job Name, Owner, and select the ‘Proxy Import’ in the Job Type. Also, you will need to fill in the SFTP credentials, the file path, and the name.
Setting up the Job Occurrence will depend on the customer requirement, but the available options are daily, weekly, Monthly, and Yearly.
After creating the job, you can submit based on the Integration Center job scheduling.
For more details about how to enable the Proxy Import feature, please review this KBA.
- Substitutions process remains in ERP with integration to SuccessFactors
If the customer decided to maintain the Substitution process in ERP it will not require any Custom MDF creation or Integration Center template, but it will be necessary an ABAP development from the customer side, to build a report that will export the substitution data in a CSV file and place it in the SFTP folder defined in the provisioning job to be consumed by SuccessFactors.
The details about this development will not be covered in this blog because we all know that this development may vary from one customer to another since the customer can have a custom infotype or any changes to the standard, for example.
2.1 Alternative Option
As an alternative, you can opt to use CPI to call out this data in ERP but it will require an integration effort.
How to set up this CPI integration could be a topic for another blog as all the technical details would be required to be shared/explained.
This blog post described how we can accommodate the ‘granting permissions to substitute employees’ process in SuccessFactors using the standard functionalities.
With the proposed solution we bring to our customer an alternative for a process that is currently not designed in the standard platform.
Looking forward to your comments and questions.
Thank you very much for sharing this solution. This is really helpful as I heard a couple of times this requirement.
Thank you very much, Soraia!
Thanks for sharing this article. It’s really useful information.
Thank you very much, Ashish! I am glad to hear that this was useful for you.
Cool ! Thanks for this - very useful cause I hear this as well very often from customers.
Volker EC Time Management
Nice to hear that you also have this kind of requirement, looks it is becoming very common.
Nice custom solution, but if your customer doesn't want to use proxy for this requirement we could also use the Standard Delegation relationships under Job Relationships section, right?
Thanks for the great solution.
Thank you for asking. Are you referring to the auto delegate option? If yes, this is only related to workflows. If you are not talking about this, can you please clarify what do you mean?
Thank you again.
No not the Auto Delegation, I’m talking about the Job Relationship section in Employee Central, there are 2 standard relationships (Delegate 1 and Delegate 2) that were introduced about 1 year ago, and we can use these relationships in RBP to give permissions to Delegates.
Thank you for replying Eduardo.
This option can be used but you need to create a logic to assign the ‘delegate’ to all employees that hi/she will need to act on. Basically I am saying that as the common requirement is for an employee to replace a manager and act on all direct reports during the leave, you need first to identify all direct reports and assign the delegate (customers will ask to have it in an automatically way). Did you already design this automation?
in any case, thank you for sharing more ideas to the readers, it is always valid.
Actually the Delegate relationship is only needed to the Manager's record you are replacing, from there the system can use the manager relationship and grant the Delegate access to the Direct and Indirect reports as needed.
I've built this solution to one of my customers using a similar solution you have described here, the main difference is the last step that instead of updating the proxy assignments I update the Job Relationship section of the manager being replaced.
How did you manage the level of permissions? The replacement not always has the full manager permissions, sometimes only part of it (time management for example). In the sample that I wrote is reflecting proxy all but we do have logic behind it replacement permission level. If you could share this part would be really appreciate.
Sure thing, you can manage this all in RBP, for this customer I created a Delegate permission role with only the permissions allowed/required.
Then in the Granted/Target population assignments you select the Relationship Type (Granted) and the Delegator's Direct and/or Indirect reports (in the Target).
With this as soon as you assign someone as a Delegate of a Manager, this employee will be automatically assigned to the Delegate Permission role in RBP, with only the permissions you defined.
It works pretty well 🙂
Oh ok. Thank you, Eduardo.
So you don't have the requirement of assigning different permissions each time, let's say that I will replace my manager during 1 month and at this stage I need to cover her/him only for the time management stuff. In another situation I will cover her/him during 6 months but having full duties. What I am trying to say is that not always the same permissions that I will have every time I replace someone. Also I can replace different employees at a time, with different permissions. Did you have this requirement in your case?
Thank you again.
For this customer they had 3 types of Delegates: Time Management, Contractor Management and Full Duties. So we used 3 different relationship types to support their requirements (Delegate A, Delegate B and Custom Manager).
The main point for this customer is that they did not want to use Proxy because of their Audit / SOX requirements.
No not the Auto Delegation, I'm talking about the Job Relationship section in Employee Central, there are 2 standard relationships (Delegate 1 and Delegate 2) that were introduced about 1 year ago, and we can use these relationships in RBP to give permissions to Delegates.
UPDATE FROM LAST RELEASE H2 2020:
Proxy assignment time based is now supported as per standard.
Demo Image: Proxy Time-Based