RBP Management, SAP SuccessFactors PDF

Provisioning ist das Backend des Systems und die Instanz ist das Frontend RBP Alles um RBP: Managing security using SAP SuccessFactors Role-Based Permissions Man kann sich als Admin der die Berechtigungen hat, RBP zu machen, diese nicht selbst entziehen Unterscheidung zwischen...

Provisioning ist das Backend des Systems und die Instanz ist das Frontend RBP Alles um RBP: Managing security using SAP SuccessFactors Role-Based Permissions Man kann sich als Admin der die Berechtigungen hat, RBP zu machen, diese nicht selbst entziehen Unterscheidung zwischen Rechte einsehen, bearbeiten und der Berechtigung, selbst zu verwalten wer RBP nutzen darf und wer nicht Man kann bei RBP auch sich selbst ausschließen als Zugriffsperson, sodass man zB nicht über sich selbst einsehen kann, wie man bewertet wird durch die Führungskraft Best Practices RBP Start with most generic roles We recommend starting with the most generic role such as an "All Employees Role" and casting the net as wide as possible to include all of the permissions that should be given to everyone. For example, in this role include all of the publicly-viewable fields in the Employee Profile. Avoid redundancy For additional roles, work on an exception basis and include only the unique extra permissions that the role should have beyond other roles. This practice will help reduce the number of roles in the system, which will both be easier to maintain, and will help improve system performance. Note It is important to keep in mind that the stronger permissions always wins. No overlap between roles A user should not get the same permission from different roles. If users have multiple roles and get the same permissions from different roles, this slows down the system response time for these users. Limit the number of groups and roles In general, keep the number of groups and roles as low as possible. This will both reduce the maintenance effort and ease the troubleshooting in case of any issues. Remember, that you can grant a role to multiple groups, so you do not have to duplicate roles just to assign them to different groups. From a performance point of view, we recommend a maximum of 1000 dynamic permission groups. Dynamic groups are based on rules in contrast to static groups which contain named users. These static groups do not count against the 1000 recommendation. Note that this is not a hard limit, it is a guidance recommendation. The system will allow you to exceed 1000 dynamic groups, but the consequences of exceeding 1000 dynamic groups will be to reduce system performance. Naming Conventions Agree on a naming convention for groups and roles. This makes the maintenance much easier, especially for large implementations. For groups, you could, for example, use the prefixes "Granted:" and "Target:" Meaningful Group Names, Role Names, and Role Descriptions Meaningful group and role names and role descriptions help customers to identify the correct groups and roles later during maintenance and troubleshooting. The role descriptions should state clearly the purpose of the role and not just repeat the role name. Additionally, advise the customers that they maintain a change login the role description field. It should include the change, the date, and who made and approved the change. The "View change history" function also delivers this information; however, looking up the description field is much quicker. Governance It's key that customers define a governance on RBP as soon as possible within the project. They should define how changes to RBP will be handled in the future: Who should be able to make changes? How can a change be requested? Who needs to review it and needs to be involved in deciding whether to make the change or not? These questions are especially important in large organizations where the departments tend to be separated from each other. If one department requests a change, this might also have an impact on other departments, so all parties need to agree on it. Some customers may also want to introduce the concept of separation of duties for the administration of RBP. How to achieve this is described in the Special Requirement: Separation of Duties in RBP Administration chapter. Run the RBP Check Tool The RBP check tool section in this guide provides information on how to run RBP checks and maintain good system performance. This tool provides a report that highlights all potential risks for the specific RBP configuration settings. Proxy: Benutzer hinzufügen oder entfernen auch per CSV möglich Commonly Used Company System Settings Settings Description Allow Manager Access to a Document’s Revision History As forms are modified and moved through the workflow in SAP SuccessFactors, an audit trail is created. With this option selected, only the manager can view the FULL history of changes on the form, and employees are only able to see the history of their own changes. Disable Product Feedback in Page Header Users can take part on a survey on certain pages, about 3–5 times a year, if this setting is enabled. Disable Proxy Access for Users without Proxy Rights If your company chooses to only let administrators make proxy assignments, this option should be selected. If you wish to allow users to assign their own proxies, leave this unchecked. That is, users will be able to assign their own proxies. General Display Name Enabled by Default for New Customers If that option is enabled and you’ve configured the Name Format for General Display field in Legal Entity and enabled the Enable the name format selected in Configure People Profile to apply globally, you can now see the name format that you’ve configured on UI pages of features that have adopted general display name in Learning as well. Enable Case-Insensitive Usernames (Note: After you enabled case-insensitive usernames, this option will grey out, and you can not disable it anymore.) With this setting it is possible to manage the case sensitivity of usernames in your company system. You can also ensure a smoother integration with SAP Identity Authentication Service (IAS) or other third parties that don't use case-sensitive usernames. Enable fuzzy search function for People Search Fuzzy search allows users to find an employee by a search term that has one-character difference from the target employee name. Enable HTML E-mail Notifications This allows SAP SuccessFactors to send for-matted messages to users. This message is also sent in Plain Text so it can be read by mobile users or by users who have not al-lowed HTML messages. Enhanced screen reader support and keyboard navigation. Special settings make the SAP SuccessFactors HCM Suite easier for some people to use, according to their personal needs. If this setting is enabled, the two options are always enabled (so ready to use) in the name menu/settings/accessibility. Everyone Can Access a Document's Revision History As forms are modified and moved through the workflow in SAP SuccessFactors, an audit trail is created. With this option selected, all roles who participated in form actions can access the full history of changes on the form. Hide Global Navigation Menu (Module Picker) This option allows to hide the Global Navigation menu from the common header area of your SAP SuccessFactors system. This enables you to make your SuccessFactors system more consistent with other SAP Cloud solutions. Integration with Outlook Calendar This allows users to add reminders associated with goals and forms to their Outlook Calendar directly from SAP SuccessFactors by selecting an e-mail icon. Show Custom Relationships in Company Organization Chart (for Company Organization Chart, Home Page, and Mobile People Profile) If you have imported matrix or customer managers and set "ORG_CHART_DISPLAY" to "TRUE" for those managers, after you enable this option, matrix and custom relationships display in the Company Organization Chart, Home Page, and People Profile. To learn how to import matrix and custom managers, you can look at the Managing User In-formation guide from the SAP Help Portal. Show inactive user in people search (requires Role-based Permissions) Both inactive and active users appear in the search results for different module pages when "Show inactive user in people search (requires Role-based Permissions)" is enabled. Show icons and use alphabetical order in the main navigation menuIf enabled the main navigation menu will appear in an alphabetical order and show icons. Upgrade center: Default ist, dass man, wenn man Zugriff auf das Admin Center hat, Upgrades machen kann; soll es anders sein, muss es im Provisioning eingestellt sein Suchlogik In der Suchlogik, die hier für das Namens-Matching in SAP SuccessFactors beschrieben wird, kommen spezielle Zeichen wie der Stern * als Wildcard zum Einsatz, um flexibler nach Namen zu suchen, insbesondere wenn man sich über die genaue Schreibweise nicht sicher ist. Die Funktionsweise dieser Logik lässt sich wie folgt erklären: 1. Wildcard-Zeichen * Das *-Zeichen steht für eine beliebige Anzahl von Zeichen, einschließlich keiner. Es kann sowohl am Anfang, in der Mitte als auch am Ende eines Suchbegriffs verwendet werden. Dieses Zeichen ermöglicht es, Teile eines Namens flexibel zu suchen, auch wenn man nicht die genaue Schreibweise kennt. 2. Beispiel-Analysen: Suche: "Mike adam" ○ Hier wird "Mike" mit "adam" kombiniert gesucht. Die Suche ist case-insensitive (Groß-/Kleinschreibung wird ignoriert). ○ Ergebnis: Person A ("Mike Adams") erscheint, da die ersten Buchstaben des Nachnamens "Adams" mit "adam" übereinstimmen, obwohl der vollständige Nachname "Adams" lautet. Suche: "Mike Willi" ○ Es wird nach einem Vornamen "Mike" und einem Nachnamen, der mit "Willi" beginnt, gesucht. ○ Ergebnis: Person B ("Mike Williams") erscheint, da die ersten Buchstaben des Nachnamens "Williams" mit "Willi" übereinstimmen.  *Suche: "Mi ams" ○ Hier wird mit dem Wildcard-Zeichen eine flexible Suche ausgeführt. Es sucht nach allen Namen, die mit "Mi" beginnen und auf "ams" enden, wobei zwischen "Mi" und "ams" beliebige Zeichen stehen dürfen. ○ Ergebnis: Sowohl Person A ("Mike Adams") als auch Person B ("Mike Williams") erscheinen. Obwohl ihre Nachnamen unterschiedlich sind, erfüllt der Wildcard-Operator * die Bedingung, da "Adams" und "Williams" beide auf "ams" enden. *Suche: "ike Adams" ○ Hier wird nach einem beliebigen Zeichen (repräsentiert durch *), gefolgt von "ike Adams", gesucht. ○ Ergebnis: Kein Treffer, weil das * am Anfang einen flexiblen Platzhalter für beliebige Zeichen sucht, aber der Name "Mike Adams" mit "M" beginnt und nicht mit irgendeinem anderen Zeichen. Action Search sehr stark konfigurierbar Abkürzungen Eigene Bezeichnungen Eigene Verlinkungen For You Today The section "For You Today" contains system-generated content, helpful and engaging, according to predefined business logic. Content is ordered by urgency and value and then adjusted based on the engagement with it. Some examples include: Updates to the job application status Goals that are due soon or overdue Recent updates to the activities in Continuous Performance Management Etc. Smartphone: "Enable Mobile Features" für sämtliche Einstellungen fürs SF auf dem Smartphone (für PP irrelevant) In den RBP einstellbar, wer Zugriff auf Mobile Features bekommt und wer nicht  Man kann auch Devices aktivieren Sprache: Es gibt Language Packs, diese enthalten aber nur grundlegende Dinge wie Menübezeichnungen oder Fehlermeldungen Weitere Sprachelemente müssen selbst konfiguriert werden Mit XLM Dokumenten können Übersetzungen im- und exportiert werden "Text Replacement" um Wörter zu tauschen Um bei Picklists verschiedene Sprachen für die Begriffe zu nutzen (Übersetzungen) muss man den Picklist Eintrag bearbeiten und dann auf die Position "Label" --> all das kann man auch mit einer csv Datei einstellen, die man ex- und importieren kann; diese Änderungen von Bezeichnungen kann man auch fürs EC machen unter Manage Business Configuration --> Label --> auf den Globus, wechselt man dann zur jeweiligen Sprache passt es Quick Actions: Zum durchführen der häufigsten und wichtigsten Aufgaben EC User Rechte Profilbearbeitung: Info: generell können alle Infos zu Personen sowohl im- als auch exportiert werden per csv (UDF Infos) Description of header settings The following table describes the available header settings in the People Profile. Setting Description Configure Header Fields Opens a dialog that allows you to configure which data fields are displayed in the profile header. See Configuring Header Fields for details. Allow employees to edit background image If checked, users can upload their own background "cover" image to their profile header. Disable background image uploading by employees If you check both this option and the Allow employees to edit background image option, users change their background image only by choosing one from the image library. Manage background image library Opens the existing Manage Background Image Library dialog, which allows you to manage the images from which users can select a background "cover" image for use in their profile header. Allow employees to upload an audio file for name pronunciation Enable the "My Name" feature, allowing users to upload a short audio clip or enter a phonetic spelling to show how their names are pronounced. To enable this feature, admins are also required to accept a user agreement acknowledging that all media content is stored in the SAP data-center in Germany. Users aren't presented with this agreement. Allow employees to upload an About Me video Enable the "About Me" feature, allowing users to upload a short video about themselves. To enable the "About Me" feature, admins are also required to accept a user agreement acknowledging that all media content is stored in the SAP data-center in Germany. Users aren't presented with this agreement. Allow employees to enter an introductory text If checked, users can enter a short text about themselves, of up to 500 characters, which is visible in the profile header. Set all fields as expanded by default If checked, when employees access the People Profile page, all the content that they have permission to access on the page is displayed. Employees can choose to show less or more content in blocks as needed. Choose the name format displayed on the profile. You can select one of the name formats configured in SAP SuccessFactors Employee Central to display in the profile header. Manage Business Configurations: Changing labels Adding or changing translations Activating fields Changing the display sequence of fields Changing the visibility of fields Setting fields to "required" Adding custom fields Defining rules Änderungen in der BCUI können per Job synchronisiert werden mit der XLM Datei, die die Daten speichert (wichtig!) Dadurch kommen die Daten ins MDF Picklist Fields Field Description Code Unique business key that is used to identify the picklist. (If you are familiar with legacy picklists, this is the equivalent of the picklist ID.) Parent Picklist A picklist can have a parent picklist. For example, if only certain states can be chosen when a specific country is selected, the Country picklist is the parent of the State picklist. When legacy picklists are migrated to MDF picklists, an optionId is generated for existing MDF picklist values. For legacy picklist options that have been migrated, the existing optionId is stored in the mapping table. Display Order Order in which the picklist values are listed in the picklist dropdown, for example, alphabetically or numerically. Name Unique name of the picklist. For example, if the picklist is for the type of address (home, mailing, business, billing, and so on), you could name the picklist "Address Type". Status Specifies whether the picklist is active or inactive, that is, whether it is available for use. Effective Start Date A picklist can have different sets of picklist values for different start dates. Example: To add a new value New York to the Location picklist but you want this picklist to be available for this location after January 1, 2017. Enter in 01/01/2017 as the effective date, the picklist with the new value is available after January 1, 2017. Note At this stage, Employee Central UI does not respect MDF picklist effective dating. Legacy Picklist ID The legacy picklist IDs can be edited from the Picklist Center after the migration to MDF. Instance sync on picklists is no longer allowed if the combinations of external code and legacy picklist ID in source and target instance do not match. You can edit the legacy picklist ID to make sure that they match. The legacy picklist ID must be unique across all picklists. Picklist Value Fields Field Description External Code MDF external code. A unique business key that is used to identify the picklist value, for example, state_Alabama. Non-unique External Code Legacy external code. Unlike the MDF external code, it can be blank or duplicated. Parent Picklist Value For example, if the external code is state_Alabama, the parent picklist value would be United States. If the value is state_Alberta, the parent picklist value would be Canada. Label For example, if the external code is state_Alabama, the label would be Alabama.  Assignment ID is used to identify users across the HCM Suite, in import and export tools, in the user interface, in APIs, and in reports. User ID (users_sys_id) still exists, but we recommend that you use it for system integration. Differentiating between Person ID, UUID, User ID, and Assignment ID Field Description Can this ID be changed? Relationship between these IDs Person ID (person-id-external) A unique identifier of a person in Employee Central. Person ID identifies a natural person. An employee generally has only one person ID throughout their time at the company, since this ID is associated to each person. Yes UUID and person ID are in a one-to-one relationship. User ID and assignment ID are in a one-to-one relationship. One person ID is associated to one or more user IDs and assignment IDs. One UUID is associated to one or more user IDs and assignment IDs. UUID (per-person-uuid) This identifier is generated when person data is created in the system. UUID is introduced for integrating person data in Employee Central with other modules. UUID is stored at a database level only and is not visible on the UI. No User ID (users-sys-id) A unique identifier of user entity. A person might have one or more user IDs. If a customer maintains only one employment per person in SuccessFactors, the user ID can serve as the person’s unique identifier in the company. No Assignment ID gradually takes place of user ID on the UI across the suite. User ID still exists, and we recommend that you adopt it for system integration. Unterschied in der Praxis: Person ID identifiziert den Mitarbeiter als Individuum. User ID identifiziert den Benutzerzugang für verschiedene Arbeitsrollen oder IT- Systeme. Eine Person kann also mehrere User IDs haben, aber nur eine Person ID. Wann welches Tool? Refer to the following table to choose the correct user management tool depending on your system configuration. If you want to... Use this tool for users that are managed in Employee Central Use this tool for users that are NOT managed in Employee Central Add or update basic user information by using the UI Employee Self-Service and Manager Self- ServiceManage Users Add or update basic user information by using a data file Import Employee Data->Basic User Import Employee Import Download basic user information Employee Export Add or update extended user information Import Extended User Information, Import Employee Data->Extended Import, or Import Employee Data -> Background Import Import Extended User Information Download extended user information Export Extended User Information Validate your user data Check Tool->User Management MDF Custom fields Speichern von Informationen die uns wichtig sind "Configure Object Definitions" 1. UDF (User Data File) Definition: Das User Data File (UDF) ist eine CSV-basierte Datei, die verwendet wird, um Benutzerinformationen und Datenfelder im System zu verwalten und zu aktualisieren. Es handelt sich um eine ältere, aber immer noch weit verbreitete Methode zur Verwaltung von Benutzer- und HR-Daten. Verwendung: ○ UDF wird hauptsächlich für den Massenimport und -export von Benutzerdaten verwendet. ○ Personaladministratoren nutzen es, um schnell Änderungen vorzunehmen, wie z. B. Aktualisierungen von Jobtiteln, Abteilungen, Standorten oder Managern. Flexibilität: Die Felder in der UDF sind statisch und erfordern Entwicklungsaufwand oder Hilfe von SAP-Support, um neue Felder hinzuzufügen oder anzupassen. Datenstruktur: UDF ist flach strukturiert, d.h., es werden einfache, zeilenbasierte Daten ohne komplexe Beziehungen oder Hierarchien verwendet. Typischer Anwendungsfall: UDF wird oft genutzt, um Daten aus anderen HR-Systemen zu importieren oder zu synchronisieren, oder für einfache administrative Aufgaben. 2. MDF (MetaData Framework)  Definition: Das MetaData Framework (MDF) ist eine flexible und erweiterbare Datenstruktur, die es ermöglicht, benutzerdefinierte Objekte und Felder in SAP SuccessFactors zu erstellen und zu verwalten. Es ist ein moderner Ansatz zur Datenmodellierung innerhalb des Systems. Verwendung: ○ MDF wird verwendet, um benutzerdefinierte Objekte zu erstellen, wie etwa benutzerdefinierte Formulare, Konfigurationsdaten oder erweiterte HR-Prozesse, die nicht im Standard existieren. ○ Es ermöglicht die Konfiguration von hierarchischen und komplexen Datenstrukturen, die verschiedene Beziehungen zwischen Objekten unterstützen, z. B. für Kompensation, Benefits oder Zeitmanagement. Flexibilität: MDF ist sehr flexibel, da Benutzer mit den richtigen Berechtigungen problemlos neue Felder, Objekte und Prozesse erstellen und anpassen können, ohne dass Entwicklungsaufwand notwendig ist. Datenstruktur: MDF arbeitet mit relationellen Datenstrukturen, was bedeutet, dass es Beziehungen zwischen verschiedenen Objekten und Daten ermöglicht, ähnlich wie in einer relationalen Datenbank. Typischer Anwendungsfall: MDF wird in SuccessFactors oft genutzt, um komplexe Geschäftsprozesse zu modellieren und anzupassen, wie z.B. für das Performance Management, Zeitverwaltung oder Kompensationspläne. Wichtige Unterschiede: Merkmal UDF MDF Datenmanagement CSV-basierte Datei für Massenänderungen Flexibles Framework für benutzerdefinierte Objekte Flexibilität Weniger flexibel, statische Felder Hoch flexibel, neue Felder/Objekte konfigurierbar Datenstruktur Flache, zeilenbasierte Datenstruktur Relationale, hierarchische Datenstruktur Verwendung Verwaltung von Benutzerdaten (Jobdaten, Abteilungen) Benutzerdefinierte Prozesse und Objekte (z.B. Kompensation, Benefits) Benutzerfreundlichkeit Technische Expertise erforderlich Konfiguration ohne Entwicklung möglich Beispiele Jobtitel, Abteilungen, Manager Bonuspläne, Zeitregelungen, Bewertungsprozesse Fazit: UDF eignet sich gut für einfache Datenimporte und -exporte sowie zur schnellen Bearbeitung von Standard-Benutzerdaten. MDF ist ein leistungsstarkes Tool zur Erstellung und Verwaltung benutzerdefinierter Prozesse und Datenstrukturen in SAP SuccessFactors, das vor allem für komplexere und flexiblere Anforderungen verwendet wird.  MDF ermöglicht die Erweiterung der bestehenden SuccessFactors-Funktionen. Du kannst neue benutzerdefinierte Objekte erstellen und bestehende (sogenannte generische Objekte) verwalten. Objekte können verknüpft und in Hierarchien organisiert werden. Integriert mit Workflows, der Regel-Engine und Berichten. Unterstützt Import/Export, Sicherheitsfunktionen über Rollenbasierte Berechtigungen (RBP). Daten können über UI, Import/Export oder oData verwaltet werden. Mit Manage Data können Administratoren den Datenverbrauch von MDF-Objekten überwachen und bei Bedarf Daten bereinigen. Es gibt verschiedene Arten von Datenvolumen, wie Audit-Daten, Assoziations-Daten und Transaktions-Daten, die verwaltet werden können. Anwendungen wie Position Management, Time Off und Manage Business Configuration nutzen MDF. Administratoren können bis zu 250 benutzerdefinierte MDF-Objekte erstellen (erweiterbar auf 400). Objekt-Definition ist die grundlegende Ebene, auf der Felder, Verhalten, Sicherheit und Verknüpfungen festgelegt werden. Business Rules können verwendet werden, um Logik wie automatische Werte oder Aktionen bei Speicherung/Änderung hinzuzufügen. Nach der Erstellung eines Objekts kannst du Ansichten oder UI anpassen (Felder hinzufügen/entfernen, Layout ändern). "Manage Data" ist häufig der Ausgangspunkt für das Konfigurieren von MDF Objekten, hier wird alles mögliche erstellt Wir wollen zB hieran Änderungen vornehmen: --> Configure Object Definitions Search "Object Definition" und nach "Position" suchen --> Make Correction --> Details zum Anpassen des Labels "Generic Object" = "MDF Object" Bsp: Objekt anlegen "Company car": Configuring MDF objects (sap.com) Business Rules: Rule events Business Rules could be attached to different events. These events include the following: Initialize Rules: Initialization rules are triggered before all other rules; such rules are useful to autofill default values for different fields. They only run when a new record is created (initialized). Validate Rules: Validate rules are triggered after a change to an object is submitted but before the change is saved. You can use these rules to validate field values entered by user. These are executed before Save Rules. When you import MDF data using the Import and Export Data UI, the validate operation triggers the validate rules associated with the MDF objects and returns errors found in the data. Administrators can then catch any data issues through validation and correct them before importing it. In fact, the validate rules are executed during both validate and import operations. Save Rules: Save rules are triggered when a user saves changes. You can use these rules to populate or change field values before saving and they are based on user inputs values. For example, you want to auto populate region field based on country values selection. Post Save Rules: Post Save rules are triggered after changes to an object have been saved. These rules are used when you want to send an alert message to the user. They are not used to set a field value. Change Rules (onChange): They are used at the field level. Objects cannot be associated with change rules. Change rules are triggered when a value for a particular field is changed. You can use these rules to populate another field after the change. For example, you can populate the Country field with a certain value based on a change to the Position field. Delete Rules: Deletion rules are triggered after an object record is deleted. On Load Rules: On Load rules are UI specific rules that get executed once the UI is loaded. An example could be calculating total salary based on different fields available on given object. UI Rules: These rules are applicable only for a UI built in the tool Configurable UI. These are UI specific rules to make certain field required, visible or hide based on certain condition. Such rules will not be applied when a user does the import. Use Cases von Business Rules sind sehr vielfältig: Workflows, Datenübertragungen in andere Felder, Kalkulationen, If-Validierungen, usw. Die "Base Objects" sind der Ausgangspunkt für die Business Rule, weil sie die Ausgangsdaten darstellen (EC oder MDF Objekte) A function performs a specific task on the data object or field of a rule. Rule events onInit: This event triggers a rule as soon as a new entity is created. For Employee Central, OnInit rules work only in Hire/Rehire scenarios and for legacy foundation objects. Since these rules are for new hires, they do not work for existing users. onSave: This rule event is triggered when a user tries to save changes to an object. You can use these rules to check related field values for correctness. For example, a field could become required as a consequence of a save. You can also use this to create or updated data. onChange: This rule event triggers a rule as soon as the user makes a change to a field. The rule triggers while the record is being filled out, not when the Save button is triggered. Note Attaching business rules to fields is the equivalent of an onChange rule event. onPostSave: Trigger events for Intelligent Services. Business Rule erstellen nach Konfiguration eines MDF Objekts: Creating and triggering Business Rules (sap.com) Es gibt Dynamische Teams die erstellt werden können für bestimmte Verwendungszwecke und somit unabhängig von der Organisationsstruktur sind --> z.B. Projektteam Übungsaufgaben, Unit 3 Exercise 4