Transcript ISR Role Help - Shared Services Home Page

ZSR New Action Types
Roles and Home Cost Center
August 5, 2009
1
ZSR New Action Types
Introduction
• Overview of ZSR Process
• Changes and Improvements
How-To:
• Using the ZSR - SAP Roles Action Type
• Using the ZSR - Home Cost Center Action Type
2
Table of Contents
Highlights
Page #
ZSR Process Overview
5
Changes to ISR Processes
6
Add and Remove Roles
13
Role Validations
22
Home Cost Center Screen
26
ZSR Workflow Routing
31
ZSR Report
33
3
ZSR is now a “One Stop Shop” for SAP Security!
• The transaction that has been used for requesting
other SAP privileges is now expanded to include
requests to Add and/or Remove SAP Roles
• ZSR now allows updates to the "Home Cost Center"
which determines the routing of some SAP workflows
• The ZSR is the One Stop Shop for these Action Types:
–
SAP Roles
– BW Roles with CC/IO Security Assignments
– Workflow Responsibility Assignments
– Additional Org Unit Security Access (Z61)
–
Maintain Home Cost Center for Workflow Routing
4
ZSR Process Overview
ZSR Initiator
makes Request
Request includes
Roles or "Z61" HR
relationships outside
User’s Business Area
ZSR Approval
Routed by
No additional approvals required
Initiator’s
Home CC
Request includes:
“Restricted Roles”?
* Additional
“Outside”
Business Area
Approval
Approved
ZSR Request
Additional
“Role Owner”
Approval
* Workflow and
BW do not yet
have an outside
ZSR approver
Automatic
updates daily
Changes to ISR Processes
ISR Type
Old Process
New ZSR Process
POSITION
CREATE
ISR Initiator could include
roles on Position Create
ISR for the position to be
created with roles
POSITION
COPY
New position is assigned
the same roles as the
position copied
New positions will continue
to be created or copied
(without roles) via the ISR
process; and a ZSR will be
needed to assign roles,
individually or through the
ZSR Position Copy feature
POSITION
MAINTAIN
Position Maintain ISR
was used to Add or
Remove SAP Roles
ZSR will be used to Add or
Remove SAP Roles
The ZSR includes an action type to update the Position Home Cost Center,
which can also still be updated using a Position Maintain ISR.
6
Usability Improvements with the ZSR
• Role selection by type:
–
–
–
–
Standard R/3 and SRM Roles
BW Roles
Restricted Roles (requires additional approval)
Portal Roles (usually assigned automatically, rarely requested)
• Accompanying roles automatically assigned
(e.g., technical and portal roles needed for
functional roles to operate properly)
• Copy capabilities:
– From one Position to another
– From a previous ZSR Request
7
Internal Control Improvements with the ZSR
•
•
•
Automatic update/assignment of fully approved requests
Validations to prevent key role conflicts
Enhanced and fully automated ZSR workflow approvals:
1. ZSR routed to the appropriate ZSR Approver determined
by the Home Cost Center of the “subject” User
2. Additional approval for R/3 roles and Z61 requests for
access outside of Users’ Business Area
 Future for BW and Workflow assignments
3. Restricted Role Owner approval for roles normally reserved
for central departments such as Shared Service Centers and
Controllers' Offices
•
More accessible maintenance of Home Cost Centers to
ensure proper routing of certain workflow transactions
8
REQUESTING
SAP ROLES
USING THE ZSR
9
Getting to the ZSR
You can enter ZSR in the
command box and hit enter
OR
Go into the SAP Easy Access menu in R/3
Under Security and Workflow One Stop Shop Requester
Select ZSR—Security Roles and Workflow Request
10
Roles Action Type
Enter SAP User ID
Select the Action Type SAP Roles
11
Create Request
Click Create Request Button
to go to the next screen
The ZSR displays accurate and useful information. So, you can use this
screen with any action type to DISPLAY the access of any User. You still
click Create Request, but then you won’t Submit the Request.
12
Add and Remove Roles
This section shows the roles
currently assigned to the user
Click here to delete roles
The Role Type Pull Down
has 4 choices which filters
the roles for each type
13
Selecting Roles
In this example, the Standard Role Type was
selected. In the Role technical name pull
down, only standard roles will be displayed.
Double click on any line to make your selection
14
Searching for a Role
By clicking the binoculars
you can enter search criteria for the role you are looking for,
using asterisk * for wildcard, the first role matching your criteria (if found) will be highlighted.
To search for additional roles meeting the criteria, Click the binoculars with the +
15
Selecting a Standard Role
A standard role has been selected
16
Selecting a Restricted Role
In this example, the
Role Type Restricted
has been selected
These Restricted Roles
require additional approval
by the Role Owner
17
Saving the ZSR Request
Click “Save Request” to continue to the summary screen
A Standard Role and a Restricted Role have been selected
18
Request Comments
Comments can be added to any
row to describe the reason for
any individual role, as needed
Restricted Roles require comments
on the specific role, so that the Role
Owner/Approver can review the
justification for the request
Comments may also be added to provide
information about the entire request
19
Summary Screen
The summary screen shows all Roles that are being
requested and allows for comments to be added
Click Submit Request to Save the
Request and submit to Workflow
20
Role Validations – Error Messages
• Conflicts – see example next page
Certain combinations of roles are not allowed to be assigned to the same User.
An error message with the technical name of the first role will be displayed and
the second role will appear in red if you request two conflicting roles or a role
which conflicts with an existing role.
• Duplicates – User already has the role
• Roles Not Currently in Use
There are very rare cases where you may see the error message below, by
requesting a role that is not intended to be assigned. This will only happen if:
 You manually enter a role name, since these roles will not be displayed in the lookup
 You use ZSR Position Copy and the Position you use as your source to copy already has the role
21
Role Conflicts
This is an example of two roles
that are not allowed to be
assigned to the same user. If
you request the two roles
together OR if you already have
one of the roles and are
requesting the other, you will
see an error message like this
To clear this error, you have to manually
delete the contents of each field (Role Type,
Technical Role Name and Display Role Name)
22
Accompanying Roles
Certain roles require portal roles or other "behind the
scenes" roles to operate correctly. On the summary
screen, you will see these type of accompanying roles
added to your request and listed as derived (DRVD).
In this example, one BW role was
requested and the other four
roles were added to the request
23
REQUESTING
CHANGES TO
HOME COST CENTER
USING THE ZSR
24
Maintain Home Cost Center Action Type
This Example will show how to request
changes to a User’s Home Cost Center
Enter SAP User ID
Select the Action Type
Maintain Home Cost Center for Workflow Routing
25
Home Cost Center Screen
User's current Home Cost Center
Enter the new Cost Center or choose from the pull-down list
26
Save Home Cost Center Request
Click Save Request to continue
to the summary screen
New Home Cost Center
has been selected
NOTE: The Home Cost Center is used to route workflow requests
and does not impact payroll or labor distribution postings.
27
Submit Request
Hit “Submit Request” to
Save the Request and
submit to Workflow
After you Save your request, but before
you Submit it, you may click Modify
Request to make changes and/or add
other Action Types to the Request
Before submitting, you
may enter comments
28
ZSR WORKFLOW
AND APPROVING
ZSR REQUESTS
29
ZSR Workflow Routing
Home Cost Center ZSR Approver (Approver 1) – for all action
types: reviews the whole request and can approve or reject
each line item
Additional Approvers (Approver 2) – applies to Roles and Z61
action types: will see only the line items they are responsible
for approving or rejecting based on the following:
•
•
Roles (or Z61 relationships) specific to a business area outside of the
subject User's business area are routed to the designated ZSR
Approver for the requested business area
Restricted roles are routed to the Role Owner for their authorization
due to the restricted nature of the role
30
ZSR Approver Screen
The approval screen appears with a
checkmark
by default, for each role.
If Approver authorizes the role as
appropriate, no further action is required
on the individual line items.
After all line items are
reviewed and Approved
or Rejected, click Submit
To reject roles:
• Individual roles- uncheck Approved
checkbox for specific line(s)
• All roles on the request – click the
Reject All
button to uncheck
all roles (still requires Submit)
The Approver may include comments on any role (line item)
or, in general, on the Approver Comments for the whole request
31
ZSR Report
To see a report of ZSR Requests, fill in search criteria.
In this example, we are searching by all requests created on 02/20/08.
After you select your search criteria, click on the green check mark
with the clock. This will run the report.
32
Tracking Requests with the ZSR Report
Here’s a list of all requests created on that particular date. You can see the
ZSR Number, Approval Status, etc. To choose one, highlight it and double click.
33
ZSR Report and Approval Status
APPR&COMPL – request is fully approved
APPRLVL1 - request has been approved by
Approver 1, but is still awaiting an Approver 2
Lines marked APPRV&COMPL with an
Initiator DERIVED indicate this is an
accompanying role assigned automatically
All ZSR Approval Statuses:
34
ZSR Report and Update Status
For each ZSR request, each action type will
display one line on the initial ZSR Report.
Click any line to drill down to view the
individual line items for that action type.
Scroll over to the right to see details about the
line item (in this example, the Role Name)
The Update Status indicates if SAP has been
updated with the assignments or changes:
Blank – awaiting update
S – successful update
F – failed update (EBS monitors failures daily)
35
Reminder Tips for Tracking your ZSR Workflow
• For the Initiator to determine who is the Approver on the request,
use Workflow Outbox and double-click on the ZSR Request
• Click Log
icon
and then, once you locate the request, click on Agent
and then click Agents to see the name of Approver 1
• To identify the Restricted Role Owners whose approval is needed: go
to the Knowledge Network – SAP Support Center – Security section
• Once the Approval Status is APPR&COMPL (Approved & Completed)
and the Update Status is S (Successful), the assignments and updates
are made and user will have the access effective the following day
(after a series of overnight jobs)
36
Future ZSR Enhancements
More enhancements and features are planned!
Based on the feedback we receive and other priorities,
some potential improvements for future consideration are:
• Additional approvals for BW and Workflow assignments
outside of User's business area
• Automatic routing to a higher level approver for ZSR
Approvers who cannot approve their own requests
• Improved error messages
• Improved search capabilities
• Single requests for updating multiple users
• Action type for assigning Workflow Substitutes
37