Creating Custom Roles

You can assign the delivered SAP Analytics Cloud standard application roles to your users. If they do not fit your business case, you can use them as a template for creating individual roles that meet your business needs.

Context

Note

In this procedure, we use the Roles page to assign roles to users, but you can also assign roles on the Users page. Whether you create users first or roles first does not matter.

Note

For information about individual permissions included in standard or custom roles, including permissions for individual objects, such as specific dimensions, see Permissions.

Procedure

Go to () Main Menu Security Roles.
Decide which license type you want to base your new custom role on.
The associated standard roles appear beside the license type, with any existing custom roles below them.
Choose Create a New Role to add a new role for that license type.
In the Create a New Role dialog, enter a unique name for the role, and select Create.

Note
Spaces are not allowed in the role name.
Select a role template.
The role templates are the predefined standard roles associated with that license type. After you select a template, the Permissions page appears, showing you the individual permissions defined for the role template you chose.
Define the permissions for your new role for every activity – either for all objects of a business object type, or individually for every existing business object.
For example, to define a user who is allowed to read all data change logs, select the check box in the Read column of the Data Change Log row. The permission is automatically passed on to all existing logs.
To define that the user should be allowed to read only specific data change logs, expand the Data Change Log node, and then select the check box in the Read column only for specific log rows.

For more information about permissions, see Permissions.
If you want to change the role template that your new custom role will be based on, select (Select Template), and choose a role.
If you have already created users that should be assigned the new role, choose Assign Users, select one or more users in the Assign Role To User dialog, and choose OK.
All users that are currently assigned to the role appear in the Selected Users list along with any new users you select.

Choose

(Role Configuration) to define the following options:

Option	Description
Use as Default Role	The default role is assigned to new users if no role is specified when users are imported or created.
Full Data Access	If you activate this option, any user who is assigned this role can see all the data of any model regardless of how the data access for the model is defined. Recommendation Grant full data access carefully and only to selected users.
Enable Self-Service	If you activate this option, any business user can request this role for himself in the Request Roles dialog.

If you selected the Enable Self-Service option, decide which type of user should approve the role request:
- Manager: The user assigned as a manager to the user requesting the role must approve the request.
  Note
  The manager is assigned to a user on the User page in the user management area.
- Other User: A specific user that you select from the dialog must approve the request.
Save your new custom role.

Note

You can't delete or save changes to the predefined standard roles.

Custom roles will have IDs in the following format:

PROFILE:<t.#>:<role_name> where t.# is the Content Namespace listed in (Main Menu) System Administration System Configuration. You must use the role ID when importing role assignments from CSV or assigning roles via the User & Team Provisioning API.

For more information, see Importing or Modifying Users from a File or SAP Analytics Cloud User and Team Provisioning API.