For analytical apps, you need to define PFCG roles and assign them to the users as well as for transactional apps and fact sheets.

In addition, specific authorizations in the form of SAP HANA roles are required for analytical apps. The figure below shows the dependencies between the UI entities and the SAP HANA roles and is followed by an explanation:

You need to define your own SAP HANA roles that contain the following delivered SAP HANA roles and analytic privileges:

(1) For each analytical data service, an SAP HANA role, which contains the authorization to call the analytical data service, is delivered.

(2) For all configuration services and the KPI catalog services, one common SAP HANA role is delivered.

(3) You need to create analytic privileges containing the authorization for the analytical data services. To do this, you use SAP HANA Live Authorization Assistant. These privileges determine which analytical data from the SAP HANA database the users are allowed to see.

(4) You need to authorize users for evaluations. To do this, you use the SAP Smart Business modeler app Manage KPI Authorizations. In the background, the SAP Smart Business modeler app generates analytic privileges containing the authorization for the KPI catalog service. Without these privileges, the users will not see any tile in the SAP Fiori launchpad.

For analytical apps that serve the insight-to-action (I2A) paradigm, the following applies:

(5) Analytical apps providing insight-to-action features have also assigned business data services for which you need PFCG roles.