Editing MIC-Specific Roles 

Use

An MIC power user can adjust the MIC-specific roles that are delivered in BC Sets and in this way specify the authorizations of a role by assigning the individual tasks.

Features

The power user has the following options for editing MIC-specific roles:

·        In Customizing for MIC under Edit Roles

·        Using a Web application that can be called up from the MIC start page

SAP delivers sample roles in a BC Set. To be able to use these sample roles, you need to activate the BC Set in Customizing. All other activities for editing roles are possible both in Customizing and in the Web application, although the user interface in the Web application is easier to use.

When editing a role, you assign all the tasks to it that anybody assigned to that role should be allowed to perform. You also specify the role level.

The role level defines whether the tasks can be performed for the entire corporate group, for a single organizational unit, for a process group, for a process, or for a process step.

The tasks are delivered by SAP and cannot be changed. Each task has the following attributes:

·        Minimum Role Level: The only tasks you can assign to a role are those with a minimum role level corresponding to the level entered for the role. For example, you can only assign the task Perform Sign-Off at Corporate Level (for which the minimum role level = group) to a role with Corporate level.

·        Restricted to One Role: Tasks for which this indicator is selected can only be assigned to one role. Furthermore, the following restriction applies to role assignment: When a role contains a task flagged with this indicator, that role may only be assigned to just one person for an object.

·        Processing by One Work Item Recipient Suffices: Tasks flagged with this indicator can be performed by more than one user. However, it is sufficient if only one user performs the task. As soon as one user has completed the task, it is then completed for all other users to whom the task is assigned.

·        Web application that the task calls up: Different tasks can call up the same Web application. For example, the task Assign Process to Organizational Unit and the task Edit Attributes of Process Groups Specific to Org Units both call up the Web application Process Assignment for Org Unit. If a person only has authorization for one of the tasks, then that person may only perform that task in the corresponding Web application. If, however, a person has authorization for both tasks, then he/she may perform both, regardless of the task from which the Web application was called up. In this latter case, it is sufficient for just one of the tasks to be scheduled. In this way, you can restrict the number of tasks that need to be sent.

For an overview of the delivered tasks and their attributes, see the following sections:

·        Tasks: Central Structure Setup

·        Tasks: Structure Setup Specific to Organizational Units

·        Tasks: Control Assessments and Tests

·        Tasks: Management Control Assessment and Test

·        Tasks: Reporting and Sign-Off

The task Create User is handled differently because a special authorization is required for this task. For more information, see Creating Users and Connecting Users to Persons.

Analyses

To find out which roles contain a task, you can search for a task in the Web application for processing roles. In this way, you can display all roles that the task is assigned to. Moreover, you can use Authorization Analysis.

Activities

...

       1.      If you want to use the delivered sample roles, activate the relevant BC Set in Customizing. For information about the procedure for this, see the documentation on the IMG activity Edit Roles.

       2.      Change the delivered sample roles or create your own roles.

       3.      Activate the roles that you would like to use and then save your entries.