3 Setting the foundation01 Introduction To MasteryC5_ManageSecurityProxy

,IntroductiontoMasteryTraining,ManagingSecurity,2012.SuccessFactors,Inc.,AnSAPCompany.Allrightsreserved.Nopartofthisdocumentmaybereproducedortransmittedinanyformorbyanymeans,electronicormechanical,withouttheexpresswrittenpermissionofSuccessFactors.Thissoftwareiscommercialcomputersoftwaredevelopedexclusivelyatprivateexpense.ThesoftwareanddocumentationareprovidedwithRESTRICTEDRIGHTS.Use,duplicationordisclosurebytheU.S.GovernmentissubjecttorestrictionsassetforthinDFARS252.227.7202-3orFAR52.227-19,asapplicable.DeveloperisSuccessFactors,Inc.,AnSAPCompany,1500FashionIslandBlvd,Suite300,SanMateo,CA94404.RwizisatrademarkofEnterpriseInformationResources,Inc.TheproductdescribedhereinincludessoftwaredevelopedbytheApacheSoftwareFoundation(/).Allotherbrandandproductnamesthatarementionedhereinarethetrademarksorregisteredtrademarksoftheirrespectiveholders.Allexamples,includingthenamesofpeopleintheexamplesorscreenshotsarefictitious.Noassociationwithanyrealperson(livingordeceased),company(existingcurrentlyorinthepast),oreventsshouldbeinferredfromanyexamplewhatsoever.InformationinthisdocumentissubjecttochangewithoutnoticeanddoesnotrepresentacommitmentonthepartofSuccessFactors.SuccessFactors,Inc.,anSAPCompany1500FashionIslandBlvd,Suite300SanMateo,CAUSA,Agenda,PermissionsOverview,PermissionsOverview,Permissionscontrolwhatuserscansee,access,andmodifyinSuccessFactorsPermissionscontrolledbyconfigurationinclude:FormsectionvisibilityVisibilityofpublicversusprivategoalsPermissionsthatarecontrolledadministrativelyinclude:GoalplanaccessReportingAdministrationPermissionsthatarecontrolledadministrativelymaybemanagedusingdefaultuserpermissionsorindividualpermissions,DefaultUserPermissions,DefaultUserPermissionsOverview,DefaultUserPermissionsindicatewhatsystemfunctionsnewusersstartwithwhentheyarefirstcreatedUsethecheckboxestoturnonandofffeaturesfordefaultusersIfnocheckboxesareselected(nodefaultuserpermissionsassigned),nouserswillbeabletologinTheabilitytologinandseetheHomepageareautomaticallygrantedasdefaultuserpermissionsIfyouwantuserstohavemoreprivileges,forexampletheabilitytoseetheirGoalPlans,youmustgrantadditionaldefaultuserpermissionsClicktheSaveSettingsbuttonatthebottomofthepagetosaveyourpermissions,DefaultUserPermissions,Affectsallactiveusers(allcurrentandfutureuserswithactiveaccountsaremembersofthedefaultusergroup)AllactiveusersmustbelongtothedefaultusergrouptobeabletologintoSuccessFactorsMostofthetime,usersareaddedtothisgroupautomaticallyImportant!MostofthesesettingsaresetduringconfigurationandarenotlikelytoneedanymodificationpostGoLive.,DefaultUserPermissionsSettings,AnythingsetherebecomesdefaultpermissionsforallactiveusersAnythingturnedon/offhereisturnedon/offforeveryoneAnythingsethereoverridesindividualsettingsTorevokeapermissiongrantedasadefaultuserpermission,youmustrevokethemfromtheDefaultUserPermissionpage,TypicalDefaultUserPermissions,PermissiontocreatenotesPermissiontoviewgoalplansReports:DashboardsListViewsSpotlightViewsPotentialotherpermission:EmployeeProfileCareerDevelopmentPlanning,ThingstoRememberaboutDefaultUserPermissions,Keepinmindthatallcurrentandfutureuserswillhavethedefaultuserpermissionsyougrant.Makesureyougrantadditionaldefaultuserpermissionsonlytothefeaturesthatyouwantalluserstoaccess.WerecommendthatyoudontgrantanypermissionstocustomizesystemfeatureslikeTemplatesasdefaultuserpermissions.WestronglyrecommendthatyoudontgrantanyAdministrativepermissionsasdefaultuserpermissions.GrantingAdministrativepermissionsallowsalluserstomakechangesthataffecttheentirecompany.Ifyouwanttorevokeapermissionyougrantedasadefaultuserpermission,youmustrevokethemfromtheDefaultUserPermissionsSettingpage.,MoreDefaultUserPermissioninformationonConfluence:,IndividualPermissions,IndividualPermissions,Typicallygrantedtosystemadminsand/orasHRpersonnelAdminscansetpermissionsforindividualusersaboveandbeyondthedefaultuserpermissions,including:AdministrativeprivilegesAd-hoc,spreadsheet,andclassicreportsHumanresourcespermissionsPermissiontocreateformsModule-specificpermissionsforCalibration,Succession,Recruiting,etc.,RecommendedAdministratorPermissions,AdministrativeprivilegesAccesstoclassicreportsAccesstospreadsheetreportsAccesstospotlightviewreportsOptional:Proxymanagement,RecommendedHRPermissions,HumanResourcesprivileges(relevantonlyifHRispartofaperformanceformworkflow):ApprovemultipleformsatonceApproveasingleformSortformsbyduedateVieworworkonasingleformAccesstoclassicreportsAccesstospreadsheetreportsAccesstospotlightviewreportsOptional:Proxymanagement,AdministrativePrivileges,AdministrativePrivilegesOverview,Youcangrantemployeesaccesstoallorsomeoftheadminfeaturesbygrantingfullorpartialadministrativeprivileges:Forexample,ifyourcompanyhasremoteoffices,youcanallowaregionalon-sitemanagertoresetemployeepasswordsAdministrativeprivilegesaredividedintogroupsoffunctionaltasks:EachpermissiongroupcomprisesindividualpermissionsYoucangrantadministrativeprivilegesfortheentiregroupofpermissionstomultipleemployees,andthenrefinethepermissionsbyrevokingindividualpermissions,MoreDefaultAdministrativePrivilegeinformationisontheCustomerCommunity:,AdministrativePrivileges,Recommendation:Limitthenumberofuserswithadministrativeprivileges,butidentifytwoadministratorswithfulladministrativepermissionssothereisalwaysabackupEmployeeswithanyadministrativeprivilegeswillhavetheAdminToolsoptioninthemainnavigationdrop-downandtheWelcomemessagedrop-downAdministrationToolsshowlinksonlytotheadministrativefeaturesforwhichtheemployeehaspermission,AdministrativePrivilegeGroups,AdministrativeprivilegesareseparatedintogroupsGrantallprivilegesfromthegrouporexpandthegroupandselectindividualprivilegesfromeachgrouptoassignPermissionsgroupsinclude:,GrantFullAdministrativePrivileges,UndertheManageEmployeessection,clickSetUserPermissionsandselectAdministrativePrivileges.VerifytheManageadministrativesecuritythroughindividualusersoptionisselectedatthetopofthescreen.Entercriteriatosearchfortheuserwhosepermissionyouwanttodefine.ClickSearchUsers.,1,3,2,4,GrantFullAdministrativePrivileges(cont.),Inthesearchresults,checktheboxnexttothenameoftheuseryouwanttograntfulladministrativeprivileges.InthePermissionarea,checktheboxestoaddtherespectivepermission.ClickSaveAdminPermissionforSelectedUserstosaveyoursettings.,5,6,7,GrantPartialAdministrativePrivileges,Sinceeachpermissiongroupcomprisesindividualadministrativepermissions,youcangrantallprivilegesfromthegrouporexpandthegroupandselectindividualprivilegesfromeachgrouptoassignTograntpartialadminprivileges:Clickthegroupnametodisplayalloptions.Forexample,clickManageUserstodisplayalladministrativeprivilegeoptions.Checkorclearcheckboxesforeachpermission,asappropriate.Clickthegroupnameagaintohidethedetaileddisplay.ClickSaveAdminPermissionforSelectedUsers.,1,2,Notethecheckboxindicatorsasfollows:,3,4,ProxyManagement,ProxyOverview,TheproxyfeatureallowsanadministratortoauthorizeanemployeetoworkinanotherusersaccountAssigningaproxygrantsanemployeeaccesstoanotheremployeesaccount:Forexample,ifanemployeewillbeunavailableorabsentwhenaformisdue,aproxycanbeassignedtocompletetheformonhis/herbehalf.Proxyistheemployeeactingonsomeonesbehalf;accountholderistheemployeeonwhosebehalftheproxyisacting:Forinstance,JohnwillbeonvacationandassignsSarahtoactonhisbehalf.JohnistheaccountholderandSarahistheproxy.,ConsiderationsWhenAssigningProxies,Oneormoreproxiescanbeassignedtoasingleaccount,andoneemployeecanbeassignedasaproxyforseveralaccountsProxywillbeabletoopen,view,edit,andsendanyitemintheaccountasifhe/shewerethataccountholderIfmultipleproxiesareassignedtoanaccount,allproxiescaneditdataatthesametimeInthiscase,thechangesmadebythelastproxytosavethedocumentoverwriteschangesofallotherproxiesProxyremainsassignedtoanaccountuntilyouortheaccountholderremovestheproxyAudittrailthatautomaticallyaccompaniesanyactiontakeninSuccessFactorswillclearlystatethattheactionwastakenbytheproxy,MoreProxyManagementinformationonConfluence:,WhoCanAssignProxies?,Administrators:AssignandremoveproxiesforanyaccountAllowotheremployeestoassignproxiesthroughCompanySettingsEmployeeswillnotbeabletoassignproxies,eventotheirownaccounts,unlesspermittedtodosounderCompanySettings.Allemployees:OnlyifpermittedunderCompanySettingsIfpermitted,canonlyassignproxiestotheirownaccount,HowToAssignProxies,Assignindividualproxies(assignoneproxyatatime)orassignmultipleproxiesatonceConsiderations:Proxywillbeabletoopen,view,edit,andsendanyitemintheaccountholdersaccountYoucanspecifyiftheproxyhasaccesstotheaccountholdersprivategoalsIfmultipleproxiesareassignedtoanaccount,allproxiescaneditdataatthesametimeProxyremainsassigneduntilyouoraccountholderremoveshim/herAudittrailwillclearlyindicatethattheactionwastakenbyaproxy,ProxyManagementOption,ProxyManagementisfoundinAdministrationToolsunderManageEmployees,AnyuserwithProxyManagementrightsmaychoosetheOptionslinkandthenselecttheProxyfromtheleftmenu,MakeProxyAssignmentsusingAdminTools,ClickProxyManagementunderManageEmployees.Entertheusernamefortheuserwhoneedsrights.Entertheusernamefortheusertheywillproxyinas.Selecttheappropriatesystemmodules.ClickSave.,1,2,3,4,MakeProxyAssignmentsusingOptions,SelectOptionsfromthedrop-downmenu.ClickProxyfromtheleftmenu.ClickAssignProxy.Entertheusernametheywillallowasaproxyfortheiraccount.Selecttheappropriatesystemmodules.ClickSave.,1,2,3,4,5,6,LookUpExistingProxyAssignments,UsetheProxyManagementpagetofindexistingassignmentsYoucanfindproxyassignments:ByAccountholder:UsethisoptiontofindoutwhocanactasaproxyforaspecificaccountholderByPro