P2P Users and Groups Overview

Objectives

Understand user group concepts

Understand key business considerations related to user and
groups
Initiate discussion on specific user groups
Set in motion an action plan for assigning users to groups

2014-2015 SAP AG or an SAP affiliate company. All rights reserved. Customer 2

Users

Who needs a user account?

Anyone who will:
Create or approve transactions in P2P
Log into Ariba Upstream applications in a Suite Integrated Realm
Be available as an on-behalf-of user

2014-2015 SAP AG or an SAP affiliate company. All rights reserved. Customer 3

What do User Groups Impact?

Determine which specific Functions a user can perform in the

system
Drive Approval Routing, including Queues

Control Transaction Visibility

Sometimes used in logic to customize P2P, such as field visibility or
validation

2014-2015 SAP AG or an SAP affiliate company. All rights reserved. Customer 4

Permissions - Based on User Group

Permissions, or access to perform system functions, are granted

via user group assignments
Users receive combined permissions from all groups to which they
are assigned
Examples:
Members of the Purchasing User group have permission to create Requisitions
Members of the Receiving Agent group can create Receipts
Members of the Invoice Agent group can enter Invoices

In some cases, e.g. Create Change Order, users are granted

specific permissions based on being the Requester/Owner of a
document

NOTE: Specifically which permissions are associated to each group

cannot be modified.

2014-2015 SAP AG or an SAP affiliate company. All rights reserved. Customer 5

Permissions Special Cases

Regardless of Group Membership, users can:

Initiate Change Orders for their own Requisitions
View and approve documents routed to them for approval
Manually add approvers to documents on an ad hoc basis
Delete approvers that s(he) has manually added
Perform desktop receiving (entered by Requester)
Be added as an ad hoc approver or watcher
Be selected as an On-Behalf-Of user
Receive e-mail notifications and To-Do items

2014-2015 SAP AG or an SAP affiliate company. All rights reserved. Customer 6

Basic User Group Structure

Standard groups exist combining Application Area and Access Level

Each access level grants a unique set of permissions, which does not
necessarily grant all permissions of a lesser Access Level

Application Area Access Level

Contract Administrator
Invoice Manager
Payment Agent
Purchasing User
Receiving

2014-2015 SAP AG or an SAP affiliate company. All rights reserved. Customer 7

Shared Upstream/Downstream Groups

The following groups are shared between Upstream and Downstream

products; users in these groups will have combined permissions for all
applications.
Contract Administrator
Contract Agent
Contract Manager
Customer Administrator
CustomerDashboardAdmin
CustomerUserAdmin
Procurement Agent
Senior Analyst
Supplier Manager
Procurement Project Creator
Procurement Project Requestor

2014-2015 SAP AG or an SAP affiliate company. All rights reserved. Customer 8

User Group Assignments by Purchasing Unit

Controls Transaction Visibility

John
(Reporting and Searching)
Kathy Purchasing Unit A
Approval routing to specific individuals Helen
that perform a similar role Seth
Mary
Managed via the ResponsibleUser.csv Purchasing Unit B
Val
file or the User Profile UI
John
Karen
Wilma Purchasing Unit C
Helen

Purchasing Agent

NOTE: Basic end users (typically Purchasing User) can only view
documents owned by themselves and their subordinates.

2014-2015 SAP AG or an SAP affiliate company. All rights reserved. Customer 9

Custom Groups

How are they used?

Utilized for approval routing
Occasionally utilized for customization purposes (validations, field visibility, etc.)
Can be used for Catalog Views

No permissions are associated with custom groups.

2014-2015 SAP AG or an SAP affiliate company. All rights reserved. Customer 10

Parent/Child Groups

A new group can be created as the child of other group(s)

Child group inherits permissions of parent group(s)

Indirect user group assignment (via subgroup) also impact approval

routing and notifications

Sometimes used to better align to centralized security administration

processes and systems, e.g. LDAP or Active Directory, expecting a single
role per user

Relationships can be managed via files or in the User Manager UI

Purchasing Purchasing Report Buyer Only
Agent Manager Manager IT Catalogs

Acme Acme Acme Acme

Buyer Buyer Buyer Buyer

2014-2015 SAP AG or an SAP affiliate company. All rights reserved. Customer 11

Specific User Groups

The following slides contain details for User Groups commonly utilized by
customers. They are intended only to generate conversation and provide
initial guidance.

For a comprehensive list of Groups and associated Permissions, always

refer to the latest Product Documentation.

Each group should be evaluated for applicability in a customer-specific

context.

2014-2015 SAP AG or an SAP affiliate company. All rights reserved. Customer 12

User Group Documentation

Ariba Groups and Notifications Reference Guide

2014-2015 SAP AG or an SAP affiliate company. All rights reserved. Customer 13

User Group Documentation (Cont.)

Directly in application in User Manager

User Groups Template (Excel Workbook from Deployment Team)

2014-2015 SAP AG or an SAP affiliate company. All rights reserved. Customer 14

Customer Administrator Group

Customer Administrator
Special group with system administration permissions, including data
import/export
Each customer should designate a small number of well-trained users to fill this
role
Customer Administrator is able to see all transactional data in the system

IMPORTANT: For a Suite Integrated customer, a user in this group has permission
to perform both Upstream and Downstream administration.

2014-2015 SAP AG or an SAP affiliate company. All rights reserved. Customer 15

Purchasing Groups

Purchasing User
Typically assigned to every system user
Grants ability to create Requisitions and run reports for themselves and their subordinates
Can create Change Orders for their own POs

Purchasing Agent
Typically in the role of a Buyer
Typically approve/facilitate non-catalog Requisitions
Responsible for Mark Ordered function for manual orders
Receive a lot of e-mail notifications

2014-2015 SAP AG or an SAP affiliate company. All rights reserved. Customer 16

Purchasing Groups (Cont.)

Purchasing Manager
For Super Users within a Purchasing Department
Have ability to create Change Orders and Cancel other users POs
Can Reopen POs
Can search all transactions (within Purchasing Units), e.g. invoices, receipts, collaboration
requests
Can edit/delete comments and attachments
Can Force Cancel approvable documents
For some organizations, users may be in both Purchasing Agent and Purchasing Manager
group
Purchasing Administrator
Should be granted cautiously, as these users can Remove approvers
Users in this group should probably also be in Purchasing Manager

2014-2015 SAP AG or an SAP affiliate company. All rights reserved. Customer 17

AP Groups

Invoice Agent
For AP Generalists that create manual Invoices and reconcile many Invoice Exceptions

Invoice Entry User

Not necessary if Invoice Agent is used
Can be used if different users are responsible for Invoice Entry and Invoice Reconciliation

Invoice Entry User (PO-Based and Contract) and Invoice Entry User (Non-PO)
Provide ability to limit which users can enter Non-PO Invoices

2014-2015 SAP AG or an SAP affiliate company. All rights reserved. Customer 18

AP Groups (Cont.)

Invoice Manager
For AP Superusers
Powerful, should be granted cautiously
Has ability to edit Invoice Exception Type configuration

Invoice Administrator
Provides ability to Force Reconcile or Force Pay (only for system issues)
Provides ability to remove approvals on Invoices and IR documents
Should be granted with caution

2014-2015 SAP AG or an SAP affiliate company. All rights reserved. Customer 19

AP Groups (Cont.)

Invoice Exception Processor

Grants ability to reconcile any type of Invoice Exception routed to them, incl. Tax
Exceptions
Commonly granted to all users in Invoice Agent group
Sometimes granted to Purchasing or End Users, if expected to handle Invoice Exceptions
Invoice Referral Specialist
When users refer an Invoice Exception, users in this group will always be available to
select
Controls only the Refer To user list; the ability to Dispute or Accept those exceptions is
granted by other groups
Financial Processing Analyst
Can Query All transactions (within assigned Purchasing Units)
Commonly appropriate for AP resources
May also include Accounting, Finance, or Executive users

2014-2015 SAP AG or an SAP affiliate company. All rights reserved. Customer 20

Contract Groups

Contract Agent
Users who will be creating Contracts, including Blanket Purchase Orders

Contract Manager
Can query all Contracts
Often included in Contract Approvals
If a small group, the same people may be granted Contract Agent and Contract Manager

Contract Administrator
Provides ability to remove approvals on Contract Requests
Should be granted with caution

2014-2015 SAP AG or an SAP affiliate company. All rights reserved. Customer 21

Reporting Groups

Report User
Grants ability to run reports for themselves and their subordinates
Typically unnecessary, as Purchasing User grants the same reporting capabilities, except
Schedule Reports

Report Manager
Reporting superusers
Can run reports on enterprise wide data
Can modify prepackaged and create custom reports
Recommend identifying a small number of reporting experts, both for central administration
team and key business users

Report Administrator
Access to a few tasks such as advanced report scheduling
Recommended for central administration only

2014-2015 SAP AG or an SAP affiliate company. All rights reserved. Customer 22

Procurement Workspace Groups

Procurement Project Requestor

Only users who belong to this group will be able to create the Procurement
Project Requests
Procurement Project Creator
Only users who belong to this group will be able to create the Procurement
Workspace

Procurement Project Requestor should be added to the Procurement

Workspace team
Only users that have the ability to create Procurement Workspaces will
see the Project links from the Requisition screen
The requestor will be able to see the Procurement Workspaces if they
are a team member.

2014-2015 SAP AG or an SAP affiliate company. All rights reserved. Customer 23

Special Groups

No Ad-Hoc Item
End users can be prevented from creating non-catalog requisitions by
adding them to this group

No Escalation
This group can be assigned to users that should not receive approvals
based on time-based escalations
This does not prevent users in this group from receiving approvals for
other reasons, including Approval Limit

No Supervisor
A user in this group is not required to have a Supervisor

2014-2015 SAP AG or an SAP affiliate company. All rights reserved. Customer 24

Special Groups (Cont.)

Finance
Certain out-of-the-box approval rules route to this group as a fall-back.
For example, if no user in the approval chain has sufficient Approval
Limit, Finance will be added
Recommended to assign at least one user to this group
P2P Authorized
If certain users only need access for approval purposes, they should be
assigned to this group (regardless of product)
Catalog Approver
Catalogs are typically approved by this group
Recommended to assign at least one user to this group

2014-2015 SAP AG or an SAP affiliate company. All rights reserved. Customer 25

Next Steps

Review User Group Documentation and identify applicable groups

Define Business Roles and map to User Groups; establish tool to
manage this mapping during implementation and beyond
Determine if departments need to identify users for specific
groups; develop data collection template and communication
Establish at least a subset of users with appropriate groups in test
site

2014-2015 SAP AG or an SAP affiliate company. All rights reserved. Customer 26

Thank you

2014 SAP AG or an SAP affiliate company. All rights reserved.

FPC Appendix
Federated Process Control (FPC)

In a FPC scenario, there are multiple child realms that belong to one
parent realm.

Shareable
Data
Parent
Realm

Child Child Child

Realm 1 Realm 2 Realm n..

ERP 1 ERP 2 ERP n..

Master Data
Transactional Data
Configuration/Rules Data

2014-2015 SAP AG or an SAP affiliate company. All rights reserved. Customer 29

FPC Scenario

What does this mean for User Data Loads?

Shareable
Data
Parent
Realm

Child Child Child

Realm 1 Realm 2 Realm n..

ERP 1 ERP 2 ERP n..

Master Data
Transactional Data
Configuration/Rules Data

2014-2015 SAP AG or an SAP affiliate company. All rights reserved. Customer 30

FPC Scenario

Common Data vs. Partitioned Data

Common Data refers to Master Data files that are generally specific to Ariba
and ERP agnostic.
Used primarily to enable Ariba functionality

Partitioned Data refers to Master Data files that Ariba shares with ERP
systems.
These data elements generally refer directly to data elements present in ERP
systems.
Part of Integration Exports from Ariba.

2014-2015 SAP AG or an SAP affiliate company. All rights reserved. Customer 31

FPC Scenario

Common Data Files in Question:

SharedUser.csv
GroupSharedUserMap.csv
UserParentGroup.csv
GroupParentGroup.csv
GroupChildGroup.csv
SharedUserSupervisor.csv

2014-2015 SAP AG or an SAP affiliate company. All rights reserved. Customer 32

FPC Scenario

Partitioned Data Files in Question:

User.csv
SharedUserShipToAddressMap.csv
UserPCardMap.csv

2014-2015 SAP AG or an SAP affiliate company. All rights reserved. Customer 33

Scenario 1: Cross-Realm Reporting Mode

Parent and child realms communicate for reporting purposes only.

Common and Partitioned Data is separate for each realm.
All User and Groups data gets loaded independently in each child
realm.

2014-2015 SAP AG or an SAP affiliate company. All rights reserved. Customer 34

Scenario 2: Multi-Variant (MV) Mode

Child realms that subscribe in MV mode will only have Common

inherited from Parent realm.
Thus, any data loaded in the following files at the parent will
replicate to these children:
i.e. SharedUser.csv entries loaded at parent will come down to a child that subscribes with MV

Additional common data can also be added at the child realm level.
i.e. I can load a SharedUser.csv with additional entries at the child realm as well.

No Partitioned Data is inherited.

2014-2015 SAP AG or an SAP affiliate company. All rights reserved. Customer 35

Scenario 3: Single-Variant (SV) Mode

Child realms that subscribe in SV mode will only have

Common and Partitioned data inherited from Parent realm.
Thus, any data loaded in either the Common or Partitioned
files at the parent will replicate to these children:
i.e. SharedUser.csv and User.csv entries loaded at parent will come down to a child that
subscribes with SV

Additional common data can also be added at the child realm

level.
i.e. I can load a SharedUser.csv and a User.csv with additional entries at the child realm as
well.

2014-2015 SAP AG or an SAP affiliate company. All rights reserved. Customer 36

Next Steps

Review User Group Documentation and identify applicable

groups
Define Business Roles and map to User Groups; establish
tool to manage this mapping during implementation and
beyond
Determine if departments need to identify users for specific
groups; develop data collection template and communication
Establish at least a subset of users with appropriate groups
in test site

2014-2015 SAP AG or an SAP affiliate company. All rights reserved. Customer 37

Thank you

2014 SAP AG or an SAP affiliate company. All rights reserved.