Title: ZSR New Action Types Roles and Home Cost Center
1ZSR New Action Types Roles and Home Cost Center
2ZSR New Action Types
- Introduction
- Overview of ZSR Process
- Changes and Improvements
- How-To
- Using the ZSR - SAP Roles Action Type
- Using the ZSR - Home Cost Center Action Type
3Table of Contents
4ZSR is now a One Stop Shop for SAP Security!
- The transaction that has been used for requesting
other SAP privileges is now expanded to include
requests to Add and/or Remove SAP Roles - ZSR now allows updates to the "Home Cost Center"
which determines the routing of some SAP
workflows - The ZSR is the One Stop Shop for these Action
Types - SAP Roles
- BW Roles with CC/IO Security Assignments
- Workflow Responsibility Assignments
- Additional Org Unit Security Access (Z61)
- Maintain Home Cost Center for
Workflow Routing
New
New
5ZSR Initiator makes Request
Request includes Roles or "Z61" HR relationships
outside Users Business Area
Additional Outside Business Area Approval
Workflow and BW do not yet have an outside ZSR
approver
ZSR Approval Routed by Initiators Home CC
Approved ZSR Request
Automatic updates daily
No additional approvals required
Request includes Restricted Roles?
Additional Role Owner Approval
6Changes to ISR Processes
The ZSR includes an action type to update the
Position Home Cost Center, which can also still
be updated using a Position Maintain ISR.
7Usability Improvements with the ZSR
- Role selection by type
- Standard R/3 and SRM Roles
- BW Roles
- Restricted Roles (requires additional approval)
- Portal Roles (usually assigned automatically,
rarely requested) - Accompanying roles automatically assigned
- (e.g., technical and portal roles needed for
functional roles to operate properly) - Copy capabilities
- From one Position to another
- From a previous ZSR Request
8Internal Control Improvements with the ZSR
- Automatic update/assignment of fully approved
requests - Validations to prevent key role conflicts
- Enhanced and fully automated ZSR workflow
approvals - ZSR routed to the appropriate ZSR Approver
determined by the Home Cost Center of the
subject User - Additional approval for R/3 roles and Z61
requests for access outside of Users Business
Area - Future for BW and Workflow assignments
- Restricted Role Owner approval for roles normally
reserved for central departments such as Shared
Service Centers and Controllers' Offices - More accessible maintenance of Home Cost Centers
to ensure proper routing of certain workflow
transactions
9Requesting SAP Roles Using the ZSR
10Getting to the ZSR
You can enter ZSR in the command box and hit enter
OR
Go into the SAP Easy Access menu in R/3 Under
Security and Workflow One Stop Shop Requester
Select ZSRSecurity Roles and Workflow Request
11Roles Action Type
Enter SAP User ID
Select the Action Type SAP Roles
12Create Request
Click Create Request Button to go to the next
screen
Tip
The ZSR displays accurate and useful information.
So, you can use this screen with any action type
to DISPLAY the access of any User. You still
click Create Request, but then you wont Submit
the Request.
13Add and Remove Roles
This section shows the roles currently assigned
to the user
Click here to delete roles
The Role Type Pull Down has 4 choices which
filters the roles for each type
14Selecting Roles
In this example, the Standard Role Type was
selected. In the Role technical name pull down,
only standard roles will be displayed.
Double click on any line to make your selection
15Searching for a Role
By clicking the binoculars you can enter
search criteria for the role you are looking for,
using asterisk for wildcard, the first role
matching your criteria (if found) will be
highlighted. To search for additional roles
meeting the criteria, Click the binoculars with
the
Tip
16Selecting a Standard Role
A standard role has been selected
17Selecting a Restricted Role
In this example, the Role Type Restricted has
been selected
These Restricted Roles require additional
approval by the Role Owner
18Saving the ZSR Request
Click Save Request to continue to the summary
screen
A Standard Role and a Restricted Role have been
selected
19Request Comments
Restricted Roles require comments on the specific
role, so that the Role Owner/Approver can review
the justification for the request
Comments can be added to any row to describe the
reason for any individual role, as needed
Comments may also be added to provide
information about the entire request
20Summary Screen
The summary screen shows all Roles that are being
requested and allows for comments to be added
Click Submit Request to Save the Request and
submit to Workflow
21Role Validations Error Messages
- Conflicts see example next page
- Certain combinations of roles are not allowed to
be assigned to the same User. An error message
with the technical name of the first role will be
displayed and the second role will appear in red
if you request two conflicting roles or a role
which conflicts with an existing role. - Duplicates User already has the role
- Roles Not Currently in Use
- There are very rare cases where you may see the
error message below, by requesting a role that is
not intended to be assigned. This will only
happen if - You manually enter a role name, since these roles
will not be displayed in the lookup - You use ZSR Position Copy and the Position you
use as your source to copy already has the role
22Role Conflicts
This is an example of two roles that are not
allowed to be assigned to the same user. If you
request the two roles together OR if you already
have one of the roles and are requesting the
other, you will see an error message like this
To clear this error, you have to manually delete
the contents of each field (Role Type, Technical
Role Name and Display Role Name)
23Accompanying Roles
Certain roles require portal roles or other
"behind the scenes" roles to operate correctly.
On the summary screen, you will see these type of
accompanying roles added to your request and
listed as derived (DRVD).
In this example, one BW role was requested and
the other four roles were added to the request
24Requesting Changes to Home Cost Center using the
ZSR
25Maintain Home Cost Center Action Type
This Example will show how to request changes to
a Users Home Cost Center
Enter SAP User ID
Select the Action Type Maintain Home Cost Center
for Workflow Routing
26Home Cost Center Screen
User's current Home Cost Center
Enter the new Cost Center or choose from the
pull-down list
27Save Home Cost Center Request
Click Save Request to continue to the summary
screen
New Home Cost Center has been selected
NOTE The Home Cost Center is used to route
workflow requests and does not impact payroll or
labor distribution postings.
28Submit Request
Hit Submit Request to Save the Request and
submit to Workflow
After you Save your request, but before you
Submit it, you may click Modify Request to make
changes and/or add other Action Types to the
Request
Before submitting, you may enter comments
29ZSR Workflow and Approving ZSR Requests
30ZSR Workflow Routing
- Home Cost Center ZSR Approver (Approver 1) for
all action types reviews the whole request and
can approve or reject each line item - Additional Approvers (Approver 2) applies to
Roles and Z61 action types will see only the
line items they are responsible for approving or
rejecting based on the following - Roles (or Z61 relationships) specific to a
business area outside of the subject User's
business area are routed to the designated ZSR
Approver for the requested business area - Restricted roles are routed to the Role Owner for
their authorization due to the restricted nature
of the role
31ZSR Approver Screen
- The approval screen appears with a checkmark
by default, for each role. If Approver
authorizes the role as appropriate, no further
action is required on the individual line items. - To reject roles
- Individual roles- uncheck Approved checkbox for
specific line(s) - All roles on the request click the Reject All
button to uncheck all roles (still
requires Submit)
After all line items are reviewed and Approved or
Rejected, click Submit
The Approver may include comments on any role
(line item) or, in general, on the Approver
Comments for the whole request
32ZSR Report
To see a report of ZSR Requests, fill in search
criteria. In this example, we are searching by
all requests created on 02/20/08. After you
select your search criteria, click on the green
check mark with the clock. This will run the
report.
33Tracking Requests with the ZSR Report
Heres a list of all requests created on that
particular date. You can see the ZSR Number,
Approval Status, etc. To choose one, highlight
it and double click.
34ZSR Report and Approval Status
APPRCOMPL request is fully approved APPRLVL1 -
request has been approved by Approver 1, but is
still awaiting an Approver 2
Lines marked APPRVCOMPL with an Initiator
DERIVED indicate this is an accompanying role
assigned automatically
All ZSR Approval Statuses
35ZSR Report and Update Status
For each ZSR request, each action type will
display one line on the initial ZSR Report. Click
any line to drill down to view the individual
line items for that action type. Scroll over to
the right to see details about the line item (in
this example, the Role Name)
The Update Status indicates if SAP has been
updated with the assignments or changes Blank
awaiting update S successful update F failed
update (EBS monitors failures daily)
36Reminder Tips for Tracking your ZSR Workflow
- For the Initiator to determine who is the
Approver on the request, use Workflow Outbox and
double-click on the ZSR Request - Click Log and then, once you locate
the request, click on Agent icon
and then click Agents to see the name of Approver
1 - To identify the Restricted Role Owners whose
approval is needed go to the Knowledge Network
SAP Support Center Security section - Once the Approval Status is APPRCOMPL (Approved
Completed) and the Update Status is S
(Successful), the assignments and updates are
made and user will have the access effective the
following day (after a series of overnight jobs)
37Future ZSR Enhancements
- More enhancements and features are planned!
- Based on the feedback we receive and other
priorities, some potential improvements for
future consideration are - Additional approvals for BW and Workflow
assignments outside of User's business area - Automatic routing to a higher level approver for
ZSR Approvers who cannot approve their own
requests - Improved error messages
- Improved search capabilities
- Single requests for updating multiple users
- Action type for assigning Workflow Substitutes