ZSR New Action Types Roles and Home Cost Center

1
ZSR New Action Types Roles and Home Cost Center

• August 5, 2009

2
ZSR New Action Types

• Introduction
• Overview of ZSR Process
• Changes and Improvements
• How-To
• Using the ZSR - SAP Roles Action Type
• Using the ZSR - Home Cost Center Action Type

3
Table of Contents
4
ZSR is now a One Stop Shop for SAP Security!

• The transaction that has been used for requesting
  other SAP privileges is now expanded to include
  requests to Add and/or Remove SAP Roles
• ZSR now allows updates to the "Home Cost Center"
  which determines the routing of some SAP
  workflows
• The ZSR is the One Stop Shop for these Action
  Types
• SAP Roles
• BW Roles with CC/IO Security Assignments
• Workflow Responsibility Assignments
• Additional Org Unit Security Access (Z61)
• Maintain Home Cost Center for
  Workflow Routing

New
New
5

• ZSR Process Overview

ZSR Initiator makes Request
Request includes Roles or "Z61" HR relationships
outside Users Business Area
Additional Outside Business Area Approval
Workflow and BW do not yet have an outside ZSR
approver
ZSR Approval Routed by Initiators Home CC
Approved ZSR Request
Automatic updates daily
No additional approvals required
Request includes Restricted Roles?
Additional Role Owner Approval
6
Changes to ISR Processes
The ZSR includes an action type to update the
Position Home Cost Center, which can also still
be updated using a Position Maintain ISR.
7
Usability Improvements with the ZSR

• Role selection by type
• Standard R/3 and SRM Roles
• BW Roles
• Restricted Roles (requires additional approval)
• Portal Roles (usually assigned automatically,
  rarely requested)
• Accompanying roles automatically assigned
• (e.g., technical and portal roles needed for
  functional roles to operate properly)
• Copy capabilities
• From one Position to another
• From a previous ZSR Request

8
Internal Control Improvements with the ZSR

• Automatic update/assignment of fully approved
  requests
• Validations to prevent key role conflicts
• Enhanced and fully automated ZSR workflow
  approvals
• ZSR routed to the appropriate ZSR Approver
  determined by the Home Cost Center of the
  subject User
• Additional approval for R/3 roles and Z61
  requests for access outside of Users Business
  Area
• Future for BW and Workflow assignments
• Restricted Role Owner approval for roles normally
  reserved for central departments such as Shared
  Service Centers and Controllers' Offices
• More accessible maintenance of Home Cost Centers
  to ensure proper routing of certain workflow
  transactions

9
Requesting SAP Roles Using the ZSR
10
Getting to the ZSR
You can enter ZSR in the command box and hit enter
OR
Go into the SAP Easy Access menu in R/3 Under
Security and Workflow One Stop Shop Requester
Select ZSRSecurity Roles and Workflow Request
11
Roles Action Type
Enter SAP User ID
Select the Action Type SAP Roles
12
Create Request
Click Create Request Button to go to the next
screen
Tip
The ZSR displays accurate and useful information.
So, you can use this screen with any action type
to DISPLAY the access of any User. You still
click Create Request, but then you wont Submit
the Request.
13
Add and Remove Roles
This section shows the roles currently assigned
to the user
Click here to delete roles
The Role Type Pull Down has 4 choices which
filters the roles for each type
14
Selecting Roles
In this example, the Standard Role Type was
selected. In the Role technical name pull down,
only standard roles will be displayed.
Double click on any line to make your selection
15
Searching for a Role
By clicking the binoculars you can enter
search criteria for the role you are looking for,
using asterisk for wildcard, the first role
matching your criteria (if found) will be
highlighted. To search for additional roles
meeting the criteria, Click the binoculars with
the
Tip
16
Selecting a Standard Role
A standard role has been selected
17
Selecting a Restricted Role
In this example, the Role Type Restricted has
been selected
These Restricted Roles require additional
approval by the Role Owner
18
Saving the ZSR Request
Click Save Request to continue to the summary
screen
A Standard Role and a Restricted Role have been
selected
19
Request Comments
Restricted Roles require comments on the specific
role, so that the Role Owner/Approver can review
the justification for the request
Comments can be added to any row to describe the
reason for any individual role, as needed
Comments may also be added to provide
information about the entire request
20
Summary Screen
The summary screen shows all Roles that are being
requested and allows for comments to be added
Click Submit Request to Save the Request and
submit to Workflow
21
Role Validations Error Messages

• Conflicts see example next page
• Certain combinations of roles are not allowed to
  be assigned to the same User. An error message
  with the technical name of the first role will be
  displayed and the second role will appear in red
  if you request two conflicting roles or a role
  which conflicts with an existing role.
• Duplicates User already has the role
• Roles Not Currently in Use
• There are very rare cases where you may see the
  error message below, by requesting a role that is
  not intended to be assigned. This will only
  happen if
• You manually enter a role name, since these roles
  will not be displayed in the lookup
• You use ZSR Position Copy and the Position you
  use as your source to copy already has the role

22
Role Conflicts
This is an example of two roles that are not
allowed to be assigned to the same user. If you
request the two roles together OR if you already
have one of the roles and are requesting the
other, you will see an error message like this
To clear this error, you have to manually delete
the contents of each field (Role Type, Technical
Role Name and Display Role Name)
23
Accompanying Roles
Certain roles require portal roles or other
"behind the scenes" roles to operate correctly.
On the summary screen, you will see these type of
accompanying roles added to your request and
listed as derived (DRVD).
In this example, one BW role was requested and
the other four roles were added to the request
24
Requesting Changes to Home Cost Center using the
ZSR
25
Maintain Home Cost Center Action Type
This Example will show how to request changes to
a Users Home Cost Center
Enter SAP User ID
Select the Action Type Maintain Home Cost Center
for Workflow Routing
26
Home Cost Center Screen
User's current Home Cost Center
Enter the new Cost Center or choose from the
pull-down list
27
Save Home Cost Center Request
Click Save Request to continue to the summary
screen
New Home Cost Center has been selected
NOTE The Home Cost Center is used to route
workflow requests and does not impact payroll or
labor distribution postings.
28
Submit Request
Hit Submit Request to Save the Request and
submit to Workflow
After you Save your request, but before you
Submit it, you may click Modify Request to make
changes and/or add other Action Types to the
Request
Before submitting, you may enter comments
29
ZSR Workflow and Approving ZSR Requests
30
ZSR Workflow Routing

• Home Cost Center ZSR Approver (Approver 1) for
  all action types reviews the whole request and
  can approve or reject each line item
• Additional Approvers (Approver 2) applies to
  Roles and Z61 action types will see only the
  line items they are responsible for approving or
  rejecting based on the following
• Roles (or Z61 relationships) specific to a
  business area outside of the subject User's
  business area are routed to the designated ZSR
  Approver for the requested business area
• Restricted roles are routed to the Role Owner for
  their authorization due to the restricted nature
  of the role

31
ZSR Approver Screen

• The approval screen appears with a checkmark
  by default, for each role. If Approver
  authorizes the role as appropriate, no further
  action is required on the individual line items.
• To reject roles
• Individual roles- uncheck Approved checkbox for
  specific line(s)
• All roles on the request click the Reject All
  button to uncheck all roles (still
  requires Submit)

After all line items are reviewed and Approved or
Rejected, click Submit
The Approver may include comments on any role
(line item) or, in general, on the Approver
Comments for the whole request
32
ZSR Report
To see a report of ZSR Requests, fill in search
criteria. In this example, we are searching by
all requests created on 02/20/08. After you
select your search criteria, click on the green
check mark with the clock. This will run the
report.
33
Tracking Requests with the ZSR Report
Heres a list of all requests created on that
particular date. You can see the ZSR Number,
Approval Status, etc. To choose one, highlight
it and double click.
34
ZSR Report and Approval Status
APPRCOMPL request is fully approved APPRLVL1 -
request has been approved by Approver 1, but is
still awaiting an Approver 2
Lines marked APPRVCOMPL with an Initiator
DERIVED indicate this is an accompanying role
assigned automatically
All ZSR Approval Statuses
35
ZSR Report and Update Status
For each ZSR request, each action type will
display one line on the initial ZSR Report. Click
any line to drill down to view the individual
line items for that action type. Scroll over to
the right to see details about the line item (in
this example, the Role Name)
The Update Status indicates if SAP has been
updated with the assignments or changes Blank
awaiting update S successful update F failed
update (EBS monitors failures daily)
36
Reminder Tips for Tracking your ZSR Workflow

• For the Initiator to determine who is the
  Approver on the request, use Workflow Outbox and
  double-click on the ZSR Request
• Click Log and then, once you locate
  the request, click on Agent icon
  and then click Agents to see the name of Approver
  1
• To identify the Restricted Role Owners whose
  approval is needed go to the Knowledge Network
  SAP Support Center Security section
• Once the Approval Status is APPRCOMPL (Approved
  Completed) and the Update Status is S
  (Successful), the assignments and updates are
  made and user will have the access effective the
  following day (after a series of overnight jobs)

37
Future ZSR Enhancements

• More enhancements and features are planned!
• Based on the feedback we receive and other
  priorities, some potential improvements for
  future consideration are
• Additional approvals for BW and Workflow
  assignments outside of User's business area
• Automatic routing to a higher level approver for
  ZSR Approvers who cannot approve their own
  requests
• Improved error messages
• Improved search capabilities
• Single requests for updating multiple users
• Action type for assigning Workflow Substitutes