Sap Analytics Cloud – User and Operating Concept

Organizational structure

When starting to use SAC at your company, you must also decide how to map its organizational structure in SAC. A concept for structure in SAC serves as a basis for demarcating enterprise areas in terms of organizational and procedural aspects, for example. The following approaches are available for this type of structuring in SAC:

• Teams
• Folder structure

Teams can be used to organize users and differentiate between them. Such teams allow SAC users to be organized into logical groups. At the team level, it is possible to assign different object permissions, for example, for models, stories, analytic applications and folders. All users in a group then automatically receive access rights assigned to that group.  This option simplifies authorization updating, which does not have to take place at the user level.

With an appropriate folder structure, you can make created content and objects available to users as well as teams in an orderly manner according to the organizational structure. Using permissions for teams, you can furthermore assign individual folders to the teams. Folder structures are meant to allow effective as well as efficient storage and management of content. Such structures facilitate administration as well as transport of content and objects, especially during deployment of several tenants (development, quality assurance, production). They should therefore be designed already when use of SAC is commenced. The folder structure you establish might appear as illustrated next.

‍

Operating concept

The operating concept defines, as an extension of organizational structure, the capabilities and rights to be made available to users in SAC. The focus is initially on conception and creation of users in SAC. Firstly, SAC can be operated completely independently with its own user concept. In addition to manual user creation, it is secondly possible to take over user information from other systems. This can be done via copy & paste, import of CSV, import via an active directory, or automatically via SSO.

Created users are subsequently furnished with respective licenses according to the purchased license models. Assignment of licenses can be modified later as required. The following licenses are available, each one's functions also being offered by the next one:

1. Business Intelligence – data discovery, story creation and viewing, reporting
2. Planning Standard – entry of data into planning models (+ functions from 1.)
3. Planning Professionals – creation of planning models (+ functions from 2.)

A role concept allows you to finely distribute responsibilities and authorizations. Roles are used here, in particular, to control access to SAC functions. Standard roles existent in SAC can be extended by your own manually created roles. Roles here offer the following types of settings and authorizations for functions:

• Reading
• Execution
• Updating
• Editing
• Deletion
• Creation
• Release

Access and protection

The ability to control access to models and data via related access and protection settings allows flexible authorization without necessitating changes in the operating or role concept.

The following functions offer a wide range of settings for model permissions:

• Enabling data auditing makes it possible to record and track data changes in planning models.
• Enabling validation rules makes it possible to check the correctness of data input into planning models.
• Enabling a data lock allows users to lock individual cells.‍
• Export restrictions can be used to prohibit export of data from individual models.
• Enabling data protection for models makes it possible to grant access to models only by model owners and users possessing appropriate roles.‍
• Data access control can be used to manage read and write access at the dimension level