Question:
Hi,
What's the difference between Job roles and activity groups or profiles
Thanks,
Answer:
Job Role - All access required for the user to complete their JOb, and a user may have more than one job. Create in PFCG
Activity group - Created in PFCG and jould be job based - All access required for the user to complete their JOb, and a user may have more than one job
Profile - The accumulation of authorization that grant access to a user's job
Answer:
Also, Activity groups are no longer called Activity groups. They are now (4.6 and 4.7) called roles. The term Job roles is really more of a security model.
Answer:
The way I look at it is as follows:-
A Job role is a business process and is what a person is employed to do - this is regardless of system used.
A Task is an element of a Job role (like post an invoice), thus a Job role is made up of many tasks. This is both a business thing and part of the mapping from business to system transaction/activity.
A Role (or profile or activity group) in SAP comprise the system authorities to enable a person to do a Task.
So a person will (more than probably) need many Roles to do their Job role in SAP.
And yes I do appreciate that in SAP profiles are assigned to users rather than Roles - but it is easier (I believe) to keep the terminology simple.
Hope this helps
Answer:
There are different schools of though around this, personally I like to design at task level like Bazza described but build at Job level so users generally have 2 or 3 roles in total including any standard user functionality.
Answer:
Be extreamely careful with creating task roles rather than job roles as they can:
1. Cause you to exceed the user buffers for authorizations by loading redundant authorization all with the same values coming from the different task role. A single role eliminates this.
2. requires your organisazion to buy Larger servers to accommodate the excessive redundant authorizations
3. Increases the logon time for user as there are more records to load at logon.
4. Increases longterm role maintenance, Shear numbers game , Maintain one role or 6 roles to do the same, keep it simple.
5. Increases analysis time and makes it harder to determine which role to change or add tot he user thus increasing long term maintenance.
6. create cluttter on the user menu amd portal screens.
7. Increase the chance to violate your segregation of duties
.. and the list goes on...
Keep it SIMPLE. there is a lot that goes on behind the sceens that most do not observe that impacts system performance and long term maintenance.
SAP's tratment of access rights does not consolidate or eliminate duplicates, it loads everything assigned to the user. You can have numerious authrization all with the same object and same values waisting space that provide no benefit but must be maintianed.