BLOG | Finance | SAC
Streamlining Security Management in
SAP Analytics Cloud (SAC)
16 October 2024
Emiliyan Tanev,
Managing Principal SAC Consultant at Decision Inc. UK
When developing solutions for SAP Analytics Cloud (SAC), one of the key requirements is creating a robust security architecture that works seamlessly across teams and users and is straight-forward to maintain. The standard security toolset available in SAC can be effective for basic models, but when deployed on a more functional multi-dimensional model has limitations.
At Decision Inc., we have developed a security solution that addresses the key pain points in managing security within more functional SAC models. The solution focuses on simplifying how access is managed across multiple dimensions and ensuring sensitive data remains protected.
Security Architecture
Security for Planning models is typically defined around the following principles:
- Roles – What users can do in the system, e.g. Cost Centre Manager & Planner
- Users / Teams – What companies, profit centre or lines of business they are responsible for
These elements are usually managed across the following dimension in the solution architecture:
- Version: Assigned based on the user’s role represented by the team in the process, ensuring users only interact with the correct version.
- Audit Trail or Data Source dimensions: Governs what teams can do in the system in terms of inputs and calculations. For example, we can guard entries made by top-down vs. bottom-up planners and still have a unified result.
- Entity-Type dimensions: Includes Cost Centre, Profit Centre, Company, Business Area, Functional Area, Lines of Business, Product Grouping, and Sales Teams, which determine what data users have access to. In some cases, we use teams to manage this access where more practical.
This approach enables tight control over key data sources and calculations while allowing for focused input as appropriate.
Security Approaches and Limitations
SAC offers two approaches to secure the data:
- Model Data Privacy via Security Roles has real limitations as security cannot be assigned at parent member levels, which restricts the usability of this approach.
- Data Access Properties, maintaining security via the dimension properties using Read-Only and Write in the security-relevant dimensions. For detailed dimensions it can be onerous and impractical to review security attributes on all members on all relevant dimensions.
Therefore, this blog post focuses on a solution which leverages the Data Access Properties approach, alongside a Security Cockpit (App) to enable an efficient and controlled management of SAC security.
Lead large, T&M and fixed cost implementations, and manage the achievement of build on time, to budget, and with the expected quality. Define project roles and responsibilities and identify and secure required resources.
Challenges with Security
One of the primary issues we face in SAC is the effort required to maintain secure dimensions. For example, if we are securing multiple dimensions such as Functional Areas, Lines of Business, Product Groups, Cost Centres, or Profit Centres, it becomes cumbersome, especially when managing hundreds or even thousands of users.
- Manual Updates: For each user, you may need to maintain their access across multiple secure dimensions. With 100+ users, this becomes complex and time-consuming.
- Excel-Based Analysis: Currently, to understand what access a user has, admins must export data to Excel, split properties (separated by semicolons), and then manually inspect or update user access – a manual and very inefficient process.
Screenshot of manual update of attribute in detailed dimensions:
Cost Centre
PRODUCTS
Introducing Decision Inc.’s Solution: Simplified Security Management (DSSM)
At Decision Inc., we’ve created a custom solution to address these security challenges in SAC. The DSSM solution provides:
- A Grid View: You can now see each user (or team) and their respective access across different dimensions in a structured table. Each user or team has a row, and the columns represent the dimensions and members they have access to.
- Easy Access Control: This grid makes it easy for admins to quickly check and manage what users have access to without manually splitting or managing manual Excel files.
- Bulk Updates: For larger user bases, there is an option to update via upload of Excel file, allowing for bulk updates to security settings. This can be used in tandem with approval processes to ensure security updates are handled efficiently.
DSSM – Grid View of Security
Solving the Key Pain Points with DSSM
At Decision Inc., we’ve created a custom solution to address these security challenges in SAC. The DSSM solution provides:
- User Visibility: Instead of manually filtering user permissions through Excel, DSSM allows admins to view, edit, and update user access in a single security area.
- Streamlined Maintenance: With DSSM, you no longer have to deal with multiple secure dimensions or complex properties. Everything is presented in an easy-to-manage grid, making the security management process much more efficient.
- Bulk Operations: The ability to import from Excel and perform bulk updates makes it easy to maintain security for large groups of users, reducing manual effort and the risk of error.
SAP Analytics Cloud is SAP’s leading tool for Planning and has great potential for modernising planning processes. However, managing security in particular for a large user-base can be complex, manual and time-consuming. DSSM streamlines this process, making it simple for administrators and security teams to manage security efficiently without sacrificing control or flexibility.
If you are facing similar challenges with your SAC environment, DSSM could save you countless hours, improve overall security management and minimise the risk of manual processing.
Contact Decision Inc. for private demonstration of DSSM or to learn about how we can help you with your SAC solutions for planning and analytics.