Users, Roles and Role Collections
The authorization model (View, Edit, Process per object), the shipped role collections, building your own collections, the identity provider and the Support Operator role.
Draft brief for authors. Section page, the equivalent of SAP's "Business Roles and Catalogs".
Source in the product repository: customer guide §4 "Role collections" and "Roles per object"; xs-security.json; .claude/rules/licensing-and-roles.md.
In this section
- The Authorization ModelThree duties per business object (View, Edit, Process), object roles and add-on bundles, licensing and roles both checked, and what a refused user sees.
- Shipped Role Collections and RolesThe Viewer and Manager collections per add-on, the Support Operator collection, and the object roles per family that the subscription adds to your subaccount.
- Building Your Own Role CollectionsSeparate uploading and editing from posting to SAP, or narrow a user to a few objects, by composing a collection from the object roles.
- Identity Provider, Single Sign-On and Sign OutUsers sign in through your subaccount's identity provider; map its groups to role collections; Sign Out ends the session in MDM, the subaccount and the provider.
- The Support Operator RoleWhat your support staff can see with the MDM Support Operator collection: the technical twins of the history, diagnostics and the on-demand purge, and what it cannot do.
Last updated: