---
title: "Users, Roles and Role Collections"
description: "The authorization model (View, Edit, Process per object), the shipped role collections, building your own collections, the identity provider and the Support Operator role."
source: "https://help.rikaiso.com/public-cloud/2026.2/users-and-roles"
edition: "public-cloud"
editionLabel: "S/4HANA Public Cloud"
version: "2026.2"
latest: true
language: "en"
section: "Information for Administrators"
updated: "2026-11-05"
---

# Users, Roles and Role Collections

> The authorization model (View, Edit, Process per object), the shipped role collections, building your own collections, the identity provider and the Support Operator role.

> **Draft brief for authors.** Section page, the equivalent of SAP's "Business Roles and Catalogs".

**Source in the product repository:** customer guide §4 "Role collections" and "Roles per object"; `xs-security.json`; `.claude/rules/licensing-and-roles.md`.

## In this section

- [The Authorization Model](https://help.rikaiso.com/public-cloud/2026.2/authorization-model.md): Three duties per business object (View, Edit, Process), object roles and add-on bundles, licensing and roles both checked, and what a refused user sees.
- [Shipped Role Collections and Roles](https://help.rikaiso.com/public-cloud/2026.2/role-collections.md): The Viewer and Manager collections per add-on, the Support Operator collection, and the object roles per family that the subscription adds to your subaccount.
- [Building Your Own Role Collections](https://help.rikaiso.com/public-cloud/2026.2/custom-role-collections.md): Separate uploading and editing from posting to SAP, or narrow a user to a few objects, by composing a collection from the object roles.
- [Identity Provider, Single Sign-On and Sign Out](https://help.rikaiso.com/public-cloud/2026.2/identity-provider.md): Users sign in through your subaccount's identity provider; map its groups to role collections; Sign Out ends the session in MDM, the subaccount and the provider.
- [The Support Operator Role](https://help.rikaiso.com/public-cloud/2026.2/support-operator-role.md): What your support staff can see with the MDM Support Operator collection: the technical twins of the history, diagnostics and the on-demand purge, and what it cannot do.