As part of this blog, I will be showing how the Datasphere new feature Scoped Roles can be used in different enterprise scenarios. Please note that the sample scenarios shown here may not fit AS IS to all the scenarios within your organization but could act as an inspiration for using the scoped roles within Datasphere.

Also, you can also refer to the previous blogs, as mentioned below, to get more details about this feature.

• Preliminary Information SAP Datasphere – Scoped Roles
• Practice Recommendations: How to Effectively Implement Scoped Roles in SAP Datasphere | SAP Blogs

Note:This feature is shipped on 17^th of October 2023 for SAP Datasphere tenants in Asia Pacific Region. On October 31^st 2023 it will be shipped for SAP Datasphere tenants in American and European landscapes.

In first case, let us assume, Company ABC LTD wants to govern their users Centrally via scoped roles for centrally managing the DWH functions like Integration, Modelling, Consumer etc. , as shown below.

Fig1: Scenario 1 – Centralized, All or Nothing

From above diagram, below scoped roles could be used by the company ABC LTD within their DS landscape.

Steps to follow when creating new Users:

For creating the new users, tenant admin needs to follow below steps:

• In User management UI,create new users and assigned the respective scoped roles. For example – if there are new employees’ addition within the Central Integration team then the scoped role SRC_Integration will be granted to them.
• Alternatively, users can be assigned Centrally governed scoped role in the Role management UI based on their role within an organization.

In second case, let us assume that for company XYZ LTD, wants to restrict and fine tune the access at the space level for each department for example Sales and Finance.

In Datasphere, this can be achieved using 2 approaches – Centralized and Decentralized.

•   Centralized approach

Fig2: Scenario 2 – Centralized Approach

From above diagram, we see that a separate scoped role is created for the different Business department across different DWH functions, as explained below:

Steps to follow when creating new Users: 

• In User management UI, create new users and assign respective scoped roles. For example, new Sales Business Analysts will be assigned Scoped role SRC_Sales_Viewer whereas Finance Business Analysts will be assigned Scoped role SRC_Finance_Viewer.
• Alternatively, users can be assigned scoped role in the Role management UI based on their role within an organization.

•   DeCentralized approach

As an alternative to above scenario, decentralized approach can also be used. In this approach, a tenant admin will create a single scoped role for each DWH function but will isolate the user access between employees from different departments by assigning the respective spaces during user assignment in the scoped role.

Also, tenant admin can delegate the responsibility to a space admin for assigning the roles to user via space management UI.

Fig3: Scenario 2 – Decentralized Approach

From above diagram, we see that below roles are used by the company XYZ LTD in their DS landscape.

Steps to follow when creating new Users:

• In User management UI, new users will be created without any role assignment.
• Then these users will be added to the decentralized scoped role by tenant admin in the Role management UI and relevant scope will be selected for them. For example, new Sales Modelers will be assigned scope Sales, Deliveries, Invoicing and Orders whereas Finance Modelers will be assigned scope to the spaces Finance, AP,AR and GL using same scoped role during user assignment in the scoped roles.
• Users will get the relevant privileges and permissions on the specific spaces granted within scoped roles.

Alternatively, Tenant admin can delegate a space admin to grant access to the spaces as explained below.

Use of Space admin:

• Here, Tenant admin will assign the scoped role of space Admin to the relevant users.
• In our scenario, we have different admin teams – SALES ADMIN, FINANCE ADMIN, INTEGRATION ADMIN, , MDM ADMIN. Therefore, tenant admin will assign the relevant scope to the space admin based on his profile instead of assigning all the scopes to a single admin. For example SALES ADMIN team will only be assigned scopes Sales, Delivery, Invoicing, Orders during user assignment within the scoped role SRD_Space_admin.
• After this a space admin can assign the relevant scoped roles to the users via space management UI. For example – Sales Modelers can be added as members in the spaces Sales, Deliveries, Invoicing and Orders via Space Management UI by Sales ADMIN and Finance Modelers can be added to spaces Finance, AP,AR and GL via Space Management UI by Finance ADMIN using the scoped role SRD_Modeler.

• Let say if we are following Centralized Approach for different departments and creating similar roles like SRC_SALES_MODELER and SRC_FINANCE_MODELER can be headache. To overcome these existing roles can be copied without user or scope assignment using Save As option in the role management UI and then we can assign new spaces as scope along-with relevant users assignment to the copied roles .
• If you are an existing Datasphere customer then as part of scoped roles rollout, your existing global or custom roles will be migrated into new scoped roles as mentioned below:

• • For each Standard Datasphere rolewith Space-specific privileges, “DW Standard_role”, a new Scoped Role “DW Scoped (Standard_role)” will be created.
  • For each Custom role “Custom_role” a new Scoped Role “(Custom_role)_SAP_Scope” will be created with a description “Created during SDP conversion”.

Based on your past strategy, you might be able to use these converted roles without any tweaks for any of the above highlighted scenarios.

This blog introduced you to the different scenarios in which scoped roles can help.

Thanks for reading! I hope you find this blog helpful. For any questions or feedback just leave a comment below this post. Feel free to also check out the other blog posts in the series.

Best wishes,

Jai Gupta

https://blogs.sap.com/2023/10/02/sap-datasphere-scoped-roles-conversion/#:~:text=In%20October%202023%20a%20fundamental,SAP%20Datasphere%20on%20Space%20level.

Find more information and related blog posts on the topic page for SAP Datasphere .