2.3 Proxy Management, Company System and Logo Settings, and Platform Feature Settings

2.3 Proxy Management, Company System and Logo Settings, and Platform Feature Settings

Quick Answer: Proxy lets one user (the proxy) act on behalf of another (the account holder). Administrators assign proxies in Proxy Management or in bulk with Proxy Import. Assignments are time-based and can be limited to modules. Instance-wide switches live in Company System and Logo Settings (for example who may assign proxies). A separate permission-controlled page, Platform Feature Settings, holds switches such as Hide Username in the UI.

Proxy: Concepts and Uses

If John is on vacation and Sarah acts for him, John is the account holder and Sarah is the proxy. One account can have several proxies, and one person can be proxy for many accounts. Administrators use proxy heavily to:

• test configuration by viewing the system as different users without logging in and out
• troubleshoot, by seeing exactly what an employee sees
• complete actions on an employee's behalf

In THR81, proxy is the standard way to verify Employee Central permissions and workflows. You proxy as an IT manager to check contact-data access, or as each approver to approve a workflow. SAP notes that when Private Data For Proxy Account Holder is deselected, the proxy does not see potentially sensitive information such as home address or compensation.

Assigning Proxies in Proxy Management

On Proxy Management, identify the proxy and the account holder, select the modules (or All Modules), set the date range, and save. Keep these rules in mind:

• The proxy can open, view, edit, and send any item in the account holder's account for the granted tools.
• You can specify whether the proxy may access the account holder's private goals. For Performance Manager forms you can pick a specific form template.
• With several proxies on one account, all can edit at once, and the last save overwrites the others.
• The audit trail clearly marks actions carried out by a proxy.
• Proxy rights are time-based. Start and end times use the local time zone of the proxy administrator who sets them, and they appear in reports such as the Proxy Assignment Change audit report.
• Proxy Now excludes assignments that have not started yet or have already ended.
• Users who assign their own proxies in personal settings can also set a start date, an end date, or both. Many customers require an end date for compliance.

To remove a proxy, use Look up Existing Assignments: search by proxy (all accounts they can access) or by account holder (all their proxies), then delete.

Proxy Import

Proxy Import uploads a CSV file to create and delete many assignments. Download the template from Action Search > Proxy Import. Columns include USERID, ASSIGNMENT_ID_USERID, PROXYID, ASSIGNMENT_ID_PROXYID, START_DATE and END_DATE (format yyyy-MM-dd HH:mm), All, Remove All, and one column per tool.

• Separate multiple proxies for one account holder with a pipe (|).
• Enter YES in All for every tool, in a tool column for that tool, or in Remove All to delete. Blank means NO.
• Assignment IDs are an alternative to user IDs. Leave USERID blank to use ASSIGNMENT_ID_USERID, and use ASSIGNMENT_ID_PROXYID together with ASSIGNMENT_ID_USERID.
• Errors (such as a missing column) fail the upload. Warnings (such as no YES in any module, several user IDs in one row, or mixing ID types) let the file upload but skip the proxy relationship for the affected rows.

Who May Assign Proxies

In Company System and Logo Settings, the option Disable Proxy access for users without Proxy rights decides the model:

• Checked: only administrators can grant and remove proxy access.
• Unchecked: every user can assign and remove their own proxies under Name menu > Settings > Proxy (Assign Proxy or Become Proxy). Administrators can still manage proxies too.

In Proxy Management, Enable Advanced Proxy Management (Proxy Now and Proxy Import) adds Proxy Now to the name menu. Always enable proxy lookup is another company proxy setting on the same page. SAP's exercise also warns that deleting an assignment does not necessarily end access: a user who holds the Proxy Management permission in RBP may still be able to proxy.

Company System and Logo Settings

These settings turn features on or off for all users. They do not grant access. Commonly used options include:

Workflow features also appear here, such as Allow delegatees to accept or reject a workflow delegation request and the option to skip the same single approver in consecutive steps (Chapter 9).

Platform Feature Settings

Access requires the Platform Feature Settings permission under Manage System Properties. Examples:

• Enable Secondary Login Feature: partners can reach the instance from Provisioning, if also enabled in Manage Support Access.
• Enable Upgrade Center Permission: controls the Upgrade Center page through RBP.
• Hide Username in the UI: removes usernames from the global header and People Preview, and disables username search.
• Enable Control on Employee Import in Role-Based Permissions: moves employee-import privileges into RBP (Section 4.4).
• Enforce Four-Eyes Principle On Workflow Step Approval: prevents initiators from approving their own dynamic group or dynamic role requests (Section 9.1).
• Tenant Preferred Time Zone: replaces the provisioned tenant time zone. This change is allowed only once and cannot be reverted.