## 13.3.4.3.5.2  Authorizations
## Use
Manager Self-Service uses the authorization concept provided by the AS ABAP. Therefore, the recommendations and guidelines for authorizations as described in the Application Server ABAP Security Guide also apply to Manager Self-Service. The ABAP Platform authorization concept is based on assigning authorizations to users based on roles. For role maintenance, use the profile generator (transaction PFCG ) on the AS ABAP.
##  Note
For more information about how to create roles, see Role Administration .
## Role and Authorization Concept for Manager Self-Service
Manager Self-Service embraces services from a variety of SAP applications and also uses the authorizations of these individual components. Many services belong to HCM components, see Authorizations for Human Resources .
##  Recommendation
For Manager Self-Service, we highly recommend that you use the HCM-specific structural authorization check in addition to the general SAP authorization check. For more information see SAP Library for SAP S/4HANA on SAP Help Portal at Human Resources HR Tools Authorizations for Human Resources Structural Authorization Check .
## Standard Roles
The table below shows the standard roles that are used for authorizations by Manager Self-Service.
Standard Roles for Manager Self-Service
| Role                      | Description                                                                                                                                                                                                                                                                                                                                                                                                          |
|---------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| SAP_ASR_MANAGER           | Authorizations for the functions of the PA-AS component (HR Administrative Services) for line managers in Manager Self-Service.                                                                                                                                                                                                                                                                                      |
| SAP_TIME_MGR_XX_ESS_WDA_1 | Authorizations for line managers in Manager Self-Service for services used to approve leave requests and working times from Employee Self-Service (WDA).                                                                                                                                                                                                                                                             |
| SAP_TMC_MANAGER           | Authorizations for managers relating to Talent Management activities. For more information, see Manager in Talent Management . The structural authorization profile TMS_MAN_PROF is also available as a template for the manager. For more information, see Customizing for Talent Management and Talent Development under Basic Settings → Authorizations in Talent Management → Define Structural Authorizations . |
| SAP_RCF_MANAGER           | Authorizations for the Manager role, which enables access to SAP E-Recruiting from the Portal (Manager Self Service).                                                                                                                                                                                                                                                                                                |
| SAP_MANAGER_MSS_OTH_NWBC  | Authorizations for remote system applications including ap- plications from SAP E-Recruiting.                                                                                                                                                                                                                                                                                                                        |
| Role                          | Description                                                                                                  |
|-------------------------------|--------------------------------------------------------------------------------------------------------------|
| SAP_HR_LSO_HR-MANAGER         | Authorizations for the applications of the HRManager Train- ing role of the SAP Learning Solution component. |
| SAP_HR_LSO_MANAGER            | Authorizations for the applications of the Manager role of the SAP Learning Solution component.              |
| SAP_FI_TV_WEB_APPROVER        | Authorizations for applications of the Travel Approver role of the SAP Travel Management component.          |
| SAP_HR_CPS_DET_PLAN_L_SR_NWBC | Authorizations for applications of the manager role of the Personnel Cost Planning component.                |
| SAP_SR_MSS_FIN_5              | Authorizations for the Financials applications in Manager Self-Service.                                      |
##  Caution
For the Business Package for Manager Self-Service , you also need SAP Note 844639 for generating the authorization profiles.
##  Note
The composite role SAP\_MANAGER\_MSS\_NWBC , which contains the single roles listed above , is required for Manager Self-Service in SAP Business Client .
## Standard Authorization Objects
The following section provides an overview of the security-relevant authorization objects that are used by Manager Self-Service.
Standard Authorization Objects for the Business Package for Manager Self-Service
| Authorization Object                                                                    | Field                                                                                   | Value                                                                                                                                                  | Description                                                                                                                                            |
|-----------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------|
| S_RFC                                                                                   | RFC_NAME                                                                                | Depends on service                                                                                                                                     | Saves data from RFC access to Web Dynpro front end to the back-end system.                                                                             |
| Standard Authorization Objects for Controlling Services in MSS(Both Deployment Options) | Standard Authorization Objects for Controlling Services in MSS(Both Deployment Options) | Standard Authorization Objects for Controlling Services in MSS(Both Deployment Options)                                                                | Standard Authorization Objects for Controlling Services in MSS(Both Deployment Options)                                                                |
| Authorization Object                                                                    |                                                                                         | Description                                                                                                                                            |                                                                                                                                                        |
| K_CCA                                                                                   |                                                                                         | General authorization object for Cost Center Accounting. Is checked in the relevant Monitor iViews, Master Data iViews, and Express Planning services. | General authorization object for Cost Center Accounting. Is checked in the relevant Monitor iViews, Master Data iViews, and Express Planning services. |
| Authorization Object   | Description                                                                                                                                                                                                                                                 |
|------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| K_ORDER                | General authorization object for internal orders. Is checked in the relevant Monitor iViews, Master Data iViews, and Express Planning services.                                                                                                             |
| K_PCA                  | Area responsible, Profit Center. Is checked in the relevant Monitor iViews, Master Data iViews, and Express Planning services.                                                                                                                              |
| K_CSKS_PLA             | Cost element planning. Is checked in the relevant Express Planning services.                                                                                                                                                                                |
| K_FPB_EXP              | Authorization object for Express Planning. This authorization object checks the Express Planning Framework call and the planning round call. The actual plan data is protected by the authorization objects for the individ- ual Express Planning services. |
##  Note
For more information about the fields for the authorization objects K\_CCA , K\_ORDER , and K\_PCA , see SAP Note 15211 .
Apart from these authorization objects, both Manager Self-Service deployment options use the authorization objects from the following application areas or application components:
- Human Capital Management See the SAP S/4HANA Security Guide at Human Capital Management Authorizations
## · SAP E-Recruiting
See the SAP S/4HANA Security Guide at Human Capital Management Talent Management SAP E-Recruiting Authorizations .
- HCM Processes and Forms
See the SAP S/4HANA Security Guide at Human Capital Management Personnel Administration (PA) HCM Processes and Forms Authorizations .
- Travel Management Travel Management (FI-
See the SAP S/4HANA Security Guide at Accounting Financial Accounting TV) .
## Authorizations for Business Intelligence (BI) iViews (BP MSS)
For the BI iViews in the Business Package for Manager Self-Service , users need the standard BI authorizations for executing queries. For more information, see Authorization Check When Executing a Query (in the Data Warehouse Management section of the documentation for SAP NetWeaver Business Intelligence).
.
In Human Capital Management, BI queries use a BI variable for personalization. Data is read from the DataStore object for personalization 0PERS\_VAR . If required, you can fill this DataStore Object from structural authorizations (see Structural Authorizations - Values ( 0PA\_DS02 ) and Structural Authorizations - Hierarchy ( 0PA\_DS03 )).