## 13.3.5.3.1  Authorizations
## Use
Talent Management uses the following authorization concepts:
- ABAP Platform authorization concept that is based on assigning authorizations to users based on roles For this purpose, the roles mentioned under Standard Roles are available as a template. You can copy the standard roles to the customer namespace and adjust them to suit your requirements. You use the profile generator (transaction PFCG ) to maintain roles.
· HR-specific concept for the structural authorization check For this purpose, the authorization profiles mentioned under Standard Roles are available as a template. You can use the authorization profiles as an example for creating your own authorization profiles and then assign these profiles to the relevant users. For more information about the authorization profiles, see Customizing for Talent Management and Talent Development and choose Basic Settings Authorizations in Talent Management Define Structural Authorizations For more information about the structural authorization check, see section Structural Authorization Check
(see SAP Library for SAP S/4HANA and choose Human Resources HR Tools Authorizations for Human Resources ).
## Role and Authorization Concept for Talent Management
## Standard Roles
The table below shows the standard roles and structural authorization profiles that can be used for Talent Management.
Standard Roles and Structural Authorization Profiles
| Role                 | Description                                                                                                                                                   | Structural Authorization Profile                                               |
|----------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------|
| SAP_SR_TMC_TMS_6     | Authorizations for talent management specialists and talent management superusers (see Talent Management Specialist under Single Roles in Talent Management ) | Talent Management Specialist: TMS_PROFILE Talent Management Superuser: TMS_ALL |
| SAP_SR_TMC_MANAGER_6 | Authorizations for managers with re- gard to Talent Management activities (see Manager in Talent Management un- der Single Roles in Talent Management )       | TMS_MAN_PROF                                                                   |
| Role                  | Description                                                                                                                                             | Structural Authorization Profile   |
|-----------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------|
| SAP_SR_TMC_EMPLOYEE_6 | Authorizations for employees with regard to Talent Management ac- tivities (see Employee in Talent Management under Single Roles in Talent Management ) | None                               |
For the documentation for the standard roles, see SAP Library for SAP S/4HANA and choose Human Resources Talent Management Talent Management and Talent Development Roles in Talent Management Single Roles in Talent Management .
<!-- image -->
The table below shows the roles that we recommend you no longer use.
Roles No Longer Recommended for Use
| Role                           | Description                                                                                                                                             | Note                                                                         |
|--------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------|
| SAP_TMC_TALENT_MANA_SPECIALIST | Authorizations for talent management specialists (see Talent Management Specialist under Single Roles in Talent Management )                            | This role is obsolete and was replaced by the role SAP_SR_TMC_TMS_6 .        |
| SAP_TMC_SUPER_TALENT_MANA_SPEC | Authorizations for talent management superusers (see Talent Management Superuser under Obsolete Single Roles in Talent Management )                     | This role is obsolete and was replaced by the role SAP_SR_TMC_TMS_6 .        |
| SAP_TMC_MANAGER                | Authorizations for managers with re- gard to Talent Management activities (see Manager in Talent Management un- der Single Roles in Talent Management ) | Werecommend that you use the role SAP_SR_TMC_MANAGER_6 instead of this role. |
| SAP_TMC_EMPLOYEE               | Authorizations for employees with regard to Talent Management activ- ities (see Single Roles in Talent Management )                                     | This role is obsolete and was replaced by the role SAP_SR_TMC_EMPLOYEE_6 .   |
## Standard Authorization Objects
The table below shows the security-relevant authorization objects that are used by Talent Management.
Standard Authorization Objects
| Authorization Object   | Description                               | More Information                                                                 |
|------------------------|-------------------------------------------|----------------------------------------------------------------------------------|
| B_BUPA_RLT             | Authorizations for business partner roles | Security Guide for Application Server ABAP under SAP Business Partner Se- cuirty |
| Authorization Object   | Description                                                                                                                                                                                                 | More Information                                                                                                                                                             |
|------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| CA_POWL                | Authorizations for the personal object worklist (POWL)                                                                                                                                                      | SAP Library for SAP S/4HANA under Cross-Application Functions in SAP ERP Cross-Application Components Personal Worklist in the section Assign Authorizations (Standard POWL) |
| S_RFC                  | Authorization check upon RFC access                                                                                                                                                                         | ABAP Platform Security Guide for Re- mote Function Call (RFC) and Internet Communication Framework (ICF) un- der Authorization Object S_RFC                                  |
| S_WFAR_OBJ             | ArchiveLink: Authorizations for access- ing documents                                                                                                                                                       | For more information, go to https:/ / help.sap.com/s4hana_op_2021, enter ArchiveLink into the search bar, press Enter , and open the search result with that title.          |
| PLOG                   | Authorization object that checks the authorization for certain fields of Per- sonnel Planning components (Organi- zational Management, Personnel Devel- opment, Training and Event Manage- ment, and so on) | SAP Library for SAP S/4HANA under PLOG (Personnel Planning)                                                                                                                  |
| P_HAP_DOC              | Authorization object that controls a us- er's access to appraisal templates                                                                                                                                 | SAP Library for SAP S/4HANA un- der P_HAP_DOC (Appraisal Systems: Appraisal)                                                                                                 |
| P_ORGIN                | Authorization object used to check the authorization for accessing HRinfo- types                                                                                                                            | SAP Library for SAP S/4HANA under P_ORGIN (HR: Master Data)                                                                                                                  |
| P_TCODE                | Authorization object used to check whether a user is authorized to start various HRtransactions                                                                                                             | SAP Library for SAP S/4HANA under P_TCODE (HR: Transaction Code)                                                                                                             |
| P_PERNR                | Authorization object used if different authorizations are to be assigned for accessing a user's personnel number                                                                                            | SAP Library for SAP S/4HANA under P_PERNR (HR: Master Data - Personnel Number Check)                                                                                         |
For the documentation for the authorization objects PLOG , P\_HAP\_DOC , P\_ORGIN , P\_TCODE , and P\_PERNR , see SAP Library for SAP S/4HANA and choose Human Resources HR Tools Authorizations for Human Resources Technical Aspects Authorization Objects .
## Critical Combinations
- Talent Review Meetings
- All users that have access to the personal object worklist (POWL) for talent review meetings may create talent review meetings.
##  Note
In the standard SAP system, the POWL for talent review meetings is contained in the roles for talent management specialists for SAP Enterprise Portal and SAP Business Client.
- Users have display and change authorization for all talent review meetings to which they are assigned as members of the support team. The POWL for talent review meetings provides users with a list of talent review meetings, which they can display and edit.
##  Caution
All members of the support team for a talent review meeting have unrestricted access to all information available within this talent review meeting (for example, to all assigned managers and talents, and their profiles). When this information is accessed, there is no additional authorization check within the talent review meeting.
- Those users that have display or change authorization for the related infotype record of the Object infotype (1000) also have display or change authorization for a talent review meeting. The infotype record is identified by the RM ( Talent Review Meeting ) object type and the ID of the talent review meeting. Users that have display authorization for this infotype record can call the talent review meeting in display mode. Users with change authorization for this infotype record can call the talent review meeting in change mode.
## · Talent Search
- To be able to use the search, a user must be a talent management specialist with an assigned area of responsibility. This means that there must be a relationship 741 ( Is Responsible For / Is in Area of Responsibility Of ) between the user's central person (object type CP ) and at least one organizational unit (object type O ).
- In Customizing, for the search fields that you want to use as search criteria, enter the infotype and the object type, if required, to define which authorization object is used for the authorization check. These settings specify whether this field is available to a user for selection in the search template and in the search results.
##  Example
The user wants to use the talent group as a search criterion and search for all talents that are assigned to a particular talent group. Therefore, the system checks whether the user has display authorization for relationship 743 ( Has Talent For / Comprises Talent ) between the object types CP ( Central Person ) and TB ( Talent Group ). T o do so, it checks the authorization for the corresponding subtype of the infotype Relationships (1001).
For more information, see Customizing for Talent Management and Talent Development and choose Basic Settings Search Define Search Requests and Search Field Names .
- In the search results, the system displays only the objects for which the user has authorization through the authorization object PLOG as well as the corresponding structural authorization. For the object type CP , the system also checks whether the user has display authorization for the infotype Organizational Assignment (0001).
##  Note
If more than one person (object type P ) is assigned to a central person ( CP ) (for example, employees in concurrent employment), it is sufficient for the talent search if the user has display authorization for one of these persons.
## Additional Functions
You can deactivate specific authorization checks that are performed in the standard SAP system when assigning employees (object type CP ( Central Person )) to positions, job families, and talent groups. In the standard SAP system, when such relationships are created, the system checks whether the user (in this case, the talent management specialist) has the following authorizations:
- For assigning employees to positions: Authorizations for
- Employee (object type CP )
- Position (object type S )
- Relationship 740 ( Is Successor Of )
- For assigning employees to job families: Authorizations for
- Employee (object type CP )
- Job family (object type JF )
- Relationship 744 ( Has Potential For )
- For assigning employees to talent groups: Authorizations for
- Employee (object type CP )
- Talent group (object type TB )
- Relationship 743 ( Has Talent For )
So that a talent management specialist is also able to create these relationships for employees (object type CP ) for which he or she does not usually have change authorization (because of his or her structural authorization profile), the authorization check can be deactivated for employees for the respective employee assignment. The talent management specialist then only needs the change authorization for the object (of the object type Position , Job Family , or Talent Group ) to which he or she wants to assign the employee, and for the relationship.
For more information, see Customizing for Talent Management and Talent Development and choose Basic Settings Authorizations in Talent Management Deactivate Authorization Check When Assigning Employees .