Once users are created in the SAP Ariba solution, they must be given the required permission to perform the tasks for which they are responsible. These required permissions are assigned through user groups. Group membership enables users to inherit all accesses, permissions and authorizations associated with the groups. For example, only members of the Customer Administrator group can use Ariba Administrator to import, export, and manage most types of data. Also, only members of the Purchasing User group can create purchase requisitions in Ariba.

Roles of SAP Ariba User Groups:

• User Groups determine which functions a user can perform in the system.

• User Groups define permissions in SAP Ariba.

• User Groups can be used to drive approval routing, including approval queues.

• User Groups can be used to control transaction visibility.

• User Groups can be used to define visibility of catalogs

• User Groups can be used for customization purposes (validations, field visibility, etc.)

System Groups vs. Custom Groups

1. System Groups: SAP Ariba solutions includes a number of standard (OOTB) or system-defined groups. System groups are preloaded in the Ariba solution with a hard-coded set of permissions or restrictions. It is impossible to modify the permissions or restrictions associated with these groups. Examples of SAP Ariba system groups are Purchasing User, Customer Administrator etc. System groups are easily identified as they are "Defined By SYSTEM" as shown in the image below.

Refer to SAP Ariba Procurement Solutions Group Descriptions Table for a comprehensive list of SAP Ariba system groups and associated permissions.

2. Custom Groups: In addition to the system-defined groups, organisations can also create their own groups, which are called user-defined or custom groups. Ideally, custom groups follow existing job roles you have in your organization e.g., procurement, finance, IT Admin etc. Custom groups can be created to inherit the permissions from multiple system groups when assigned as a child group. Then a user assigned to such custom group will automatically have all the authorizations and permissions from those system groups. A custom group can also be assigned to another custom group(s). Custom roles are easily identified by a standardized naming convention e.g., XYZ_Ariba_Buying_Requester where XYZ is the short name of the company, Ariba Buying is the solution module and Requester is the role of the user in the system.

Group-to-Child Group Concept:

A group that is assigned to another group is called a Child group. A child group can inherit permissions from multiple "parent" groups. For example, as in the image below, if you create a custom group – XYZ_Ariba_Buying_Requester and add it as a child to the Purchasing User and Spot Buy User system groups, and also to another custom group – XYZ_Guided_Buying_Redirect, it will inherit the privileges from all these groups. These group relationships are referred to as Group-to-Child Group mappings.

In the SAP Ariba solution, an Administrator can manage user groups via Manage → (Core) Administration → User Manager → Groups

SAP Ariba User Groups Best Practice Approach

• Define clear group roles and set up groups that align with specific business functions (like Finance, Procurement, or IT); establish tool to manage this mapping during implementation and beyond.

• Determine if departments need to identify users for specific groups; develop data collection template and communication for this.

• Establish a subset of users with appropriate groups.

• Adopting a standardized naming convention for custom groups (e.g., XYZ_Ariba_Buying_Requester) helps keep groups organized and easy to manage.

• Minimize excessive overlap of groups to avoid permission conflicts or unintended access levels.

• Regularly check and update user group memberships and permissions, especially after organizational changes.

In conclusion, SAP Ariba User Groups are powerful means for streamlining user management and compliance within an organization. By grouping users based on roles and responsibilities, SAP Ariba administrators can efficiently manage access and permissions, reduce administrative overhead, and ensure that users have appropriate levels of access. Also, implementing User Groups with best practices listed above not only simplifies system management but also fosters a more agile and compliant procurement process that can adapt to organizational changes effectively.

Reference(s): System Groups, Custom Groups, and Child Groups

© 2024 SAP SE or an SAP affiliate company. All rights reserved. This article references SAP materials for educational purposes, in accordance with SAP's copyright guidelines.