2186617 - Creating new Super Admin User in SuccessFactors

• How to login to the SucessFactors system as an admin user
• How to reset a superuser password
• How to create an admin user from Provisioning
• How to get initial admin user access for SuccessFactors

Image/data in this KBA is from SAP internal systems, sample data, or demo systems. Any resemblance to real data is purely coincidental.

SAP SuccessFactors HCM Suite

Please be informed that SAP Technical Support does not have the ability to reset password for existing user accounts in SuccessFactors systems. This task falls under the scope of the administrator of the account, and has been highlighted in KBA 2345110 - Configuring Password Reset for the Login Page in SuccessFactors.

As described in the KBA 2517118 - SAP SuccessFactors New Instance/Re-activation request, Product Support is not responsible for providing new instance credentials. When the instance is first created, Email notifications with initial tenant access details are automatically sent to the company's IT Contact Person maintained in the contract.

[A] Creating a new super admin user from the SuccessFactors backend (Provisioning)

Steps to create a new super admin user in SuccessFactors: Creating a Super Admin User in Provisioning
Note: If the single recipient e-mail feature is enabled, creating a Super Admin from Provisioning is not possible. To proceed, temporarily disable the feature.

The above steps require access to SuccessFactors Provisioning. If you do not have any partner engaged with the required Provisioning access to perform these steps, please check section [B].

Additionally- if the SuccessFactors tenant is Identity Authentication Service (IAS) integrated, please check instructions in section [C].

[B] Engaging Technical Support for super admin creation

Super Admin creation from provisioning is performed by Technical Support when-

• The initial email notification containing the System and access details is not received after the tenant is created, normally caused due to incorrect IT Contact details.
• The initial IT Contact is not available to utilize their system access, and the access needs to be granted to a new contact.

How to engage support for this? -

1. Submit a support case under component LOD-SF-PLT-ADM.
2. Include the required details:
• E-mail address where the credentials will be sent to:
• Company ID:
• Data Center where the new user will be created:
• Reason why a new admin user needs to be created:
3. Support will then create a Super Admin user and share the corresponding access details to the provided email address.

Same instructions as above apply to SAP Partners/Consultants without access to Provisioning. 
Note: Please add the customer approval and the reason why a new admin user needs to be created - it could be either via a customer updating the case or attach the approval email from customer to the case.

[C] Additional steps needed when the SuccessFactors tenant is Identity Authentication Service (IAS) integrated

In SuccessFactors tenants that are integrated with IAS, the above super admin creation alone will not be enough for login. With IAS enabled, an Admin user account needs to be created in the connected IAS tenant, matching the Username of the newly created SuccessFactors admin user in the IAS Login Name field.

(1) Verify if IAS integration is enabled

• (With Provisioning access) Check the Single Sign-On (SSO) Settings page in Provisioning, if SSO Authentication is enabled and the SAML Issuer value has a URL ending with ondemand.com or cloud.sap.
• (Without Provisioning access) Post Super Admin creation in Provisioning try to login with those credentials and the provided login URL. If the login page shows error "Sorry, we could not authenticate you. Try again", that is an indication IAS integration is enabled.
• (Without Provisioning access) Alternatively, SuccessFactors Technical support can confirm the same as well by verifying the Provisioning oncifguration.

(2) The process for creating this IAS admin user will vary depending on whether there are any existing IAS admins or not, the following KBA details all the options-> 2570572 - How to add Administrators to SAP Identity Authentication Service (IAS) tenants

(3) Post admin user creation, that user profile will need to be edited in IAS to set the Login Name matching the SuccessFactors admin username-> List and Edit User Details

(4) Finally, with the matching user created in IAS, the login to SuccessFactors can be done using the corresponding URL and via IAS login page.

[D] How to get access to SuccessFactors admin tools post login?

The super admin user created in SuccessFactors will not have access to all admin tools by default. Upon login, the first step is to add the user to the "Manage Role-Based Permission Access" page.

To do so, please follow the steps here: Granting Administrators Access to Role-Based Permissions

Post above setps, the added user will have the access to use the four features below:

• Manage Permission Groups
• Manage Permission Roles
• User Role Search
• RBP Troubleshooting

With access to these features, the user can create permission groups and permission roles

• 2345110 - Configuring Password Reset for the Login Page in SuccessFactors
• Managing Instance Access: Super Administrators
• 2344584- How to add access to Role-Based Permission Admin features (Manage Role-Based Permission Access, View User Permission, Manage Permission Roles, Manage Permission Groups and User Role Search)

sf, successfactors, administrator, admin permissions, new user, all access, provisioning, super, admin, SuccessFactors, sf, sfsf , sf sf, SuccessFactors, SuccessFactor, Success, Factor, bizx, superuser , KBA , LOD-SF-PLT-ADM , Admin user creation , How To