2229023 - Admin Roles export and import in Learning

This KBA serves as a guide for administrators regarding the export and import of admin roles.

"Image/data in this KBA is from SAP internal systems, sample data, or demo systems. Any resemblance to real data is purely coincidental."

SAP SuccessFactors Learning

Admin Roles export and import

The admin roles export and import features are built to transfer administrator roles from one environment to another.

Best Practice: 

1. Create the administrator roles, security domains, and security domain groups in System Administraton > Security, in stage environment first >
2. Test that the configuration enables admins assigned to the role to perform the required tasks >
3. Import the role in production.

Prerequisites:

Assign these permissions to the administrator who exports/imports the admin roles: Role's "Permissions" tab > "Search" and "System Administration":

• Export Data.
• Import Data.
• View Role.
• Search Role.

Using the Export Data

• The "Export Data" can be found in System Adminstration > System Management Tools.
• Administrators follow the export wizard to assemble the records for export. At the end of the wizard, the system creates a background job to build the export file.
• When the background job completes, the file is available in System Adminstration > System Management Tools > Export Data.

Tip:

• It's possible to configure the export files through the "exportExpiration" setting found in System Administration > Configuration > System Configuration > LMS_ADMIN.

Using the Import Data

• The "Import Data" can be found in System Adminstration > System Management Tools.
• Starting with the file that the export data generated, administrators follow the import wizard to import the roles.
• The tool adds or updates roles, permissions and restrictions. It doesn't delete roles/permissions or nullifies restrictions.
• The tool only adds restriction if the entity or function already exists in the system, for example:

• A report developer has modified an existing custom report to add/change the table on which to apply restrictions for the admin running the report.
• This means all the roles where this permission is assigned are missing a restriction for that entity or showing the previous entity only.

Example:

• The report has 2 entities, Questionnaire Survey and User, but the User entity is missing.

• Therefore, it's desired to update all the roles where this permission is assigned with a restriction on that entity so the file was populated as per below:

• However, the restriction value for the Questionnaire Survey entity isn't deleted, as it's not supported. The User entity hasn't been created, because it must already exist in the system.

Resolution:

To add the new entity in the restrictions, it's required to manually remove the permission from the role:

1. "Permissions" tab > Edit > Check the box next to the permission> Apply Changes >
2. Add it again (same tab) > "add one or more from list" entry > Check the box > Apply Changes.

Important: This will remove any restrictions values that were populated in the permission. Therefore, it's possible to import the file again and the restriction will be populated for all the roles where the above-mentioned task was done.

Note: There is no automated/bulk way to remove permissions from roles. Alternatively, to have a different system behavior, it'd be possible to have an enhancement request (KBA 2090228) created for it, where the Learning Product Management team can further review and assess the requested functionality to be considered in a future release.

lms, learning, administrator, admin, role, export, import, data, tool, report, permission, restriction, group, not, add, added, remove, removed, delete, deleted, custom, change, update, unable , KBA , LOD-SF-LMS-IMP , Import Data Tool , LOD-SF-LMS , Learning Management System , LOD-SF-LMS-WOR , Roles & Workflows , How To