2776423 - Updating benefit object by user who does not have 'Manage Data' or 'Configure Object Definition' permission

Benefit object is updated by a user who does not have 'Manage Data' permission or 'Configure Obejct Definition' permission.

Employee Central - Global Benefits

Navigate to Manage Data > Benefits > Open a particular benefit > Check last updated by.

The last updated by is the user who does no have 'Manage Data' or 'Configure Object Definition' permission.

Even if a user does not have 'Manage Data' or 'Configure Object Definition' permission, the user can update data from Workflow request. Navigate to 'Manage Pending request' in Home page > Click on the Benefit workflow > Click on the quick card which appears next to Benefit field > Click Manage and the user can change the benefit object (assuming Benefit is unsecured object i.e Secured = NO in Configure Obejct Definition > Benefits).

The issue happens because the user had 'Access to non-secured objects (previously known as 'Read/Write Permission on Metadata Framework')' permission in RBP (Role Based Permission). Once this permission is disabled in RBP, the user will get an error 'You do not have permission to access this object' when user will click on Manage under the quick card of the benefit field in the workflow.

Manage Data, Configure object definition, benefit, No permission to user, benefit object getting updated, benefit object getting changed, Update, change, permission, RBP , KBA , LOD-SF-EC-GBF , Global Benefits , Problem

SAP SuccessFactors Employee Central all versions ; SAP SuccessFactors HCM Core all versions