3557543 - Unauthorized Changes to MDF Objects by Users Without Access to Manage Data

• An update was made to and object such as "Country/Region" by a user who only has an employee role and no admin access.
• The change was made without direct access to Manage Data or Import/Export Data.
• This issue raises a security concern as objects are being altered by unauthorized users.

SAP SuccessFactors HCM Core

1. Navigate to Manage Data. 
2. Select the object which was modified e.g. Country/Region. 
3. Take note in the bottom right corner of the user who last made the change to the object. 
4. Go to Manage Permission Roles/User Role Search and validate the user permissions. 
5. Proxy as the user who made the change and notice the user has no access to the Manage Data or Import/Export Data to have made these changes. 

• The object is not marked as secured, allowing users to make changes to the object.
• The user can make changes through other areas such as People Profile, Manage Position, Position Org Chart, etc., which have access to one or more objects referencing the object that was changed.

Please keep the following points in mind to ensure unauthorized changes are not made to objects by users:

1. A user does not need access to Manage Data to change this object/an object because there are several areas such as People Profile, Manage Position, Position Org Chart, etc., which allow access to one or more objects.
2. To prevent unauthorized users from updating critical objects, mark the object as Secured and controlled by additional RBP. Grant 'Edit' access to only specific authorized users.
3. Important: Core MDF objects cannot be marked as secured and please do not make any changes to the objects. The full list of objects that cannot be changed can be found here: List of MDF Core Objects | SAP Help Portal
4. In cases where objects cannot be marked as secured but are critical in your system, ensure that unauthorized users do not have the RBP "Access to non-secured objects".

• User Change Report | SAP Help Portal
• MDF Change History Data Report | SAP Help Portal
• MDF Configuration Data Report | SAP Help Portal
• List of MDF Core Objects | SAP Help Portal

SAP SuccessFactors, MDF, Unauthorized Changes, Country/Region Object, Security Issue, Manage Data, Role-Based Permissions, Secured Object, Quick Card, Object, LOD-SF-MDF, no access, changes , KBA , LOD-SF-MDF-OBJ , Object Definition & Field Related Issues , LOD-SF-MDF-MGD , Manage Data - Create, Update & Delete , LOD-SF-MDF-RBP , RBP Permissions on Objects , Problem