3746294 - Edit class domain restriction not respected for mark attendance action.

• When a role has the "edit class" permission with a domain group restriction, that restriction is not respected for the "mark attendance" action.
• Roles with "edit class" restricted to certain domains can mark (and edit) attendance for all classes they can view, instead of only those within the permitted domains.

 SAP SuccessFactors Learning

1. Create or use a role that has exactly these permissions: View Class, Search Class, and Edit Class.
2. Restrict View/Search Class to domain group A; restrict Edit Class to a different, narrower domain group B.
3. Assign the role to a user and sign in as that user.
4. Open a class that the user can view (domain group A) but that is outside the Edit Class domain group B.
5. Attempt to mark attendance for that class; the system allows marking attendance despite the Edit Class domain restriction.

The Mark Attendance admin action is not implemented as a domain‑restricted workflow. The system checks that the user has Edit Class permission (plus View Class to access the class) but does not evaluate the Edit Class security domain restriction for the attendance action.

1. Acknowledge expected behavior: Mark Attendance is a permission‑based action. With View Class + Edit Class, admins can mark attendance even when the class is outside the Edit Class domain restriction.
2. If preventing attendance updates is required, redesign roles/permissions so users who can view classes but must not update attendance do not also hold Edit Class, or align View and Edit domain groups for users who are allowed to mark attendance.
3. Consider requesting a product enhancement to make attendance actions domain‑restricted and aligned with Edit Class domain restrictions.
4. For complex authorization design options, engage Professional Services to review and propose a configuration approach. Refer to: 2149831 - SAP Professional Services / SAP Certified Partner / SAP Account Management Team [SuccessFactors Cloud]

Refer to: 2149831 - SAP Professional Services / SAP Certified Partner / SAP Account Management Team [SuccessFactors Cloud]

edit class, mark attendance, domain restriction, security domain group, view class, admin permission, attendance action, class permissions, workflow action, role restriction, expected behavior, access control, authorization, learning admin, successfactors learning , KBA , LOD-SF-LMS-ADM , System Admin, Global Variables, References , Problem