3831195 - Employee Central Workflows Bypassed When Admin Access to MDF OData API Is Enabled in Onboarding Administrator Role - Onboarding

Employee Central workflows are not triggered for changes performed by an Onboarding administrator.

The issue can occur when the administrator's permission role includes:

Administrator Permissions > Metadata Framework > Admin Access to MDF OData API

As a result:

• Employee Central approval workflows do not initiate for affected changes performed by the Onboarding administrator.

• The data change is saved without being routed through the configured Employee Central approval workflow.

This permission may have been granted previously while troubleshooting Onboarding Dashboard visibility issues, such as:

• New hires not appearing on the Onboarding Dashboard.

• First Name or Last Name not displaying for candidates on the Dashboard.

SAP SuccessFactors Onboarding

1. Navigate to Admin Center > Manage Permission Roles.

2. Open the permission role assigned to the affected Onboarding administrator.

3. Navigate to Administrator Permissions > Metadata Framework.

4. Enable Admin Access to MDF OData API.

5. Save the permission role.

6. Log in as, or proxy as, a user assigned to this role.

7. Perform an operation that would normally trigger a configured Employee Central approval workflow.

8. Observe that the data change is completed without the expected Employee Central workflow being initiated.

The Admin Access to MDF OData API permission provides broad access to Metadata Framework OData entities.

SAP documentation states that this permission:

• Overrides the target population configured for the Role-Based Permission role.

• Allows the user to query and edit all Metadata Framework OData entities, overriding entity-level permissions.

• Is recommended only for integration scenarios.

When this permission is assigned to the affected Onboarding administrator, operations performed by that user can bypass the permission controls normally applicable to the affected entities. In the scenario described in this KBA, this results in configured Employee Central workflows not being initiated for the affected changes.

Therefore, Admin Access to MDF OData API should not be used as a general Dashboard-access permission for interactive administrator users when Employee Central workflow processing must be preserved.

For additional information about this permission, refer to:

Permissions for the Onboarding Dashboard: Permissions for the Onboarding Dashboard | SAP Help Portal 

Remove Admin Access to MDF OData API from the interactive Onboarding administrator role and configure the permissions required for the Onboarding Dashboard individually.

This follows a least-privilege configuration and avoids granting the broad MDF OData access associated with the behavior described in this KBA.

Step 1: Remove Admin Access to MDF OData API

1. Navigate to Admin Center > Manage Permission Roles.

2. Open the permission role assigned to the affected Onboarding administrator.

3. Navigate to Administrator Permissions > Metadata Framework.

4. Deselect Admin Access to MDF OData API.

5. Save the permission role.

If this permission is required for an integration scenario, assign it to a dedicated integration or technical user through a separate permission role rather than to an interactive administrator account.

Step 2: Verify the target population

1. Open the Assignments section of the administrator permission role.

2. Configure the target population required for the administrator's Onboarding responsibilities.

For administrators who need access to all active Onboarding processes, this can include:

• All External Onboarding Users

• All Employees, when access to existing employees or internal-hire scenarios is required

For restricted administrator roles, configure the target population according to the intended population instead of granting unrestricted MDF OData access.

Step 3: Configure the Onboarding Dashboard permissions

Verify the following permissions based on the administrator's business requirements.

Under User Permissions > General User Permission:

• User Search

Under User Permissions > Employee Data:

• First Name

• Last Name

• Status

• Location

Under User Permissions > Employee Central Effective Dated Entities > Job Information:

• Location

• Job Classification

Under User Permissions > Onboarding or Offboarding Object Permissions:

• ONB2Process - View

• Aggregated Details, where required by the Dashboard configuration

Additionally, enable at least one applicable Dashboard status permission under Onboarding or Offboarding Permissions, according to the administrator's responsibilities:

• Show Compliance Forms Status on the Dashboard

• Show Onboarding Tasks Status on the Dashboard

• Show Data Collection Status on the Dashboard

• Show Form I-9 and E-Verify Status on the Dashboard

The exact permissions required depend on which Onboarding information and tasks the administrator must access.

Step 4: Review Employee Export if candidate names are not displayed

Employee Export is not intended for Hiring Manager or Onboarding Participant roles.

For administrator roles, KBA 3293129 - Onboarding admin unable to view candidate details in the dashboard - Onboarding - SAP for Me describes scenarios in which Employee Export affects First Name and Last Name visibility on the Onboarding Dashboard.

If Employee Export is already granted to the administrator:

1. Review all permission roles assigned to the user that contain the ONB2Process object permission.

2. Follow the permission consistency requirements described in 3293129 - Onboarding admin unable to view candidate details in the dashboard - Onboarding - SAP for Me 

3. Ensure that Employee Export is not granted to Hiring Managers or Onboarding Participants through another permission role.

Do not re-enable Admin Access to MDF OData API solely to resolve candidate name visibility. Review the granular permissions and target population first.

After Admin Access to MDF OData API is removed from the interactive administrator role:

• Employee Central workflows are triggered according to the configured Employee Central workflow rules for affected operations.

• Onboarding administrators continue to access the Onboarding Dashboard according to their granular permissions and configured target population.

• Dashboard access no longer depends on the broad MDF OData administrator permission.

If candidate First Name or Last Name values are still missing from the Dashboard, review the Employee Export configuration and KBA 3293129 - Onboarding admin unable to view candidate details in the dashboard - Onboarding - SAP for Me 

• KBA 3089047 - Permissions for the Onboarding/Offboarding Dashboard - Onboarding
• KBA 3293129 - Onboarding admin unable to view candidate details in the dashboard - Onboarding
• Permissions for the Onboarding Dashboard | SAP Help Portal
• Role-Based Permissions for Administrators in Onboarding and Offboarding | SAP Help Portal

SAP SuccessFactors Onboarding, Employee Central workflow, EC workflow, workflow not triggered, workflow skipped, Admin Access to MDF OData API, MDF OData API, Metadata Framework, Onboarding administrator, Onboarding Dashboard, Dashboard permissions, candidate name not visible, First Name, Last Name, Employee Export, ONB2Process, Aggregated Details, User Search, target population, All External Onboarding Users, Role-Based Permissions, RBP, entity-level permissions, integration user, LOD-SF-OBX-DBD , KBA , LOD-SF-OBX-DBD , Dashboard , Problem