User Types and Security

When you define user security, you are assigning the user to a role (Power, Contributor, or Reviewer). For information on the access and security according to role, see the User Roles and User Role Access tables above.

To define a user, select the Manage task and the User Management subtask.

1. In the Username cell enter the user's login ID.

2. In the Role cell, select Power, Contributor or Reviewer. 

3. Enter a temporary password for the new user in the Password field.

4. Select a User Type: Business or External. 

5. Click Save.

Best Practices/Tips

• You can add a user to another application, however, the user role must remain the same. User roles are globally enforced, which means that if you add an existing user to a new application, the user will automatically have the same role.

• As a Best Practice, Business users should manage only Business users. For any changes related to External users, contact Planful Support.

  • If you are a Business user, you can add only new Business users. You cannot add a new External user.

  • Only External users can create new External users.

  • However, if you are a Business user, you can add an External user to your application if the External user name already exists.

  • For example, External Partner A has worked with Business Customer P before, and External Partner A has an External username. When Business Customer X starts working with External Partner A, they can add External Partner A to their application because External Partner A already has a username (usernames are global). Business Customer X cannot add a new External Partner B, though, if that is a new username to the Planful system.

  • Business Power users can change the password of a Business user but not an External user. If an External user wants to change their password, they should contact Planful Support.

Step 3 – Define Groups

Define a group of users that have access to specific models, sub-models and views.

1. Access the Groups page by selecting the Manage task and the Group subtask.

2. Define groups by entering the name of the group under the Group cell.

Step 4 - Add Users to Defined Groups

Add users to groups defined on the Group page.

1. Select the Manage task and the User Group subtask.

2. Enter the user's login ID under the Username cell and enter the group the user belongs to under the Group cell.

Group permission does not take effect until you log off and then log in again. For example, if you are a Power user and you assign yourself to a new group, you must log off and then log in again to gain access to the newly defined group.

Step 5 – Define Dimension Security

Dimension security is defined at the User Group level. For example, you can define a group to have access to Company Division 1 and 2, but not 3.

To define dimension security:

1. Select the Manage task and Model Administration, Model Permissions subtask. The permissions subtask allows you to provide access to specific dimensions for a user group.

2. Select the model and the group you want to assign security to.

3. Select the dimension you want to secure. When using a single dimension, use filters to assign access to specific dimension members (values). In the image below, the SUSER group has access to the North America member of the Company dimension.

   

4. Design a report with these dimensions.

Power users have access to everything including groups, models, views, and reports. To set up a Power user, complete the following steps.

In Practice: Add a Power User

1. Select the Manage task and the User Management subtask.

2. Enter the Power user’s email address in the Username field.

3. Select Power user in the Role field.

4. Enter the first and last name of the Power user in the Name field.

5. Enter a temporary password for the Power user in the Password field. Make sure you let the user know what the temporary password is. The Power user can change it at a later time.

6. Select a User Type: Business or External. 

7. Click Save.

Best Practices/Tips

• You can add a user to another application, however, the user role must remain the same. User roles are globally enforced, which means that if you add an existing user to a new application, the user will automatically have the same role.

• As a Best Practice, Business users should manage only Business users. For any changes related to External users, contact Planful Support.

  • If you are a Business user, you can add only new Business users. You cannot add a new External user.

  • Only External users can create new External users.

  • However, if you are a Business user, you can add an External user to your application if the External user name already exists.

  • For example, External Partner A has worked with Business Customer P before, and External Partner A has an External username. When Business Customer X starts working with External Partner A, they can add External Partner A to their application because External Partner A already has a username (usernames are global). Business Customer X cannot add a new External Partner B, though, if that is a new username to the Planful system.

  • Business Power users can change the password of a Business user but not an External user. If an External user wants to change their password, they should contact Planful Support.

In Practice: Add a Power User to User Groups

1. Select the Manage task and the User Group subtask.

2. Enter the Power user’s email address in the Username field.

3. Select the group that you defined for Power users in the Group field. *

4. Click Save.

   If you have a Contributor Review user with access to only specific user groups and you make the Contributor or Reviewer user an Power user, you will need to update group access.

* Group names are user-defined. So, you can name groups to best suit your needs.

Power users have access to all models, views, and reports so there is no need to assign access to these artifacts as you would with a Contributor or Reviewer user.

In Practice: Add a Contributor User

1. Select the Manage task and the User Management subtask.

2. Enter the Contributor user’s email address in the Username field.

3. Select Contributor in the Role field.

4. Enter the first and last name of the Contributor user in the Name field.

5. Enter a temporary password for the Contributor user in the Password field. Make sure you let the user know what the temporary password is. The Contributor user can change it at a later time.

6. Select a User Type: Business or External. If you are a Business user, you can add only Business users. You cannot add an External user.

7. Click Save.

In Practice: Create a Group for Contributor Users

It is unlikely that you will want Contributor users to be a member of the same group as your Power users. To set up a group for Contributor users, complete the following steps.

1. Select the Manage task and the Group subtask.

2. Enter a group name in the Group field.

3. Click Save.

In Practice: Map the Added Contributor User to the New Group
Now that you added the Contributor user on the User page and created a group for the user on the Group page, you must map the added Contributor user to the group. Complete the following steps:

1. Select the Manage task and the User Group subtask.

2. Enter the Contributor user’s email address in the Username field.

3. Select or enter the group name defined on the Group page.

4. Click Save.

Next, assign user group access to models, reports and views.

In Practice: Add a Reviewer User

1. Select the Manage task and the User Management subtask.

2. Enter the Reviewer user’s email address in the Username field.

3. Select Reviewer in the Role field.

4. Enter the first and last name of the Reviewer user in the Name field.

5. Enter a temporary password for the Reviewer user in the Password field. Make sure you let the user know what the temporary password is. The Reviewer user can change it at a later time.

6. Select a User Type: Business or External. If you are a Business user, you can add only Business users. You cannot add an External user.

7. Click Save.

In Practice: Set up a Group for Reviewer Users

1. Select the Manager task and the Group subtask.

2. Enter a group name in the Group field.

3. Click Save.

In Practice: Map the Added Reviewer User to the New Group

Now that you added the Reviewer user on the User page and created a group for the user on the Group page, you must map the added Reviewer user to the group. Complete the following steps:

1. Select the Manage task and the User Group subtask.

2. Enter the Reviewer user’s email address in the Username field.

3. Select or enter the group name defined on the Group page.

4. Click Save.

Next, assign user group access to models, reports and views.

In Practice: Assign Dimension Security to a Reviewer User

In the example, access to multiple dimensions will be given to a Reviewer user. In this case, the Reviewer user will have access to the Company - North America dimension member, the Actual scenario, and the Budget scenario.

1. Select the Manage task and the Model Administration, Model Permissions subtask.

2. Enter the user group the Reviewer use has access to in the Groups field (see image below).

3. Enter the group you entered in the Groups field under Group.

4. For Dimension, select Company.

5. Select FixedMember for Filter and enter North America as the member you want the Reviewer user to have access to.

6. Perform steps 3 – 5 for the Scenario dimension. For Value, enter Actual and Budget as shown below).

7. Click Save.

   

As a Power user, you need to provide access to models, reports, and views for Contributor and Reviewer users.

In Practice: Assign Access to Models

1. Select the Manage task and the Model Administration, Model Permissions subtask.

2. Select the Model you want to provide the Reviewer or Contributor user group access to.

3. In the Groups field, add all the groups you want to access the model. In the image below, 2 groups have access to the DecisionWorks model; the SUSER and RELC groups.

4. If you want to secure dimensions and allow one or both user groups to only view certain dimension members in the model, you can apply dimension security here. For steps on how to do so, see the Define Dimension Security topic.

   

In Practice: Assign Access to Reports and Views

Power users can define views and reports to be shared with Reviewers. The Reviewer can open the report or view, and dimension security established by the Power user is maintained.

Example 1 : If a Power user defines a view or report with a Department dimension filter (e.g., Sales), and selects the All Departments member against the filter, the view or report for Sales can be accessed by the reviewer.

Example 2 : Similarly, a reviewer who has access to only two departments (e.g., Sales, Marketing) can use the view or report shared by the Power user.

To assign group access to a view , complete the following steps:

1. Select the Analyze task and the Data subtask.

2. Select the view you want to assign group access to.

3. Select the Design View subtask.

4. Click the Properties action.

5. In the Group column, select the name of the group in which you want to provide access.

6. Click Save.

To assign group access to a report, complete the following steps:

1. Select the Analyze task and the Data subtask.

2. Select the model or view you want to base the report off of.

3. Select the Design Report subtask.

4. Click the Properties action.

5. In the Group column, insert a row and select the name of the group in which you want to provide access.

6. Continue designing the report as needed.

7. Click Save.

The following table summarizes different ways to assign or restrict access to all aspects of models. Sometimes, there is more than one way to accomplish the same task, but one way may be more efficient than another. The table lists the more efficient methods above the less efficient methods. For example, you can assign access to a Model for a Group of users either with Model Permissions or Group Access. Model Permissions is a faster method.

Reminder :

• Roles : the predefined Dynamic Planning Roles are Power, Contributor, and Reviewer. Power users can see which user is assigned to which role with Manage, User Management or Manage, Navigation Access. The roles have defaults associated with their access to models, views, reports, and other artifacts. See those defaults in Manage, Navigation Access.

• Groups : groups are user-defined lists of users in your organization. They are defined with Manage, Group Management, User Group.

• Types : the predefined User Types are Business and External. User Types define whether someone can create or modify other user accounts. The Business user type is for all users within your organization that use Dynamic Planning. The External user type is for users outside of your organization who need to access your application for diagnostics, development, or debugging work, such as Planful Support or Partner Consultants.