Managing and Using Proxy Assignments
Managing and Using Proxy Assignments
1 Proxy Access. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
3 Alternatives to Proxy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Proxy access allows one person to access another person's user account and act on their behalf, for a specific
purpose and in specific areas of the system.
• Ensuring that important business processes aren't interrupted by an individual employee's absence
For example, if an employee is unavailable or absent when a form is due, an assigned proxy can complete the
form on the employee's behalf.
• Troubleshooting and testing
You can use proxy access to quickly test how the system behaves for different users and different roles, without
manually logging in and out of different user accounts.
Caution
Proxy access gives broad access to someone's user account. For areas where they have proxy rights, a proxy
can see the same information and take the same actions that the account holder can. In some places, a proxy
may even have access to sensitive personal data, such as a national ID, or to other private data, such as a
compensation statement.
Plan usage of proxy access carefully and make sure it aligns with the data protection and privacy
requirements of your organization.
To understand how proxy access works, you just need to understand a few key concepts:
• A proxy assignment defines a proxy relationship between two people, an account holder and a proxy.
• A proxy is the person who's been assigned to act on someone else’s behalf.
• An account holder is the person whose account the proxy can access and on whose behalf the proxy can act.
• You can grant specific proxy rights for each proxy assignment. Proxy rights define which specific areas of the
system the proxy is allowed to access.
• You can control who's allowed to manage proxy assignments. You can centralize control with a small group of
proxy administrators or enable everyone in the organization to assign their own proxy.
• By default, proxy assignments are indefinite. However, you can set a start time or end time, if necessary.
Example
For example, John is going on vacation and Sarah is assigned to act on his behalf. John is the account holder
and Sarah is the proxy. John is a hiring manager on some open requisitions, so Sarah is granted proxy rights to
As a proxy, Sarah can act on John's behalf in the recruiting process but not in other processes, such
as performance reviews for his team. She can not see any of John's personal profile data, such as his
compensation statement.
Here are some leading practices for setting up and using proxy access.
DO
• Do assign a proxy for a specific purpose, such as moving a specific business process forward or
troubleshooting a specific issue.
• Do assign a proxy who maintains a close working relationship with the account holder and only exercises proxy
rights when required.
• Do audit the existing proxy assignments from time-to-time, as a part of an overall governance process. Remove
questionable proxy assignments or consult with the account holder to see if it's still needed.
Example
An executive assistant is an example of good proxy usage. An assistant can use proxy access to take
administrative actions on behalf of an executive.
DON'T
• Don't use proxy access to perform actions on behalf of people who can or should perform the actions
themselves.
• Don't use proxy access as a shortcut to see information that could also be seen with reports or made visible
with role-based permissions.
• Don't assign too many proxies for the same user account. Multiple proxies can overwrite each other's changes.
• Don't assign too many user accounts to the same proxy. It's difficult for a proxy to maintain a close working
relationship with too many account holders.
Example
Generally speaking, it’s ill-advised to assign one person as the proxy for many account holders. For example,
it's not a leading practice to assign one Human Resources representative as the proxy for everyone in a
given location, for all business processes. Broad proxy access should be restricted to a small group of proxy
administrators only.
Proxy access isn’t the only way for one user to act on the behalf of another. Here are some alternatives to using
proxy access in some scenarios.
Set up proxy access so that a proxy can be assigned to act on another person's behalf.
Procedure
Remember
As a customer, you don't have access to Provisioning. To complete tasks in Provisioning, contact your
implementation partner or Account Executive. For any non-implementation tasks, contact Technical
Support.
Prerequisites
Remember
As a customer, you don't have access to Provisioning. To complete tasks in Provisioning, contact your
implementation partner or Account Executive. For any non-implementation tasks, contact Technical Support.
Results
Next Steps
Use role-based permission to give a small group of administrators the ability to manage proxy assignments for your
organization.
Prerequisites
Context
Proxy administrators have broad access to other people's user accounts and personal information. Limit the
number of people with Proxy Management permission as much as possible and advise them to only use it when
necessary.
Caution
People with Proxy Management permission automatically have proxy access to every user account in the
target population of the permission role, whether or not a proxy assignment has been explicitly created. For
example, an administrator with Proxy Management permission for all employees in North America can act as a
proxy for all employees in North America.
Proxy access based on the Proxy Management permission doesn't have a time range. It starts as soon as
the permission is granted and it has no end date.
Procedure
1. Identify the permission role or roles that you want to give Proxy Management permission to.
2. Ensure that the identified permission roles have the appropriate target population.
Note
Proxy Management permission requires a target population. You can only create a proxy assignment if both
the account holder and the proxy are in the target population of the role.
3. For each identified permission role, go to Administrator Permissions Manage User and grant Proxy
Management permission.
Results
People in the permission role can use the Proxy Management and Proxy Import pages to manage proxy
assignments. They can also act as a proxy for anyone in their target population.
Next Steps
If appropriate, give everyone in your organization the ability to assign their own proxy, without a central
administrator.
Prerequisites
Most customers choose centralized control of proxy assignments, for stricter internal controls and greater data
privacy. However, if you decide it's appropriate for your organization, you can allow all account holders to assign
their own proxy, without an administrator.
Individual control of proxy assignments is independent of central control. You can choose to simultaneously allow
central control of proxy assignment as well.
Procedure
• Select the setting to block individuals from assigning their own proxy.
• Deselect the setting to allow individuals to assign their own proxy.
3. Save.
Next Steps
Prerequisites
Procedure
This setting is only necessary if you're not using the employee directory feature. If you already use the
employee directory, it has no effect.
3. Select Enable Advanced Proxy Management (Proxy Now and Proxy Import) to enable more functionality.
If selected:
• Proxy Now appears in the user preference menu, under your name in the global page header, for anyone
with proxy rights. Otherwise, proxies have to go to Settings Proxy instead.
• The Proxy Import page enables administrators with Proxy Management permission to manage multiple
proxy assignments at the same time, using a CSV import file. Otherwise, you have to manage them one by
one in the Admin Center.
4. Choose Save Proxy Settings.
Use a CSV import file to add, edit, or remove multiple proxy assignments at the same time.
Prerequisites
Procedure
Note
There’s no export function for proxy assignments. Always start from a blank template.
3. Add a row in the import file for each proxy assignment you want to add, edit, or remove.
Tip
You can assign multiple proxies to a single account holder, using the pipe symbol (|) between IDs. For
example: jsmith|ychang
Note
Alternatively, you can identify people by Assignment ID instead of User ID. To use Assignment
ID, leave USERID and PROXYID blank and enter values in the ASSIGNMENT_ID_USERID and
ASSIGNMENT_ID_PROXYID columns instead.
4. Optional: For each row, set a time range for the proxy assignment. You can add a START_DATE, an END_DATE,
or both, in yyyy-MM-dd HH:mm format.
If you don't set a time range, proxy assignments start as soon as they’re created and have no end date. Use this
option to restrict proxy assignments to the specified time range.
Start and end times are based on the time zone of the proxy administrator who sets them, as shown
on their Employee Profile. If no time zone is defined, they're based on the time zone set on the proxy
administrator's computer or device.
For example, if you're a proxy administrator located in Germany, your profile might list your time zone as
Central European Time. Or, if it doesn't, your computer is probably set to that time zone. If you want to
create a proxy assignment for people in New York that starts at 9:00 AM and ends at 5:00 PM Eastern
Standard Time, you need to calculate and provide start and end times based on your location, starting at
3:00 PM and ending at 11:00 PM Central European Time.
5. For each row, select which product area the proxy can access in the account holder's account.
• Enter YES in the ALL column to grant proxy rights for all product areas, so that the proxy can do
everything the account holder can do.
• Enter YES in the REMOVE ALL column to remove proxy rights for all product areas for the specified
account holder and delete the proxy assignment.
• Enter YES in one or more columns named for different product areas (like Performance Manager Forms) to
grant proxy rights for specific product areas.
• Leave cells blank in one or more columns named for different product areas (like Performance Manager
Forms) to remove proxy rights for specific product areas.
Caution
• Don't enter the value NO in any column. The value NO is implied by a blank cell. If you enter NO, the
import fails for that record. Other changes in the import file can still be processed.
Caution
The Proxy Import feature doesn't support granular proxy rights for Reporting. With the CSV import file, you
can only grant or remove all proxy rights for Reporting, for all proxy assignments in the file. You can only
grant granular proxy rights in the user interface (either in Proxy Management or in personal user settings).
• If the import file says YES in the Reporting column and granular Reporting proxy rights are already
granted in the user interface, then the existing granular Reporting proxy rights are retained. The
import file doesn't change them.
• If the import file says YES in the Reporting column and proxy rights for Reporting haven't been
granted yet or it's a new assignment, then all Reporting proxy rights are granted by the import file.
• If the import file is blank in the Reporting column, then all Reporting proxy rights are removed by
the import file.
Tip
Some proxy rights are dependent on others. In the Proxy Management tool, these dependencies are
enforced by the user interface. But in the CSV import file, they appear as separate columns. To avoid errors
with the import, be sure to select the same proxy rights in the CSV file that you're allowed to select in the
user interface.
Tip
Use the REMOVE ALL column to periodically delete proxy assignments for inactive users in bulk.
Example
For example, an import file like the following table would create a proxy assignment for user02 to act as
the proxy for user01. For simplicity, this example only shows columns for Goal Management, but, in most
cases, there are many more columns. Notice that all of the proxy rights for Goal Management are granted
to the proxy user except for Private Objectives. That means that the proxy doesn't have access to that
account holder's private goals.
START_ END_D
AS- AS- DATE(y ATE(yy Total Career
SIGN- SIGN- yyy- yy-MM- Goal Devel-
MENT_I MENT_I MM-dd dd Man- Private opment
D_USE PROX- D_PRO HH:mm HH:mm Remove Goals age- Objec- Plan-
USERID RID YID XYID ) ) All All Tab ment tives ning
6. Save the import file in CSV format and go back to Admin Center Proxy Import .
7. Choose the saved import file.
8. Select the appropriate character encoding.
9. Choose Import Proxies and then OK to confirm.
Results
Use the Proxy Management page in the Admin Center to add, edit, look up, or remove proxy assignments.
Caution
If users have proxy permissions assigned to them from both Role-based Permissions and from the Proxy
Management screen, then those users will not show up on the User Data File. If you want users to appear on
the User Data File, make sure their proxy permissions are assigned only through Proxy Management.
Create a proxy assignment so that the specified proxy can act on behalf of the specified account holder.
Prerequisites
Procedure
Note
Some checkboxes are indented to indicate that they have a dependency on another checkbox. For example,
the Private Objectives checkbox is indented under the Total Goal Management checkbox because it has a
dependency. You can only select Private Objectives if you also select Total Goal Management.
4. Optional: Set a time range for the proxy assignment. Select a Start date and time, an End date and time, or
both.
If you don't set a time range, proxy assignments start as soon as they’re created and have no end date. Use this
option to restrict proxy assignments to the specified time range.
Start and end times are based on the time zone of the proxy administrator who sets them, as shown
on their employee profile. If no time zone is defined, they're based on the time zone set on the proxy
administrator's computer or device.
Example
For example, if you're a proxy administrator located in Germany, your profile might list your time zone
as Central European Time. Or, if it doesn't, your computer is probably set to that time zone. If you
want to create a proxy assignment for people in New York that starts at 9:00 AM and ends at 5:00 PM
Eastern Standard Time, you need to calculate and select start and end times based on your location,
starting at 3:00 PM and ending at 11:00 PM Central European Time.
5. Choose Save.
Note
Choose the Save button immediately following the checkboxes, not the Save Proxy Settings button at the
bottom of the page.
Results
The proxy can access the account holder's user account, with proxy rights only for the areas of the system you
selected. In those places, they can see everything that you can see and can act on your behalf. If you specified a
time range, they only have proxy access during that time period.
Prerequisites
• Enter a name in the Account Holder field and choose Search for Proxy
• Enter a name in the Proxy field and choose Search for Account Holders to see a list of account holders for
whom the specified person is a proxy. to see a list of proxies for the specified person.
Results
Note
to see a list ofStart and end times are displayed in your time zone, as the logged-in proxy administrator, as
defined on your employee profile. If no time zone is defined on your profile, they're displayed in the time zone
set on your computer or device.
Next Steps
For each proxy assignment listed, you can delete it or edit the start and end time.
Set a time range for an existing proxy assignment so that it starts or ends at a specified date and time. You can add
a start date, an end date, or both.
Prerequisites
You've looked up the existing proxy assignments for an individual proxy or account holder.
Context
Setting a time range is optional. If you don't set a time range, proxy assignments start as soon as they are created
and have no end date.
Procedure
1. Review existing proxy assignments for the specified person, in the Look Up Existing Assignments section of the
Proxy Management page.
2. Select the people whose proxy assignment you want to set a time range for.
3. Choose Edit.
4. For each proxy assignment, select a Start date and time, an End date and time, or both.
Note
Start and end times are based on the time zone of the proxy administrator who sets them, as shown
on their employee profile. If no time zone is defined, they're based on the time zone set on the proxy
administrator's computer or device.
Example
For example, if you're a proxy administrator located in Germany, your profile might list your time zone
as Central European Time. Or, if it doesn't, your computer is probably set to that time zone. If you
want to create a proxy assignment for people in New York that starts at 9:00 AM and ends at 5:00 PM
Eastern Standard Time, you need to calculate and select start and end times based on your location,
starting at 3:00 PM and ending at 11:00 PM Central European Time.
5. Choose Save.
Results
The time ranges you define take immediate effect. The proxy now only has access to the account holder's account
during the specified time range.
Delete a proxy assignments for a specified proxy or account holder, after its end date or when it's no longer needed.
Prerequisites
You've looked up the existing proxy assignments for an individual proxy or account holder.
You can only view proxy assignments for one person at a time. To make multiple changes at once, use Proxy Import
instead.
Procedure
1. Review existing proxy assignments for the specified person, in the Look Up Existing Assignments section of the
Proxy Management page.
2. Select the checkbox next to the names of people you want to remove from the proxy assignment.
3. Choose Delete.
Results
To create proxies with unrestricted access, for test purposes only, add proxy assignments to the user data file.
Prerequisites
You have permission to manage user information for a target population that includes both the account holder and
the proxy.
Context
Caution
To protect data privacy, don't use this proxy assignment method in a production system with real user data.
A proxy assigned with this method can see and do everything the account holder can see and do, including
sensitive personal data.
Use this method in a Test or Preview instance to quickly grant unrestricted proxy rights, for convenience during
testing. If you don't plan on using proxy access in production, but want to use it during testing only, this method is
simpler. Just remember to remove the unrestricted proxy assignments before moving user data to your production
instance.
Procedure
Identify proxies by User ID and separate multiple proxies with a pipe (|) character.
4. Import the user data file.
The assigned proxy now has unrestricted access to the corresponding account holder's user account.
5. Use the proxy user account for testing so that you can quickly test features as people in different roles.
6. When you're done with testing, remove proxy assignments by exporting the user data file, clearing all values
from the Proxy column, and importing it again.
Audit reports enable you to track changes that are made to proxy assignments or see when other changes are
made by a proxy.
You can use the Proxy Assignment Change audit report to see who made changes to proxy assignments, over a
given time range, and which proxy rights were granted or removed.
In any change audit report, you can use the Proxy: Logged in User columns to see if a particular change was
made by a proxy.
If it was, these columns show the first name, last name, and username of the proxy who made the change. The
Changed By User columns show the first name, last name, and username of the account holder whose account
was used.
Note
For details on how to create change audit reports and how to read the Proxy Assignment Change report, refer to
the Change Audit guide.
Related Information
Prerequisites
Procedure
1. Open the menu under your photo in the global page header at the top of any page, and choose Settings to view
your personal user settings.
You see a list of your existing proxies and the specific areas of the system they’re allowed to access on your
behalf.
3. Add or select the person you want to act as your proxy.
• To add a new proxy, choose Add a proxy. Then find and select someone.
• To edit proxy rights for an existing proxy, select their name on the list.
4. Use checkboxes in the Grant Proxy Rights section to select specific areas of the system that the proxy can
access.
5. Optional: Set a time range for the proxy assignment. Select a Start date and time, an End date and time, or
both.
If you don't set a time range, proxy assignments start as soon as they’re created and have no end date. Use this
option to restrict proxy assignments to the specified time range.
Note
Start and end times are based on your time zone, as shown on your employee profile. If no time zone is
defined, they're based on the time zone set on your computer or device.
Example
For example, if you're located in Germany and you create a proxy assignment that starts at 9:00 AM
and ends at 5:00 PM, the proxy access is based on Central European Time. If your proxy is located in
New York, the assignment starts at 3:00 AM and ends at 11:00 AM Eastern Standard Time.
6. Save.
Results
The person you assigned as your proxy can now access your user account and act on your behalf in the areas of the
system you specified. If you specified a time range, they only have proxy access during that time period.
Remove a proxy assignment so that your assigned proxy can no longer access your account.
Prerequisites
Administrators of the system have allowed you to assign your own proxy.
Procedure
1. Open the menu under your photo in the global page header and choose Settings to view your personal user
settings.
You see a list of your existing proxies and which specific areas of the system they’re allowed to access on your
behalf.
3. Choose X next to the name of an existing proxy to delete the proxy assignment.
4. Choose OK to confirm.
Results
The proxy assignment is removed. The person can no longer access your account as a proxy.
If you've been assigned as someone's proxy, you can use proxy access to access their account and act on their
behalf.
Prerequisites
You've been assigned as the proxy for a given account, either by the account holder or by a proxy administrator.
Context
There are different ways to initiate and end proxy access, depending on how the system is configured. Choose the
method that's more convenient for you.
Procedure
• Open the menu under your photo in the global page header and choose Proxy Now if the option is available.
Then find and select the account holder that you're a proxy for.
• Otherwise, open the menu under your name, at the top of any page, and go to Settings Proxy
Become Proxy . Then find and select the account holder that you're a proxy for and choose Go.
Note
In search results, you can see all account holders that you're a proxy for, but if the proxy assignment has a
specified start date and it hasn't started yet, you can't initiate proxy access. Try again after the start date.
You’re navigated to the account holder's home page. You can see that you’re acting as a proxy by hovering on
the avatar photo in the page header and confirming that there's a "on behalf of" message. For example, if Carla
Grant is acting as proxy for Geoff Hill, it says "Carla Grant on behalf of Geoff Hill".
2. Navigate to an area of the system that you have proxy rights for and take the required action.
3. End proxy access.
• If you used the Proxy Now option in Step 1, use the same menu to choose Become Self.
• If not, use the same menu to go to Settings Proxy Become Self .
You’re navigated back to your own home page. You can see that you’re no longer acting as a proxy by hovering
on the avatar photo in the page header and confirming that the "on behalf of" message has disappeared. For
example, after Carla Grant stops acting as proxy for Geoff Hill, it just says "Carla Grant".
Understand the key differences between delegation and proxy features, so you know when and how to use each one
to manage tasks and permissions effectively.
Below is a table outlining the key differences between the delegation and proxy features to help you understand
when to use each.
Proxy Delegation
Proxy access grants full access into the account holder's mod- Delegation includes a workflow between one individual and
ule information/permissions that the account holder has when others to whom they wish to delegate a specific task within
you are granted that proxy relationship the context of a product.
Example: Granting Proxy rights to Performance Management Example: Delegating a Performance Review
Function: Gives the proxy user full permissions/access to sub- Function: Gives the delegatee access only to the form(s) for
ject user's forms, overview, inbox and all information on the which the assessment/review is required.
form.
As you can see from the table above, if you're looking to give someone full access to an account holder’s
module information and permissions, then you'd use Proxy. For example, granting Proxy rights in Performance
Management allows the proxy user to manage forms, the inbox, and all relevant information as if they were the
account holder themselves.
On the other hand, if you need to assign a specific task to someone without granting full access to an account,
Delegation is the better option. For instance, delegating a Performance Review gives the delegatee access only
to the form necessary for completing the review, without providing broader access to the account holder's
information.
When using the delegation feature, you might see some error messages if things don't work as expected. This
resource explains what those errors mean and gives you steps to fix them. If you can’t resolve the issue, your
system administrator is always there to help.
Permission Error Occurs when there is an issue with user • Ensure you have the required admin
permissions (e.g., missing admin, delega- permissions.
tor, or subject permissions).
• Check that the delegator has proper
delegator-delegatee and delegator-
subject permissions.
• Contact your system administrator
to review permissions.
Bad Request Error Occurs when there’s an issue with the • Verify the delegation data is valid.
request (e.g., invalid data, user roles, or
status conflict).
• Ensure that both the delegator and
delegatee are active users with ap-
propriate roles (e.g., not inactive or
temporary users).
• Avoid starting multiple tasks in the
same session.
• Avoid simultaneous tasks in the
same session.
• Contact your administrator if issues
persist.
Delegation Not Enabled Error Occurs when the delegation feature or • Confirm the delegation feature is en-
specific task type is disabled. abled
• Check that the specific task type is
allowed in the system.
• Contact your system administrator
for assistance.
Other Non-Specified Error An unexpected error occurs that doesn’t • Try refreshing the page or logging in
fit into the other categories. again.
• If the issue continues, contact your
system administrator.
By following these steps, you should be able to resolve most delegation issues on your own. If you still run into
problems or need extra help, don't hesitate to reach out to your system administrator for support.
Learn about changes to the documentation for proxy access in recent releases.
2H 2024
New We added the topic "When to Use Delega- When to use Delegation vs. Proxy: Under-
tion vs. Proxy: Understanding the Differ- standing the Difference [page 25]
ence".
New We added the topic "Understanding Dele- Understanding Delegation Errors [page
gation Errors". 26]
2H 2311
2H 2021
Changed We added a note about Reporting proxy Creating, Editing, or Deleting Proxy As-
rights in the Proxy Import file. signments with an Import File [page 12]
1H 2022
Changed You can now remove proxy assignments Creating, Editing, or Deleting Proxy As-
for inactive users in bulk, using Proxy signments with an Import File [page 12]
Import.
Changed You can now remove proxy assignments Creating, Editing, or Deleting Proxy As-
for inactive users in bulk, using Proxy signments with an Import File [page 12]
Import.
1H 2021
Changed Account holders can now restrict proxy Assigning a Proxy to Act on Your Behalf
assignments to a specified time range [page 22]
when they assign a proxy in their per-
sonal account settings. Previously, time-
based assignments weren't possible on
the Settings page.
Hyperlinks
Some links are classified by an icon and/or a mouseover text. These links provide additional information.
About the icons:
• Links with the icon : You are entering a Web site that is not hosted by SAP. By using such links, you agree (unless expressly stated otherwise in your agreements
with SAP) to this:
• The content of the linked-to site is not SAP documentation. You may not infer any product claims against SAP based on this information.
• SAP does not agree or disagree with the content on the linked-to site, nor does SAP warrant the availability and correctness. SAP shall not be liable for any
damages caused by the use of such content unless damages have been caused by SAP's gross negligence or willful misconduct.
• Links with the icon : You are leaving the documentation for that particular SAP product or service and are entering an SAP-hosted Web site. By using such links,
you agree that (unless expressly stated otherwise in your agreements with SAP) you may not infer any product claims against SAP based on this information.
Example Code
Any software coding and/or code snippets are examples. They are not for productive use. The example code is only intended to better explain and visualize the syntax and
phrasing rules. SAP does not warrant the correctness and completeness of the example code. SAP shall not be liable for errors or damages caused by the use of example
code unless damages have been caused by SAP's gross negligence or willful misconduct.
Bias-Free Language
SAP supports a culture of diversity and inclusion. Whenever possible, we use unbiased language in our documentation to refer to people of all cultures, ethnicities, genders,
and abilities.
SAP and other SAP products and services mentioned herein as well as
their respective logos are trademarks or registered trademarks of SAP
SE (or an SAP affiliate company) in Germany and other countries. All
other product and service names mentioned are the trademarks of their
respective companies.