Managing Users, Groups, Roles, and Permissions

SAP Integration Suite, advanced event mesh Account Administrators can manage the roles assigned to other advanced event mesh users. As an Account Administrator, you can assign roles to users. Each role has defined permissions, which allow or deny access to different sets of features in advanced event mesh.

The advanced event mesh user management system has the following components:

Permissions: Permissions provide your users with appropriate levels of access to advanced event mesh features based on the work they need to do.
Roles: Roles are sets of permissions that can be assigned to users. Users can have different roles in separate organizational accounts. For example, a user can have the Account Administrator role in one account, the Mission Control Viewer role in a second account, and the Event Portal Manager role in a third account.
Users: Users with the Account Administrator role can add, edit, and delete other users and manage the actions users can perform by assigning one or more roles.
User Groups: You can create user groups and assign one or more roles to each group. When users are assigned roles through user groups, roles assigned to individual users are ignored. You add users to groups by mapping claims from your identity provider (IdP) to automatically assign users to a group when they log in to advanced event mesh.

For information about adding and managing users, see Configuring User Access.

User Management

User management includes a wide range of functionality, such as adding and deleting users, and controlling user activity through role assignments. SAP recommends following the security best practice to assign a role with the fewest permissions that a user requires.

The User Management tab on the Account Details page provides Account Administrators with a dashboard to view and manage users, groups, roles, and permissions. You can manage roles and permissions in two ways:

Manually through the user management settings. For more information, see Configuring User Settings Manually.
Use group management to map claims received from your IdP to the user groups in advanced event mesh and automatically add users to groups. For more information, see Managing User Groups.

Roles and Permissions

Roles provide sets of permissions to users for role-based access control (RBAC). You can assign one or more roles to each user. For example, you can assign a user the Mission Control Manager role to give them access to create and modify event broker services and event meshes in Cluster Manager and Mesh Manager. You can assign roles manually or dynamically using group management.

advanced event mesh users can have the following roles:

Account Administrator: Account Administrators can create, manage, and delete users and event broker services. Account Administrators can also grant or deny access to Event Portal. This permission gives the user all the other roles listed here with the exception of the Insights Advanced Editor role. As an Account Administrator, you can self-assign the Insights Advanced Editor role to yourself.
Mission Control Manager: Users with the Mission Control Manager role can create, modify, and delete event broker services in Cluster Manager. They can also create, modify, and delete event meshes in Mesh Manager.
Mission Control Viewer: Users with the Mission Control Viewer role can view the details of an event broker service in Cluster Manager, but can't edit or delete them. They can also view, scan, and run Health Checks on event meshes in Mesh Manager. If you have user groups configured, you can assign extra permissions to Mission Control Viewers for specific event broker services.
Mission Control User: The Mission Control User role is available only if you have user groups configured. Mission Control Users have limited viewing access in Cluster Manager. They can't see event broker services they are not assigned permissions to and they have no access to Mesh Manager. Users can be given greater access to event broker services by assigning permissions to them. For more information about event broker service-specific access levels, see Configuring User Access to Event Broker Services.
Event Portal Manager: Users with the Event Portal Manager role can view, create, and modify all application domains and modeled event meshes in Event Portal. Event Portal Managers can also give additional permissions to users with the Event Portal User role to provide greater access to specific application domains and to modeled event meshes within specific environments.
Event Portal User: Event Portal Users have limited viewing and editing access for application domains and modeled event meshes in Event Portal. Event Portal Users can be given greater access to specific application domains and to modeled event meshes within specific environments. For more information about Event Portal-specific roles and user permissions, see Managing User Access to Event Portal.
Insights Advanced Manager (Controlled Availability): If your organization has this feature, you can assign a user the Insights Advanced Manager role. Users with this role have access to the Datadog setup that is part of Insights. Users with the Insights Advanced Manager role can view, edit, create, and clone dashboards and monitors.; Insights Advanced Managers can also manage Datadog API and APP keys, as well as Datadog Integrations. For more information, see Insights Advanced Manager Role.; Access to all Insights Advance roles require a Insights subscription. You must agree to the acceptable use policy (AUP) for Insights before assigning any Insights Advance roles to users. Assigning an Insights Advance role to a user triggers an invitation email to the Datadog account. This Datadog account is separate from advanced event mesh. Insights Advance roles provide access beyond the access provided by the Administrator role.
Insights Advanced Editor: Users with the Insights Advanced Editor role have access to the Datadog setup that is part of Insights. Users with the Insights Advanced Editor role can view, edit, create, and clone dashboards and monitors.; Access to all Insights Advance roles require a Insights subscription. You must agree to the acceptable use policy (AUP) for Insights before assigning any Insights Advance roles to users. Assigning an Insights Advance role to a user triggers an invitation email to the Datadog account. This Datadog account is separate from advanced event mesh. Insights Advance roles provide access beyond the access provided by the Administrator role.
Insights Advanced Viewer: Users with the Insights Advanced Viewer role have access to view dashboards and monitors inside the Datadog setup that is part of Insights. They do not have permission to edit, create, clone, share, or perform any other actions to the dashboards and monitors.; Access to all Insights Advance roles require a Insights subscription. You must agree to the acceptable use policy (AUP) for Insights before assigning any Insights Advance roles to users. Assigning an Insights Advance role to a user triggers an invitation email to the Datadog account. This Datadog account is separate from advanced event mesh. Insights Advance roles provide access beyond the access provided by the Administrator role.
Micro-Integration Manager: Users with the Micro-Integration Manager role have access to view, create, modify, delete, and deploy Micro-Integrations.
Micro-Integration User: Users with the Micro-Integration User role have access to view Micro-Integrations. They do not have permission to edit, create, deploy, or perform any other actions on Micro-Integrations.

Group Management

You can assign roles to user groups instead of directly to users and map claims received from your IdP with your user groups to automatically add users to groups. When group management is enabled, users are automatically added to groups based on the claim mapping that you have configured. For example, if your IdP returns a claim value such as service_manager, users with that claim value would be automatically assigned to the user group that the claim value is mapped to. If no claim returned for the user is mapped to a group when a user authenticates, the user can be added to a default role or denied access.

After you configure group management you can continue to invite new users manually or you can enable just-in-time provisioning to add new users to groups based on the existing claim mapping configuration when a user successfully authenticates using SSO. Enabling just-in-time provisioning with group management allows you to extend SSO to event broker services.

To set up group management for your account, see Configuring Group Management.

Provide feedback