Permissions Manager Best Practice

[wiaccino]

We're wondering if the main Concur administrators should be the Permissions managers or if a separate team is responsible for maintaining permissions. I'm the main administrator and have the Role Administrator permission. It allows me to adjust my own permissions which seems wrong. What is the best practice for this permission? Should it be with the main administrators or a separate team in IT?

[KevinD]

@wiaccino I don't believe there is any hard and fast rule about this so each company determines who is in charge of assigning permissions. I do understand the concern of being able to assign yourself permissions. Maybe this is something you discuss internally to determine if there should be someone else in charge of assigning permissions and maybe their only role is Role Administrator. The Role Administrator permission is what we call group aware. What that means is lets say you have three employee groups: Group A, Group B and Group C. You are assigned the Role Administrator role for Groups A and B. That means you can only assign permissions to people in those groups. So, if the employee group you belong to is Group C, but your Role Admin permissions is for Groups and A and B, you then couldn't assign yourself any new permissions. This might be something to look into and consider. 

Let me know if this makes sense and if you have any follow-up questions.

[samasuraj]

Hi  

Please check the below too. Hope it helps.

-----

Best practice is to implement Segregation of Duties (SoD) and Least Privilege access.

SAP Concur administrators can manage daily operations, but Role Administrator / Permissions Administrator access should ideally be restricted to a designated security or IAM team, or a small group of authorized administrators.

Recommended controls include:

• Separate user administration from privileged role assignments.

• Avoid self-assignment or modification of elevated permissions.

• Require documented approval for privileged access changes.

• Conduct periodic access reviews and audit permission changes.

• Maintain controlled emergency access for business continuity.

My recommendation: If you can modify your own administrator permissions, that represents a potential SoD risk.

Assign privileged access management to an independent team wherever practical.

Bottom line:Administrators should operate the system, but privileged access should be independently controlled and audited.

Thanks & Regards

--

Samantha Prathikantam

SF_EC & ECP / SAP Concur Consultant