Designer / viewer rights in SAP Analytics Cloud, add-in for Microsoft Office

[alexander_peter]

In the recent release, the add-in has introduced a new functionality to apply designer or viewer rights in workbooks. While the designer can still access the full set of features, the viewer user has limited options to change report layouts (e.g., can not add/remove dimensions, filtering only possiblle on specified dimensions etc.).
Those rights are derived from a permission that has been recently introduced to SAP Analytics Cloud. This permission is called “Add-in Workbook”.

New permission for SAC add-in

While the new permission should have appropriate rights in the standard content roles (i.e., viewer and BI content viewer only have read rights, while all other admin, modeler or planner reporter roles have full rights) , in most custom roles, however, this permission could have no rights per default (as shown in the screenshot). This means that users with these roles are not able to work in add-in workbooks anymore.
So it is important that this permission needs to be adjusted by the administrator. You need at least read right for working as viewer in the add-in. A designer needs at least update rights.

Note that this new permission is NOT available in Datasphere-only tenants. You need to have BI subscription when using SAC add-in.

[JefB]

Hi Alexander,

Can a user be a designer for one area (model/folder/workspace in LOB A) and a viewer in another area (model/folder/workspace in LOB B)?

[alexander_peter]

Hi Jef,

thanks for your question! For now, the permission is only on user level.

It is planned to have a workbook-related permission once OCEAN is integrated in SAC repo. 

In addition, there are several ideas of introducing more flexibility on authorizations on story level - when this is happening, we are following this for SAC add-in (on workbook level).

Best,

Alex

[Agata]

Hello Peter, are those on the roadmap already?

[Agata]

Additional question - on the BO permission were designed similar way, but when user downloaded workbook and saved that locally he could for example add additional column with dimension from the query. Will that be still possible or workbook is completely not editable, no matter where saved?

[alexander_peter]

Hi,

repo is on the roadmap (could make it until QRC1). Other things are still in discussion with SAC team.

Best,

Alex

[alexander_peter]

A workbook designed by "designer user" cannot be changed (significantly) by a "viewer user". Even not in "save as" case. However, a viewer user will be able to create own workbooks with almost full rights - except planning.

Best,

Alex

[Agata]

Hi Alex, thanks for both answers. I have to test that!

[ezaidman]

Alex,

Do the Add-in Workbook permissions only apply to creating, editing, and deleting tables within Excel add-in workbooks?  What permissions would a user with a View-only role in a browser need to be able to create their own Excel add-in tables or edit one someone else shared with them?

Thanks

[alexander_peter]

Hi Enrica,

I try to anticipate the documentation on this in brief:

• User with designer rights ("update" permission in SAC add-in privilege): like before, this user can do everything (planning, etc.) in ALL workbooks


• user with viewer rights ("read"):
  
  
  
  • can open existing workbooks, but not change layout (i.e. adding/removing dimensions), only filter on "permitted" dimensions, can plan (if allowed by workbook designer)
  
  
  • can create own (local) workbooks with any model, can navigate and filter on them, but cannot plan
  
  
  
  

Hope that helps.

Best,

Alex

[panwccap]

Can you please clarify what all of the check boxes in the role do? (I've taken my best guess below)

 

Create - Does this have any function, or should we leave it unchecked for now?

Read - Described above

Update - Allows edit access to excel add-in tables, same as before.

Delete - Does this have any function, or should we leave it unchecked for now?

[alexander_peter]

Hi Chris,

this privilege will also be used later when when SAC add-in can store workbooks in SAC repository. So most of the rights you see are not relevant until the repo intergation will be available (planned early next year).

For the designer/viewer rights only "update" (designer) and "read"(viewer) are relevant. If nothing is set, the user won't be able to use SAC add-in going forward.

Best,

Alex

[JefB]

Hi alexander.peter how about Datasphere-only users? How do you assign this privilege to them?

[alexander_peter]

Hi Jef,

it is related to the user who logs into SAC add-in (which needs to be a SAC user).

Best,

Alex

[JefB]

ok, so I guess the SAC add-in will not work anymore for Datasphere users (old/embedded SAC users)

[alexander_peter]

There's no change ... but you need an SAC user to log on ... you cannot log on to Datasphere stand-alone

[KMS71]

Hi Jef, good question as I would have hoped that the Embedded SAC within Dataspehere could be used. Not tested this yet as we are currently testing the ad-on against Datasphere Analytic Models but having to go via standalone SAC which then exposes the various connections (wea can also cosume S4 Cloud queries this way). I will give an update is I can find a sandbox environmemt to test this in.

Regards

Kris

[JefB]

I know it works today but should be discouraged because it's phased out:
Analytics Optimization – SAP Analytics Cloud and SAP Data Warehouse Cloud now on two tenants! | SAP ...
I guess this will be totally blocking after this change.

[alexander_peter]

Hi Jef,

you made a good point. I just checked the embedded SAC (in single-tenant Datasphere) does not contain the "Add-in workbook" privilege. However, you can switch to the SAC app (on the upper right corner) to see the SAC user privileges. Please make sure you maintain them as described above.

Best,

Alex

[alexander_peter]

Hi Jef,

please see my update above. We need to deactivate the feature for Datasphere-only tenants (both single-tenant and two-tenant set-ups) for the time being.

Best,

Alex

[amrita_goswami]

Hi Alex,

We have been using SAC Excel Workbooks to input and publish data. However over the past 2/3 weeks we noticed that in one of our Workbooks the Publish Button is greyed out after 'Process Data' button is clicked.

The underlying Role has the following permissions:

Please suggest if some setting is missing here.

 

Thanks & Regards,

Amrita

[alexander_peter]

Hi Amrita,

the new feature has not been rolled out yet. So it needs to be a different issue. If you do not find a solution, please open a customer ticket and we'll look into it.

Best,

Alex

[S_van_Kolck]

Hi Alexander,

does this mean we cannot use the Excel Add in function for only Datasphere customers? We are working on a customer project right now where this is a key element for the implemenation. They require a Excel plugin for Analytical Models in Datasphere. Customer is a Datasphere Only tenant.

How do we need to move forward now with this client?

I can recommend you to postpone the implementation of these new restrictions rights till also Datasphere is sorted.

Gr

Sander

 

 

[Oleks_Master]

Hi Alexander,

Currently, designers and users can save Excel workbooks on their local PC only. Is it right?

Best regards,

Oleksandr

[alexander_peter]

Hi Sander,

SAC add-in continues to work on pure Datasphere tenants as before - as long as the privilege is not available there (we're working on that). So for your customer, there's no change wrt designer and viewer rights from the next release on (planned for Nov 20).

SAC tenants need to be configured wrt to add-in workbook privilege to continue working ...

Best,

Alex

[alexander_peter]

Hi Oleksandr,

SAC add-in cannot influence the right to store workbooks on local PC. There's no change ... everyone can save workbooks locally ..

Best,

Alex

[Oleks_Master]

Thanks Alexander. But the question was a little bit different. I could not believe that workbooks cannot be saved on SAC Server. Could you confirm this please?

BR, Oleksandr

[alexander_peter]

Hi Oleksandr,

no saving of workbooks to SAC tenant is not yet possible. We are working on this. Tentatively planned for QRC1 2024.

Note that for this feature the same privilege "Add-in workbook" will be checked to define if a user can store, update, read or delete the file. So if you are maintaining the roles now, please also consider the future repository integration.

Best,

Alex