User provisioning
We know how good it feels when you start exploring Anaplan on your own. One very important area that needs special attention from you is the Users section in Anaplan. This is the section where you add users into Anaplan or remove users from Anaplan. There are other things as well that you can do in the Users section, but I wanted to grab your attention on this topic only. It is very important that you understand how to add users into the model because of the direct cost impact due to licensing, the potential to inconvenience users, and the avoidance of breaching the security of your organization.
Be very careful while venturing into Users' sections, and don’t check/uncheck any check box unless it is absolutely mandatory and you are aware of what you are trying to do. There are many cases when new Anaplanners are asked to remove the access of an individual from a model who went on to revoke their admin rights.
Adding users: When you are asked to add a colleague of yours into Anaplan Workspace there are multiple ways of doing so. I have elaborated on four different cases so that you understand all the ways of adding users and their implications.
Case I
A user needs access to only one model and should also be made a Workspace (WS) admin.
Solution: Make sure while adding their credentials, add them as Non-WS Admin with No Access to the current model.
Once added, provide them admin rights by clicking on the checkbox and give them full access to the model, provisioning them as Full Access. This will ensure that they don't get access to any other model apart from the current model.
Case II
A person needs WS admin rights and can access all the models within the workspace.
Solution: While adding their credentials, you can add them as a WS admin and give them full access to the model. This approach will give them access to all the models within the workspace.
Case III
A person needs to be WS admin, and you don’t want to provide them access to the current model.
Solution: Make sure while adding their credentials, add them as a WS Admin with no access to models. This will grant them admin rights in the WS, full access to all other models, and no access to the current model.
Final thoughts
We recommend that you add Admins using Case I, i.e., add them with no WS admin rights and no access. This is because when you provision a user for the first time in a model within a workspace, other models (not in memory) will take this as the default because it is stored at the workspace level. Once the user is added, change them to WS admin with full access. The only caveat is that if the user doesn't need to have access to all of the models within a workspace. If Admin needs to have full access to all of the models then please add using Case II.
Similarly, when removing the user from the model please change the access to no access within Model Role Column of Users Section, and don't delete the user unless you want the user to be removed from all the other models in a workspace.
Comments
-
And is of particular importance in PROD environments where WA should be at a minimum, essentially there for model syncs and other administrative tasks.
0 -
This content has been removed.
-
Great post @Misbah!
One thing that would have been nice to have is the ability to more easily maintain an existing user's access to models for a particular Workspace.
As an example, if a user who only has access to 2 models and now needs to be given access to 10 more models as his/her role in the business has changed, my understanding is that a WS Admin would need to manually go to each of the 10 models individually to give the user access to the models.
An appropriate area to do this maintenance might be in the Workspace section of the Administration function that a Tenant Admin would have access to (see below). Unfortunately, I don't have Tenant Admin rights to be able to see what's in the Users tab to check if this functionality already exists but I believe it doesn't exist yet. The snapshot below if purely from Anapedia.
2
