Hi @jim_ma, thanks for your question, happy to help.
User management is definitely a hot topic and a tricky one. I’ll start with one of our guiding philosophies about model maintenance which might help set a better context for my answer. Overall, we believe that all interactions with the model, even from an administrative perspective, should be driven from dashboards (as opposed to the model settings tab). If the model is constructed properly, nobody should need to go into the model settings as part of their daily/weekly/monthly job, even as system administrators.
So, with that in mind, we always build an Employee Management dashboard. Depending on your model strategy and level of maturity, this might be its own model, or might exist in a Data Hub, but for most new customers implementing Anaplan for the first time we usually just put this in the primary model we are building at first.
On this dashboard we manage everything from who works for the company and who will have Anaplan licenses, including their model role and selective access visibility. We need to know everybody who works for the company so that we can tag and report by people, even if they aren’t Anaplan users. For example, in a Sales Forecasting implementation, we would need to know the Sales Rep who owns an Opportunity, which means we would need a full list of everybody who works in the Sales Organization, even if only Managers and above would actually use the model.
Then for User management, we use a module on this dashboard to set the User Role (a custom list with the same value as the actual user roles in user settings), we use Booleans to say which subset this person may belong in (for example splitting out Sales Reps from Sales Managers, if we have modules that only apply to Managers), and we allow people to set selective access (should they only see a specific region, etc.). Through import actions published on this dashboard we can create Anaplan licenses, set roles, subsets, and selective access, all from this one dashboard. Happy to get more technical on this part if it would help.
So I think that answered a few of your questions but really was just a rant on my opinions of best practices of user management. So for the sake of completeness I’ll go back through one by one:
- 1) I don’t think you can actually reorder the Users settings list, but if you use the Employee Management dashboard then you can change your sorting/filtering and interact with the user settings in a much more usable manner.
- 2) Using subsets or any driver line item on the Employee Management dashboard, it would be easy to filter or group your users. From my example above, if you used Booleans to say whether somebody was a Sales Rep or a Sales Manager then you could filter on those Booleans to only manage one group of them.
- 3) I’d use the same sorting/filtering from previous steps, and then use copy-down/across to set the same setting for the filtered group, again from the Employee Management dashboard. Even better if you can automate this access based on other attributes of the Employee (for example, use a formula to set their access to Regions based on the Employee’s Region from an HR system).
- 4) While you COULD use a new line item formatted to the Employees dimension to say that a new user should have all the same values as an existing employee, I think this is risky and possibly over-engineering something that could be done in more flexible and simple way. So I would probably go with a Copy/Paste on the Employee Management dashboard of the old user to the new user, which gives more flexibility than using formulas which would lock you out of overriding one-off individual attributes. Again much easier to do from an Employee Management dashboard than from the User settings.
- 5) This one is tricky, because the email address is the unique identifier that links your Employee dimension to the Users list. I’m not sure I have a better answer for you on this one other than to manage this exception case directly from the Users settings, and to be honest I don’t think you can modify a user’s email address after they have received a license, so you might just need to treat them as a new user altogether (which is easier, just update the email address attribute on Employee Management and Anaplan will do the rest to create the new user with all the same settings as the current user), but you’ll still need to remove the old license to keep the model clean.
- 6) 2 ways, the first way is to just take the model offline, like you would do when synchronizing through ALM (locks out everybody except Workspace Admins while you validate the deployment was successful). Second way would be to update everybody to a new a Model Role with very limited access. You can even use an import with a formula hard-coding the specific model role you want to use, so running that individual import would temporarily update all model roles, and then you can use your standard Update Employees process action to reset whatever model role was actually set on the Employee Management dashboard.
- 7) (From @ThierryP, nice to see some Accenture love here!) I think the only way to do this is through Tenant Administration (which I’m admittedly not up to date on), though you can use Employee Management in the new model to set all Model Roles to No Access which would effectively accomplish the same goal.
Hope that helps, I know that’s a lot to digest!
-Chris Weiss
