Four layers of F&SCM security, one complete picture

The four layers, from top to bottom

Roles

A security role is what users are assigned. A user without a role has no access. Microsoft ships about 100 standard security roles, and all functionality is associated with at least one of them. Microsoft recommends duplicating the sample roles and working with the copies, because the standard roles can change with application updates.

Duties

Duties represent parts of a business process, such as maintaining bank transactions. Segregation of duties rules are defined at this layer, as pairs of duties the same user or role should not hold.

Privileges

Privileges represent access to tasks, such as cancelling payments or processing deposits. Microsoft recommends assigning privileges to roles only through duties, but the system also allows assigning them to roles directly.

Permissions

Permissions are access to individual securable objects: menu items, tables, fields. This is where access actually happens. Authorization is enforced at the entry point at run time.

Where reviews go blind

Reviews that reason only about the top layers inherit their blind spots. A role called Accounts payable coordinator is assumed to be limited to accounts payable. A duty called “inquire into vendor” is assumed to be read-only. Neither assumption is checked unless someone opens the lower layers.

Duty-based SoD rules have the same limitation. They compare duty names, so a privilege added directly to a role, or the same rights inside a differently named duty, never meet a rule.

What F&SCM gives you natively

F&SCM includes out-of-box security reports under System administration > Inquiries > Security:

• User role assignments shows which users hold which roles, including legal entity or organization restrictions.
• Role to user assignments aggregates the same data by role.
• Security role access gives a flattened list of effective permissions for a role across sub-roles, duties and privileges.
• Security duty assignments lists the duties in a set of roles, to help keep duties separated between roles.

These are solid building blocks, and they can run as batch jobs. A quick manual check of one role looks like this:

1. Run Security duty assignments for the role and read the duty list against the job it is meant for.
2. Run Security role access for the same role and scan for permissions that do not fit that job, such as vendor bank or payment objects in a read-only role.
3. Compare the two. Permissions you cannot trace back to a duty usually point to privileges assigned to the role directly.
4. Run User role assignments to see who holds the role, and in which legal entities.

What they don’t do on their own is combine the layers into answers to business questions across every role and user at once, or keep a review trail of what was decided.

What a complete picture means in practice

F&SCM Authorization Monitoring reads the layers together. It maps how rights are structured across roles, duties and privileges, and shows which users hold which rights, both directly assigned and inherited through roles. A role stops being a label and becomes a transparent container.

On top of that structure sit Critical Permissions, research questions you define about your Security Objects. Who can maintain vendor master data? Who can acknowledge the receipt of goods? Who can process payment to a vendor? The analysis answers each question on actual access, including privileges assigned directly to roles, and classifies results by impact.

What changes when you can see everything

• Role reviews become reviews of contents, not names. Whether a role is really limited to its title stops being a matter of trust.
• Auditor questions get answered faster. “Who can approve payments?” becomes a query result with a documented basis, not a research project across role definitions.
• Conflicts surface automatically. Combinations of Critical Permissions that break segregation of duties are detected across the whole structure and queued for review.
• Decisions leave a trail. Every finding is evaluated as Agreed, Disagreed or To Review, with reviewer, timestamp and rationale retained, and results export to Excel.

When all four layers are visible in one analysis, the question is no longer what you might be missing, but what you want to check next.