Managing HCM Security and Users

Key points the exam tests

• Data Security via Security Profiles (Person, Organization, etc.) restricts which records a user can see at row level.
• Oracle upgrades overwrite predefined roles. Always copy a predefined role, then customize the copy to survive upgrades.
• Data Role = Job Role (function access) + Security Profile (data restriction). It grants specific functions but limits them to defined data scope.
• Run after major role mapping changes to re-evaluate all workers and ensure everyone has correct roles per current conditions.
• Field-level hiding is configured in Transaction Design Studio (HCM Experience Design Studio). A rule may be hiding the field for that user's role.
• Function Security controls which actions/pages a user can access; Data Security (via security profiles) controls which records; Row-level filters records further; Field-level (via Transaction Design Studio) controls individual field visibility.
• Oracle upgrades can overwrite predefined roles. Copying the role first and customizing the copy ensures your changes survive future upgrades.
• A Data Role bundles a Job Role (defines what actions are available) with a Security Profile (defines which records those actions can be performed on).
• Person Security Profiles support multiple scoping options — manager hierarchy, organization, position hierarchy, or custom-defined combinations — to precisely control worker visibility.
• Role Mappings define auto-provisioning logic — when an HR transaction results in a worker matching specified conditions, the mapped role is automatically granted.
• Role and user changes in HCM don't take effect for authentication/SSO purposes until synchronized to the identity directory — this process performs that sync.
• TDS is specifically for field-level behavior — e.g., hiding the salary field from non-payroll roles — configured directly without requiring sandbox activation.
• The Security Diagnostic Report is the key troubleshooting tool for access issues — it shows a specific user's full role assignments, inherited privileges, and security profiles in one place.
• Duty Roles are building blocks — collections of privileges — composed together to form Job Roles, which are the roles actually assigned to individual users.
• Abstract Roles represent broad categories (Employee, Line Manager, Contingent Worker) used to grant general self-service access, independent of a person's specific job.
• Role Mappings evaluate conditions (like job or position) at the moment of an HR transaction and automatically provision the matching role — enabling exactly this kind of automatic assignment.
• Field-level security operates at a finer grain than Function or Data Security — it can hide or restrict individual fields (like salary) even when the user otherwise has record-level access.
• Role Mapping changes only apply going forward for new transactions by default. Running this process retroactively re-evaluates the entire existing workforce against the new conditions.
• Function Security governs access to functionality (menus, pages, actions), while Data Security governs which specific data rows a user with that functional access can actually view or act on.
• The Security Console includes an administration area for configuring console-wide options, in addition to its role and user management capabilities.
• User account status can be linked to HCM employment events — a termination event can automatically trigger role deprovisioning and account suspension through role mapping conditions.
• Security audit logs specifically capture who changed what within security configuration (roles, profiles, mappings) and when — the correct place to investigate suspected unauthorized changes.
• OTBI and other HCM reporting tools should be configured to honor the same data security profiles as transactional access, preventing users from seeing report data beyond their authorized scope.
• Intermittent access to specific records often traces back to hierarchy-based security profiles (manager hierarchy, organization) where the visible population changes as underlying org/reporting relationships change.
• A Data Role bundles a Job Role (defines available functions) with a Security Profile (defines the data scope those functions apply to) — the other options are unrelated Security objects.