If you work with several colleagues from one company in an ERP system, it is wise to set up different authorization levels or user roles. The larger an organization, the more different levels are often needed.

First, of course, there is the role of superuser. This role is reserved for the functional administrator of the ERP system in your company. Often this is also the project manager during the implementation process. The functional administrator adds users and can change their privileges.

Rights by department

In larger companies, there are usually several departments that may or may not need to see each other's data. For example, we regularly see at Logres that the sales department does not need to see the data of the purchasing department and vice versa.

On the one hand, it has to do with the margin they must be able to establish independently. On the other hand, it is simply a consequence of the AVG legislation.

Privacy Law

Since May 23, 2018, European GDPR legislation has applied. This states that personal data is privacy-sensitive data.

If you are allowed to see personal data, it must be because you need it for your daily work. To put it another way: if there is no logical reason why you should be allowed to see certain personal data, then they must also be protected from you.

At Logres, we can advise you on how to properly apply the AVG. At the same time, we try to keep your ERP system as open as possible to everyone. Our experience is that a transparent ERP system delivers the most in terms of efficiency and knowledge sharing. So we always advise you to shield only that which actually needs to be shielded.

Approval by executives

In addition to user roles by department, there is often a difference in the level of authorization between employees and their supervisors.

Executives, especially financial managers, often need to give a fiat on a particular purchase invoice. They therefore have rights in the system for this that normal users do not have.

However, employees may also need to be able to check each other's work based on the principle of the 4-eye policy. Here, however, it is not about setting up different user roles, but about setting up the right workflow.

View of edit

Superusers sometimes have doubts about far-reaching rights of colleagues. After all, if employees have many rights in the system, they can also "break" a lot. In practice, however, this is not so bad. There is a difference between being able to view certain data and being able to modify that data. When creating user roles, the difference between view and edit is therefore rightly made.

For many employees, being able to view certain data is enough to do their jobs correctly. Only a limited number of them actually need to be able to edit this data.

Share logins

Sometimes we see at Logres that user logins are shared with colleagues. Two or even more colleagues then work with the same login.

In practice, this is a big risk for your ERP system. When something is erroneously deleted or modified, it is difficult to find out where the mistake was made. As a result, restoring the original data is also more difficult.

So we always recommend keeping the system as clean as possible and sometimes giving users temporarily more rights and then revoking them. This is always safer than logging in under a different name.

Closed doors

Nobody likes to constantly bump into closed doors. This is why our ERP systems have set access rights so that entire programs or modules are visible to some and totally invisible to others.

Therefore, a user with less rights or other privileges usually has a different dashboard and different menus. Only if he or she unexpectedly arrives via a link on a screen for which he or she does not have permissions will he or she see a "closed door," or a notification that he or she does not have permissions for this screen or page.

Custom user roles

While our consultants can advise you on some standard authorization levels, there are also organizations where customization is needed for certain user roles.

Fortunately, this is not difficult in both Wholesale and SAP Business One. Access rights for each user can be adjusted in detail by the superuser.

Logres as superuser

For small companies and organizations where employees usually do not have much affinity with ICT, Logres is sometimes just the superuser. We can relieve you of all your worries by taking care of the tasks that are normally the responsibility of the functional administrator. Ask us about the possibilities!