Using Planning Server roles

The Global Administrator role has a system-wide scope. The other administrative roles have either an application scope or a model-site scope.

At the application level, a user in the Modeler, Data Administrator, or User Administrator role has permissions for all model sites in the application.

At the model-site level, a user in the Modeler, Data Administrator, or User Administrator role has permissions only for the specific model site.

Each role enables its members to perform a specific set of tasks within a specific scope.

The following table provides a high-level description of the administrative roles. Users who belong to multiple administrative roles can perform all tasks that are associated with each role.

A user who belongs to the Global Administrator role cannot connect to a server in Planning Business Modeler unless he or she also belongs to another administrative role. The only exception is to create the first application on Planning Server. A user who belongs only to the Global Administrator role can open Planning Business Modeler to create the first application.

Members of the Global Administrator role can perform the following tasks:

• Create or delete applications and model sites

• Add users to or remove users from the User Administrator role for the model site

Typically, members of the Modeler role have both the technical and business expertise to perform modeling tasks. Members of the Modeler role can perform the following tasks in Planning Business Modeler within their scope (application or model site):

• Create, modify, or delete models, dimensions, and member sets.

• Deploy models and model sites.

• Create, modify, or delete assumptions.

• Create, modify, or delete cycles, workflow assignments, and calendars.

• Create, modify, or delete associations.

• Create, modify, delete, or run rules.

• Create, modify, delete, or run jobs. However, they cannot run Data Load, Data Export, or Data Movement jobs.

• Create, modify, or delete business roles within their scope. However, only members of the User Administrator role can manage role membership.

Users who are assigned to the Modeler role have unrestricted Read and Write access to all business data within their scope. This is true even if they belong to a business role that has restricted settings.

Members of the Data Administrator role use Planning Business Modeler and the PerformancePoint Command Utility (ppscmd) as the primary tools for data integration tasks. Members of the Data Administrator role can perform the following tasks in addition to all Modeler role tasks:

• Run, synchronize, or load associations.

• Run Data Load, Data Export, or Data Movement jobs.

• Synchronize data to and load data from the application or staging database.

Planning Business Modeler uses the PerformancePoint Service Identity (SI) account to perform data integration tasks on a staging or application database. This account must have explicit permissions to the Microsoft SQL Server 2005 database.

Users who are assigned to the Data Administrator role have unrestricted Read and Write access to all business data within their scope. This is true even if they belong to a business role that has restricted settings.

Typically, members of the User Administrator role are executive administrators and business analysts. Members of the User Administrator role can do the following tasks in Planning Business Modeler:

• Assign users to and remove users from Data Administrator, Modeler, and User Administrator roles that have a model-site scope.

• Assign users to or remove users from business roles in the model site.

• Edit user permissions for a member set in the model site. This feature must first be enabled by a member of the Data Administrator or Modeler role.