Operations Guide for SAP Digital Manufacturing Cloud

Operations Guide | PUBLICDocument Version: 2202 – 2022-02-18

Operations Guide for SAP Digital Manufacturing Cloud

© 2

022

SAP

SE o

r an

SAP affi

liate

com

pany

. All r

ight

s re

serv

ed.

THE BEST RUN

Content

1 Prerequisites. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

2 Supported Data Centers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4

3 Browser and Platform Support Matrix. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

4 Onboarding and User Management. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

4.1 E-mails from SAP. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

4.2 Subscribe to SAP Digital Manufacturing Cloud. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8

4.3 Configure Authorization by Creating Role Collections. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

Role Templates. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

4.4 Manage Users and Authorization. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120

Manage Users Using SAP Cloud Identity Services - Identity Authentication. . . . . . . . . . . . . . . . 120

Manage Users Using SAP ID Service. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .128

4.5 Onboard Your Organization. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129

4.6 Activate User Account. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131

5 Prepare for API Integration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133

5.1 Assign a Service Plan to a Subaccount. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134

5.2 Create an Organization. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135

5.3 Create a Space. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135

5.4 Create a Service Instance. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .136

5.5 Create a Service Key. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136

5.6 Register an OAuth 2.0 Client. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .138

6 Manage Members in an SAP Business Technology Platform Account. . . . . . . . . . . . . . . . . . . 139

7 Add an Identity Authentication Tenant Administrator. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .140

8 Decommissioning Tenants, Data Return and Deletion. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141

9 How to Contact Us. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 142

2 PUBLICOperations Guide for SAP Digital Manufacturing Cloud

Content

1 Prerequisites

The following prerequisites are required to perform operations.

SAP Business Technology Platform Cockpit

● To create subaccounts and manage members in an SAP Business Technology Platform global account, you must be a member of the global account.

● To subscribe to applications and perform other administrative tasks like creating destinations in subaccounts, you must be a member of the global account.

● To manage trust configuration and configure authorization using role collections, you must be a security administrator in the subaccount.

SAP Cloud Identity Services - Identity Authentication Tenant

If you use SAP Cloud Identity Services - Identity Authentication to manage users, you must be a tenant administrator and assigned the appropriate roles.

After being added to the tenant as an administrator, you receive an email with an account activation link. To perform tenant administrative tasks, you must first activate the user account.

Related Information

Administrator Authorizations in SAP Cloud Identity Services - Identity Authentication

Operations Guide for SAP Digital Manufacturing CloudPrerequisites PUBLIC 3

https://help.sap.com/viewer/6d6d63354d1242d185ab4830fc04feb1/Cloud/en-US/86ee37423f8945a1898faff1e6308756.html

2 Supported Data Centers

The following data centers support SAP Digital Manufacturing Cloud:

Region Infrastructure Provider Region Host

Europe (Frankfurt) Amazon Web Services (AWS) eu10.hana.ondemand.com

US East (VA) Amazon Web Services (AWS) us10.hana.ondemand.com

US West (WA) Microsoft Azure us20.hana.ondemand.com

Europe (Netherlands) Microsoft Azure eu20.hana.ondemand.com

Some capabilities of SAP Digital Manufacturing Cloud are only supported by certain data centers.

Data Centers Supporting Data Engineering




Data Centers Supporting SAP Digital Manufacturing Cloud for edge computing




NoteChoose the data center closest to where most users of your application are located.

Related Information

SAP Business Technology Platform Regions and Service PortfolioCloud Foundry Regions and API Endpoints


Supported Data Centers

https://help.sap.com/doc/aa1ccd10da6c4337aa737df2ead1855b/Cloud/en-US/3b642f68227b4b1398d2ce1a5351389a.html

https://help.sap.com/viewer/65de2977205c403bbc107264b8eccf4b/Cloud/en-US/350356d1dc314d3199dca15bd2ab9b0e.html#loiof344a57233d34199b2123b9620d0bb41

3 Browser and Platform Support Matrix

SAP Digital Manufacturing Cloud browser and platform support matrix.

For latest information on the browser and platform matrix supported by SAP Digital Manufacturing Cloud see 2722235 .

Operations Guide for SAP Digital Manufacturing CloudBrowser and Platform Support Matrix PUBLIC 5

http://help.sap.com/disclaimer?site=https://launchpad.support.sap.com/#/notes/2722235

4 Onboarding and User Management

The onboarding process starts after your organization purchases SAP Digital Manufacturing Cloud. During the process, the contact person of your organization receives a series of emails from SAP, with instructions for next steps and additional information. If your organization does not already have an SAP Business Technology Platform global account or an SAP Cloud Identity Services - Identity Authentication tenant, the contact person is automatically assigned as the first administrator for the global account or tenant.

● Welcome e-mail from SAP Digital Manufacturing Cloud [page 7]● Provisioning Complete Notification from SAP Digital Manufacturing Cloud [page 7]● Subscribe to SAP Digital Manufacturing Cloud [page 8]● Configure Authorization by Creating Role Collections [page 10]● Manage Users and Authorization [page 120]● Onboard Your Organization [page 129]● Activate User Account [page 131]

4.1 E-mails from SAP

The contact person for an organization is responsible for the communication between the organization and SAP. The communication includes a series of e-mails from SAP.

During the provisioning process for SAP Digital Manufacturing Cloud, the contact person receives several e-mails, as listed below.

When using the application, the contact person may receive further e-mails such as upgrade notification and downtime notification.


Onboarding and User Management

Welcome e-mail from SAP Business Technology Platform

If an organization doesn't already have an SAP Business Technology Platform account, a new global account is provisioned.

The contact person receives a welcome e-mail with access information to an SAP Business Technology Platform account. An S-user (SAP user) is also created for the contact person and added as the first member of the account.

Account Activation e-mail from SAP Cloud Identity Services - Identity Authentication

If an organization doesn't already have an SAP Cloud Identity Services - Identity Authentication tenant, a new tenant is also provisioned.

The contact person receives an account activation e-mail and will be redirected to the administration console when activating the user account.

Welcome e-mail from SAP Digital Manufacturing Cloud

After an organization purchases SAP Digital Manufacturing Cloud, the contact person receives a welcome e-mail with the order details.

Provisioning Initiated Notification from SAP Digital Manufacturing Cloud

After an organization subscribes to SAP Digital Manufacturing Cloud in an SAP Business Technology Platform subaccount, SAP starts to provision SAP Digital Manufacturing Cloud. The contact person receives a notification with technical details such as the landscape and the tenant ID.

Provisioning Complete Notification from SAP Digital Manufacturing Cloud

When the provisioning process for SAP Digital Manufacturing Cloud is complete, the contact person receives a notification. This e-mail includes resources for getting started with SAP Digital Manufacturing Cloud and instructions for further actions (for example, how to request data replication from on-premise systems).

NoteThe provisioning process may take 2-3 days.

Operations Guide for SAP Digital Manufacturing CloudOnboarding and User Management PUBLIC 7

4.2 Subscribe to SAP Digital Manufacturing Cloud

Subscribe to SAP Digital Manufacturing Cloud in an SAP Business Technology Platform subaccount to trigger the provisioning process for SAP Digital Manufacturing Cloud.

Prerequisites

Your organization has purchased SAP Digital Manufacturing Cloud and the entitlement as appropriate to the license has been allocated to the SAP Business Technology Platform global account.

Context

Depending on the role of your organization (customer or partner), the license purchased, and the purpose of the subscription, different entitlements (SaaS applications) for SAP Digital Manufacturing Cloud are available.

For each customer, 2 SaaS applications for SAP Digital Manufacturing Cloud are available for subscription: one for production and one for testing. As a partner, you receive 1 application only.

CautionYou must subscribe to the production and test applications in different subaccounts.

As the production and test applications use the same services, when you subscribe to an application, you may notice that the other application is automatically subscribed. However, the subscription doesn't trigger the provisioning process for the other application. Subscribe to the other application separately in another subaccount.

Procedure

1. Log on to the SAP BTP cockpit and select a region.

CautionThe region determines the data center where the application runs. You can only subscribe to SAP Digital Manufacturing Cloud in a supported data center.

If you're unsure of the data center to choose, refer to Supported Data Centers [page 4] and contact the responsible person in your organization.

2. Select a global account.3. Open a subaccount in the Cloud Foundry environment or create a new subaccount.

If you create a new subaccount, fill in the following information:



Field Description

Display Name Define a meaningful name for the subaccount.

Environment Cloud Foundry

Provider Refer to Supported Data Centers [page 4] to select the infrastructure provider.

Region Refer to Supported Data Centers [page 4] to select the region for the data center.

Subdomain Define a subdomain that contains only lowercase letters and digits.

The subdomain is part of the application URL for SAP Digital Manufacturing Cloud. Therefore, make sure that the subdomain is identifiable and meaningful for your users.

4. Configure the entitlements of the subaccount.a. Navigate to the subaccount where you would like to configure the entitlements.b. Choose Entitlements from the left hand-side navigation to see the entitlements available for your

subaccount.c. Choose Configure Entitlements.d. Edit the entitlements table.e. Choose Add Service Plans. From the dialog select the services and the plans from each service that

you would like to add to the subaccount.

You can also edit the quota assigned to service plans during this step.f. When you're done, choose Save to save and exit edit mode.g. If necessary, repeat steps d to f to configure entitlements for your other subaccounts.

5. Subscribe to SAP Digital Manufacturing Cloud. Subscribe to the test tenant before you subscribe to the production tenant. Test tenant availability depends on your license:

License Available Test Tenant

Test and Demo SAP Digital Manufacturing Cloud for execution, Test; Plan: partnertandd

SAP Digital Manufacturing Cloud for execution SAP Digital Manufacturing Cloud for execution, Test; Plan: test

SAP Digital Manufacturing Cloud for insights SAP Digital Manufacturing Cloud for insights, Test; Plan: test

a. From the side bar menu, choose Service Marketplace.b. Search for the application SAP Digital Manufacturing Cloud.c. Choose the tile for the appropriate SAP Digital Manufacturing Cloud entitlement.d. Choose Create.e. In the dialog box that appears, select the relevant plan and choose Create.

The subscription is submitted.f. Go to Instances and Subscriptions to check the status of your subscription.


The Go to Application link becomes available. Choose the link to launch the application and obtain its URL.

CautionThe application is inaccessible until the provisioning process is complete. Therefore, share the application URL with the intended users of SAP Digital Manufacturing Cloud in your organization only when you receive a notification from SAP that the provisioning is complete.

g. If the subscription fails, see View Details and follow the steps mentioned there.

6. If you've another entitlement for a production tenant for SAP Digital Manufacturing Cloud, repeat steps 4 and 5.

License Available Production Tenant

SAP Digital Manufacturing Cloud for execution SAP Digital Manufacturing Cloud for execution; Plan: production

SAP Digital Manufacturing Cloud for insights SAP Digital Manufacturing Cloud for insights; Plan: production

SAP Digital Manufacturing Network SAP Digital Manufacturing Network; Plan: production

Results

The provisioning process has been triggered. Wait for the notification that provisioning is complete. This process may take 2–3 business days.

Related Information

Subscribe to Multitenant Business Applications Using the Cockpit

4.3 Configure Authorization by Creating Role Collections

As a security administrator for an SAP Business Technology Platform subaccount, you can configure authorization for applications and services by creating role collections. A role collection contains 1 or more roles from the same or different applications or services. Each role is created based on a role template that defines the permissions for an application or service.



https://help.sap.com/viewer/65de2977205c403bbc107264b8eccf4b/Cloud/en-US/7a3e39622be14413b2a4df7c02ca1170.html

Procedure

1. Go to your subaccount.a. Log on to the SAP BTP cockpit and select a region.b. Select a global account.c. Select a subaccount.

2. From the side bar menu, choose Security Role Collections .3. To create a new role collection, choose Create New Role Collection, enter a name, and then choose Create.4. To add roles to the role collection, choose the name of the role collection, and then Edit.5. Choose Add Role.6. In the Select: Role window, select a role, a role template, and the application identifier for SAP Digital

Manufacturing Cloud and then choose Add.

Role templates and roles have a 1:1 mapping.

The application identifier for each application or service follows a certain pattern. The table contains an overview of the applications and services that are relevant to SAP Digital Manufacturing Cloud:

Application / ServiceApplication Identifier Pattern Example Remarks

SAP Digital Manufacturing Cloud

<license>-dmc-sap-<landscape><randomString>

execution-dmc-sap!t7760

Asset Central Foundation ac_broker_<landscape><randomString>

ac_broker_live!b622

SAP Asset Intelligence Network

ain_broker_<landscape><randomString>

ac_broker_live!b622

SAP Digital Manufacturing Cloud Services

dmc-services-<landscape><randomString>

dmc-services!b3715 Relevant for integration with SAP Plant Connectivity only. For more information, see Integrate with SAP Plant Connectivity.

Audit Log Manager auditlog-management<randomString>

auditlog-management!b6316

Audit Log Viewer auditlog-viewer<randomString>

auditlog-viewer!t6316

Personal Data Manager personal-data-manager<randomString>

personal-data-manager!b6007

Retention Manager retention-manager<randomString>

retention-manager-service!b1824

SAP BTP Portal portal-cf-service<randomString>

portal-cf-service!b254


https://help.sap.com/viewer/c86ca4026fae4cb3ba66ed751866175b/latest/en-US/2aaac1f5ed104ffb850ede5942d7031d.html

https://help.sap.com/viewer/c86ca4026fae4cb3ba66ed751866175b/latest/en-US/2aaac1f5ed104ffb850ede5942d7031d.html

Application / ServiceApplication Identifier Pattern Example Remarks

UI Theme Designer sap-theming<randomString>

sap-theming!b241

Next Steps

There are 2 ways to manage authorizations. If you use a trusted identity provider, you can map role collections to user groups. Alternatively, you can assign role collections manually to users.

● If you use a trusted identity provider, map role collections to user groups in the identity provider. For more information, see Configure Role Collection Mappings [page 127].

● Assign role collections directly to users. For more information, see Directly Assign Role Collections to Users.

4.3.1 Role Templates

Find out about available role templates and the permissions each role template has.

Overview

The table contains an overview of all role templates that are available for SAP Digital Manufacturing Cloud.

Role Template Description

Global_Regional_Manager The persona is someone (such as a vice president) who is in the management team or board taking tactical decisions to optimize the manufacturing performance. A user who is accountable for manufacturing and production functions across multiple plants.

Level of access: READ, UPDATE, DELETE

Plant_Manager A user who is accountable for manufacturing and production functions of a plant and needs complete visibility into the plant's operations.


Manufacturing_Admin A user who manages plants and integration configuration



https://help.sap.com/viewer/65de2977205c403bbc107264b8eccf4b/Cloud/en-US/51acfc82c0c54db59de0a528f343902c.html

https://help.sap.com/viewer/65de2977205c403bbc107264b8eccf4b/Cloud/en-US/51acfc82c0c54db59de0a528f343902c.html


Production_Supervisor A user who ensures that the production runs according to the production plan, tracks the production progress, manages breakdowns and other exceptional situations.

The user is responsible for allocating resources such as labor to the right place and at the right time, keeping all machines up and running, and ensuring all material at work.


Production_Operator A user who executes work in process transactions and performs data collection and nonconformance logging

Level of access for master data: READ

Level of access for process transactions: READ, UPDATE

Production_Engineer A user who defines and manages product and process configurations within a plant.


Automation_Engineer A user who is responsible for manufacturing automation, for example, defining and maintaining the production processes on the operational level.


PQM_Analytical_User A user who has all the authorizations of a PQM_Basic_User. In addition, the user can create new analytical data sets and analyze quality defects to evaluate the influence of 4Ms of manufacturing. The persona would be manufacturing engineer, quality engineer, process engineer, and so on.

PQM_Basic_User A user who receives predictive quality alerts and can view the predictive evaluation results for a specific combination of plant and equipment. The persona would be a production operator or quality inspector.

PQM_Model_Manager A user who has all the authorizations of PQM_Basic_UserPQM_Analytical_User. In addition, the user can create and change AI/ML scenarios, train models, subscribe alerts and review the results after the model is trained. The persona would be a manufacturing engineer or quality engineer.

Manuf_Networks_Customer_Admin A user who is accountable for manufacturing and production. A user who performs administrative as well as regular user tasks for a private customer within the Manufacturing Network

Manuf_Networks_Customer_User A user who performs regular user tasks for a private customer within the Manufacturing Network

Manuf_Networks_Premium_Customer_Admin A user who performs administrative as well as regular user tasks for a customer within the Manufacturing Network



Manuf_Networks_Premium_Customer_User A user who performs regular user tasks for a customer within the Manufacturing Network

Manuf_Networks_Premium_Supplier_Admin A user who performs administrative as well as regular user tasks for a supplier within the manufacturing networks

Manuf_Networks_Premium_Supplier_User A user who performs regular user tasks for a supplier within the Manufacturing Network

Manuf_Networks_Supplier_Admin A user who performs administrative as well as regular user tasks for a private supplier or a supplier with the Suppliers license within the Manufacturing Network

Manuf_Networks_Supplier_User A user who performs regular user tasks for a private supplier or a supplier with the Suppliers license within the Manufacturing Network

Manufacturing_Extension_Provider A user who manages extensions (registration, unregistration, and so on) and event subscriptions

Data_Privacy_Auditor A user who has access to blocked data.

Role Templates, Apps, and Permission

The table describes the permissions each role template has on the SAP Digital Manufacturing Cloud apps. Use this table as a basis for configuring role collections.

SAP Asset Intelligence Network (AIN) and Asset Central Foundation

The role templates for SAP Asset Intelligence Network (AIN) and Asset Central Foundation apps are also included in this table. As SAP Digital Manufacturing Cloud reuses some of the AIN and Asset Central Foundation apps, you need to configure these role templates along with the SAP Digital Manufacturing Cloud role templates.

● AIN_ORG_DATA_EXPERT (for reading, editing, and deleting data)● AC_ORG_DATA_EXPERT (for reading, editing, and deleting data)

NoteTo grant users access to AIN and Asset Central Foundation apps used in SAP Digital Manufacturing Cloud, you also need to add the users in the Application Settings app. For more information, see Application Settings.

For granular level information on predefined roles within the role templates AIN_ORG_DATA_EXPERT and AC_ORG_DATA_EXPERT, see Roles for SAP Intelligent Asset Management FLP.

TipYou can filter by the role template, the tile, and/or the group to find out the best combinations.



https://help.sap.com/viewer/61e8324ac84e49c5a3a823b690be7883/2112/en-US/347309dc18c04bdba83b2fe6c507bc83.html

https://help.sap.com/viewer/61e8324ac84e49c5a3a823b690be7883/2112/en-US/347309dc18c04bdba83b2fe6c507bc83.html

https://help.sap.com/viewer/d89bac86aa294f75afdc40dca457dd7b/2002/en-US/8fb1f4003c484bd7895fc1f75219da41.html

Application Identifier Role Template Area / Capability Launchpad Group App/Plugin Permissions

dmc Production_Supervisor

-Insights Manufacturing Insights

Plant Insights app Assigned users can do the following:

● View and analyze production progress at different plants. A user who is accountable for manufacturing and production functions across multiple plants


-Execution Manufacturing Configuration

Overlay Authoring Tool app

Assigned users can do the following:

● View, create, edit, and delete projects and associated objects

dmc Manufacturing_Admin




● View, create, edit, and delete projects and associated objects

dmc Production_Operator




● View projects and associated objects





KPI Analytics app Assigned users can do the following:

● View and analyze KPIs to monitor production progress



OEE Insights app Assigned users can do the following:

● View and analyze OEE KPIs


-Insights Manufacturing Insights Configuration

Configuration app Assigned users can do the following:

● View settings made for plant configuration, KPI configuration



Set KPI Thresholds app


● View, set, update, and delete KPI thresholds at the Plant level



Manage Alerts app Assigned users can do the following:

● Monitor the alerts raised by the applications and initiate a corrective action on the alerts




dmc Production_Engineer


Manage Alert Type app


● View and manage alert types and actions associated with alerts






dmc Global_Regional_Manager









● View alert types and actions associated with alerts


-Insights Personalized Dashboards, Reports, and KPIs

Dashboard Designer app


● View the dashboards created







● View the dashboards created

ac_broker TEMPLATE_READ EQUIPMENT_READDOCUMENT_DELETE



Roles are required in addition to dmc roles.


● View equipment or indicator data in dashboard


-Insights Enterprise Hierarchy

Manage Hierarchy Types app


● View the hierarchy types



Manage Hierarchy app


● View hierarchies



Manage Hierarchy Node Types app


● View hierarchy node types



Manage Hierarchy Templates app


● View hierarchy templates





-Manufacturing Automation

Manufacturing Automation

Machine Model and Connectivity app


● View machine model objects




Manage Equipment Connectivity app


● View equipment connectivity



Manage Attributes app


● View the system and custom attributes



Manage Master Objects app


● View master objects



Manage Data Source app


● View data sources



Manage Analytical Models app


● View Analytical Models



Manage Analytical Model KPI Thresholds app


● View Analytical Model KPI thresholds





Manage KPI Subscriptions app


● View, update, and save KPI subscriptions.

dmc Plant_Manager -Insights Manufacturing Insights Configuration



● View, update, and save KPI subscriptions















● View KPI subscriptions



Manage Favorite KPIs app


● Select or deselect the dashboard as a favorite




dmc Plant_Manager -Insights Personalized Dashboards, Reports, and KPIs















-Execution Manufacturing Execution

Dispatching and Monitoring app


● Monitor, schedule, and dispatch operations on the shop floor



ac_broker AC_ORG_DATA_EXPERT



Roles required in addition to dmc Manufacturing_Admin and Production_Supervisor roles.

Assigned users can view indicators and work orders.

Note that with these roles alone, you cannot use this app.



Schedule Labor app


● Assign shifts and resources to the workers for a given calendar week



Manage Floor Stock app


● Receive, edit and view the floor stock



Manage Staging app


● Stage materials from EWM for specific orders or materials

● View and check staging request status






Manage Logistics Orders app


● View, create and edit logistics orders



Execute Logistics Orders app


● View and execute logistics orders


-Execution Manufacturing Master Data Management

Manage Storage Locations app


● Create, edit, copy, and delete storage locations



View Labor Schedule app


● View the assignments of workers for all shifts




● View settings made for plant configuration, KPI configuration







● View, set, update, and delete KPI thresholds at the Plant level.




● View and analyze production progress at different plants













● Read, update, and delete dashboards
















● View, create, update, and delete hierarchies

dmc Plant_Manager -Insights Enterprise Hierarchy








● View, create, update, and delete hierarchy types






● View hierarchy types





● View, create, update, and delete hierarchy node types









● View, create, update, and delete hierarchy templates












● View, create, update, and delete attributes used in Analytical Model





● View, create, update, and delete master objects used in Analytical Model





● View, create, update, and delete data sources used in Analytical Model





● View, create, update, and delete Analytical Model







● View, create, update, and delete thresholds set for custom KPIs configured using Analytical Model










Manage Web Serversapp


● View, create, and delete web servers

● Manage connections to other web servers




Manage Service Providers app


● View, create, update, and delete service providers


-Insights Technical Configuration and Integration

Manage Service Registry app


● View and register organization services









● View, create, update, and delete connectivity between tags and equipment





● Receive, edit, and view floor stock









● View, configure, update, and delete settings made for plant configurations, KPI configurations






Design Production Processes app


● Export and import production process designs with cloud processes and relevant services



Customize KPI Calculations app


● View, create, update, and delete customization settings for KPI calculations

dmc Automation_Engineer




● View and register organization services



Enterprise Hierarchy







Manage Hierarchy Type Nodes app


● View hierarchy type nodes





















● View, create, update, and delete service providers






● View, create, update, and delete machine model objects




Manage Web Servers app


● View, create, delete web servers

● Manage connections to other web servers
















Manage Staging app






Manage Tool Assignments


● Unassign orders and tools from a specific resource

● Import tool assignments with a resource from Resource Orchestration (REO)











Global Insights app Assigned users can do the following:

● View and analyze KPIs across plants and regions


















● View settings made for plant configurations, KPI configurations





● View, set, update, and delete KPI thresholds at the Company level.




● Monitor alerts raised by applications and initiate corrective actions for the alerts








● View, create, update, and delete dashboards.

NoteTo create dashboards for custom KPIs (Analytical Model), standard KPIs, or real-time indicator permissions to Analytical Model tiles, Machine Model Orchestration tiles and Enterprise Hierarchy tiles are also required.







































● View system and custom attributes








● View, create, update, and delete system and custom attributes










● View, create, update, and delete master objects










● View, create, update, and delete data sources





● View Analytical Models







● View, create, update, and delete Analytical Models





● View thresholds set for custom KPIs configured using Analytical Model





● View, create, update, and delete thresholds set for custom KPIs configured using Analytical Model

dmc Plant_Manager -Insights Manufacturing Insights














● View settings made for plant configurations, KPI configurations




● View, set, update, and delete KPI thresholds at the Plant level



● Monitor alerts raised by the applications and initiate corrective action for the alerts.






● View and manage the alert types and actions associated with alerts

dmc Plant_Manager -Insights Personalized Dashboards, Reports, and KPIs



● View existing dashboards

● Create, update, and delete dashboards




● View system and custom attributes








● View the custom data source for Analytical Model







● View the Analytical Model




● View thresholds set for custom KPIs configured using Analytical Model

dmc Plant_Manager -Execution Manufacturing Configuration

Manage Document Print Templates app


● Specify, edit, and delete the information that is available for printing

● Define, edit, and delete print formats

ac_broker DOCUMENT_DELETE




● Upload print template files from an integrated SAP Asset Intelligence Network system




Manage Printers app


● Set up, edit, and delete printers to print various types of production-related documents


Reprint Documents app


● Reprint or view documents that printed for specific SFCs or orders

dmc PQM_Analytical_User

-Insights AI/ML Scenarios Management

Manage Analytical Data Sets app


● Create, edit, delete, and clone analytical data sets




dmc PQM_Analytical_User


Manage AI/ML Scenarios app


● Create, edit, delete, and clone AI/ML scenarios

● Configure alerts to define alert conditions

● Subscribe to alerts so that they are notified whenever an alert is triggered

dmc PQM_Model_Manager


Manage Analytical Data Sets app


● Create, edit, delete, and clone analytical data sets

dmc PQM_Model_Manager


Manage AI/ML Scenarios app


● Create, edit, delete, and clone AI/ML scenarios for defect detection and visual inspection.

● Configure alerts to define alert conditions

● Subscribe to alerts so that they are notified whenever an alert is triggered.





Manage Orders app


● Create, edit, and view orders

● Release orders to create SFCs



Manage Cancellations app


● View activity confirmations, EWM goods issues and EWM goods receipts that are posted against the order

● Cancel activity confirmations, EWM goods issues and EWM goods receipts that are successfully posted against the order



Manage Resource Setup app


● Assign orders to a resource

● View a resource with assigned orders






Load Resources with Components app


● Load components or floor stock inventories into the empty resource bins

● Unload components or floor stock inventories from the loaded resource bins



Manage Holds app Assigned users can do the following:

● View SFCs placed on hold or released from hold

● Place SFCs on hold or release SFCs from hold



Work Center POD (Default) app


● Execute production activities at the selected work center





Operation POD (Default) app


● Execute production at the selected operation activity and resource



OEE POD Assigned users can do the following:

● Report downtimes and speed loss that occur during the execution of an order

● View real-time values of the OEE KPIs



Order POD (Default) app


● Execute production activities for the selected process order



Post-Production Reporting POD








Quality Inspection Characteristic List plugin


● View inspection characteristics

● View summarized results



Quality Inspection Results plugin


● View single-value recordings

● Record inspection results

● Upload and download attachments





● Assign orders and tools to a specific resource







Manage BOMs app Assigned users can do the following:

● View, create, edit, and delete bills of materials (BOMs)



Manage Routings app


● View, create, edit, and delete routings



Manage Recipes app


● View recipes imported from SAP S/4HANA Cloud



Manage Operation Activity Master app


● View, create, edit, and delete operation activities



Manage Work Instructions app


● View, create, and edit work instructions






Manage Materials app


● View, create, edit, and delete materials



Manage Material Groups app


● View, create, edit, and delete material groups



Manage Data Collection app


● View, create, edit, and delete data collection groups



Manage Resources app


● View, create, edit, and delete resources



Manage Resource Types app


● View, create, edit, and delete resource types





Manage Work Centers app


● View, create, edit, and delete work centers



Manage Shifts app Assigned users can do the following:

● View, create, edit, and delete shifts



Manage Set Points app


● View, create, edit, and delete set point groups



Manage Tools Assigned users can do the following:

● Create, edit, and view tools

● Define tool logging method

● Track tool usage

● View tool schedules planned in Resource Orchestration (REO)






Manage Carriers app


● View, create, and edit carriers



Manage Nonconformance Codes app


● View, create, edit, and delete nonconformance codes



Nonconformance Data Entry plugin


● Upload images when logging nonconformance codes



Data Collection plugin


● Upload images when logging data collection parameters



ain_broker DOCUMENT_READ -Execution Manufacturing Execution

Header Information plugin


● Display a material thumbnail in the header information on a POD page in both the Work Center POD (Default) and the Operation POD (Default)



plugin NC Selection





NC Data Tree plugin





Manage Nonconformance Groups app


● View, create, edit, and delete nonconformance groups






Manage OEE Reason Codes app


● View, create, and edit OEE reason codes



Assign OEE Reason Codes app


● Assign OEE reason codes to resources

● Change the assignment of the OEE reason codes



Manage User Assignments app


● View user data, assign business attributes to users, and delete user settings



Manage Certifications app


● View, create, edit, and delete certifications



Manage Plants app Assigned users can do the following:

● View and create plants





Manage Custom Data app


● View, create, edit, and delete custom field definitions



Manage Data Types app


● Group data fields created in the Manage Data Fields app



Manage Data Fields app


● View, create, edit, and delete data fields



POD Designer app Assigned users can do the following:

● View, create, edit, and delete production operator dashboards (PODs)



Manage OEE Time Model Configuration app


● View, create, and edit OEE time elements






Manage Standard Rates app


● View, create, edit, and delete standard rates



Assign Time Element Types app


● Assign resource statuses to time element types

● Change the assignment of the resource statuses



Manage Next Numbers app


● View, create, and edit numbering patterns



Manage Buyoffs app


● View, create, edit, and delete buyoffs





Product Genealogy Report app


● View the manufacturing history of an SFC and the history of individual components



Product History Report app


● View personal data

● View the manufacturing history of an SFC or a batch (depending on the industry type)



Manage Orders app


● View orders

















Manage Staging app


● Stage materials from SAP EWM for specific orders or materials






Packing List plugin Assigned users can do the following:

● View and assign destinations to packing units

● Create packing units

● Add items to packing units

● Remove items from packing units

● Close and unpack a packing unit

● Unload a packing unit



Packing List Assigned users can do the following:

















Logistics Order Creation plugin


● View assigned destinations to SFCs





● View empty and loaded resource bins















OEE POD app Assigned users can do the following:










Post-Production Reporting POD app





Quality Inspection Characteristic List plugin


● View inspection characteristics

● View summarized results






Quality Inspection Results plugin


● View single-value recording

● Record inspection results

● Upload and download attachments











● View bills of materials (BOMs)



Manage Routings app


● View routings





Manage Recipes app


● View recipes imported from SAP S/4HANA Cloud





● View operation activities





● View work instructions





● View materials





● View material groups





● View data collection groups





● View resources








● View resource types





● View work centers




● View shifts



Manage Carriers app


● View carriers





● View nonconformance codes





● View nonconformance groups


















● View user data and assign business attributes to users





● View certifications




● View plants in SAP Digital Manufacturing Cloud





● View custom field definitions













● View data fields




● View production operator dashboards (PODs)










● View, create, and edit standard rates













● View numbering patterns



Manage Buyoffs app


● View and log buyoffs





● View the manufacturing history of SFCs and the history of individual components

















Monitor Production Processes app


● View the execution result and progress of production processes













dmc Plant_Manager -Manufacturing Automation










Production Process Administration app


● View, create, edit, and delete workgroups

● View, create, edit, and delete data sources



Manage Orders app









Manage Orders app






Manage Staging app








● View resources with assigned orders











































● Define tool logging methods





Manage Carriers app


● View, create, edit, and delete carriers







Manage Routings app








Manage Recipes app


● View, edit, and delete recipes imported from SAP S/4HANA Cloud




















































Manage Set Points app


● View, create, edit, and delete set point groups

















● View nonconformance codes












● View nonconformance groups




























● View and create plants in SAP Digital Manufacturing Cloud






















































Manage Printers app







● Reprint or view documents that were printed for specific SFCs or orders



Manage Buyoffs app


● View, create, and edit buyoffs









-Administration Administration License Usage Report app


● Monitor the resource consumption of the SAP Digital Manufacturing Cloud license



Configure Inspection Points app


● Create, change, display and delete user field combinations for inspection points.

● Import and define validation codes for inspection point valuation from integrated ERP systems.






Manage Orders app














● Assign orders to a resource












Manage Holds app Assigned users can do the following:

● View SFCs placed on hold or released from hold

● Place SFCs on hold or release SFCs from hold



































● Monitor, schedule, and dispatch operations on the shop floor



Schedule Labor app


● Assign shifts and resources to the workers for a given calendar week.













Manage Staging app


● Stage materials from SAP EWM for specific orders or materials




Manage Logistics Orders app


● View, create and edit logistics orders








Manage Transport Systems app


● View, create and edit transport systems





Packing List plugin Assigned users can do the following:









Logistics Order Creation plugin


● Assign destinations to SFCs







Manage Routings app








Manage Recipes app


● View, edit, and delete recipes imported from SAP S/4HANA Cloud






















































● Define tool logging method





Manage Carriers app


● View, create, edit, and delete carriers








































● View and create plants in SAP Digital Manufacturing Cloud


















































● Specify, edit, and delete the information that is available for printing and define, edit, and delete print formats



Manage Printers app







● Reprint or view documents that were printed for specific SFCs or orders.



Manage Buyoffs app






-Execution Technical Configuration and Integration

Manage Collaboration Links app


● Map directives to a system action for use with the collaboration



Manage Collaboration Directives app


● Create directives by copying existing ones to use with the collaboration



Monitor Integration Messages app


● View, process, and delete integration messages



Integration Message Dashboard app


● View, process, and delete integration messages

● Retry failed integration messages and submessages






Manage Integration Workflows


● View and update the workflow configurations for inbound and outbound collaboration





● View organization services








Product History Report app


● View personal data

● View the manufacturing history of SFCs or batches (depending on the industry type)


















● View service providers




Manage Automatic Triggers app


● View subscriptions, timers, and business rules




Production Process Administration app


● View workgroups






-Execution-Manufacturing Automation


Deploy Shop Floor Elements app


● View, create, edit, and delete deployment groups

● Deploy and activate shop floor elements

● Remove shop floor elements from deployment groups

● Manage users in deployment groups




Deploy Shop Floor Elements app


● View, create, edit, and delete deployment groups

● Deploy and activate shop floor elements

● Remove shop floor elements from deployment groups

● Manage users in deployment groups








● View, create, edit, and delete subscriptions, timers, or business rules to trigger services or production processes






● View, create, edit, and delete subscriptions, timers, or business rules to trigger services or production processes

ac_brokerain_broker

EQUIPMENT_READINDICATOR_READMODEL_READTEMPLATE_READ




Roles required in addition to dmc Production_Engineer or Automation_Engineer role










● View, create, edit, and delete production process designs

● View, create, edit, and delete cloud-based production processes (cloud processes)

● Export and import production process designs with cloud processes and relevant services

● Submit production process designs for activation

● Manage users in assigned production process designs








● View, create, edit, and delete production process designs

● View, create, edit, and delete PCo-based production processes (automation sequences)

● Manage users in assigned production process designs

ac_brokerain_broker

DOCUMENT_READEQUIPMENT_READINDICATOR_READAC_ORG_DATA_READ




Roles required in addition to dmc Production_Engineer or Automation_Engineer role







Manufacturing Configuration







Manage Printers app





Manage Carriers app


● Create, edit, copy, and delete carriers





● Reprint or view documents that were printed for specific SFCs or orders





Manage Buyoffs app



dmc Manuf_Networks_Premium_Supplier_Admin

-Network Manufacturing Network Configurations

Private Organizations app


● Add, register, and delete private customers



Supplier Profile app


● Edit the basic information of the organization's supplier profile


-Network Manufacturing Network

Collaboration Rooms app


● Enter collaboration rooms to collaborate on various topics like design and quality

● Accept collaboration invitations to the users themselves or on behalf of the users' own organization




dmc Manuf_Networks_Premium_Supplier_User





● Accept invitations to new collaborations

dmc Manuf_Networks_Customer_Admin


Collaboration Partners app


● Approve and reject suppliers for collaboration

dmc Manuf_Networks_Customer_Admin




● Create, view, edit, and delete collaboration rooms





dmc Manuf_Networks_Customer_User







dmc Manuf_Networks_Premium_Customer_Admin


Private Organizations app


● Add, register, and delete private suppliers



Manage Integrations app


● Import Ariba vendors

● Map Ariba vendors to suppliers in Network


















Parts Analysis app Assigned users can do the following:

● Create worklists for parts to be analyzed for additive manufacturing

● Enter results in the worklists for internal analysis



Request for Quotation app


● Create requests for quotation that are to be sent to an integrated ERP system





View Collaboration Rooms app


● View collaboration rooms where the user was or is a participant

dmc Manuf_Networks_Premium_Customer_User

















Parts Analysis app Assigned users can do the following:

● Create worklists for parts to be analyzed for additive manufacturing

● Enter results in the worklists for internal analysis



Request for Quotation app


● Create requests for quotation that are to be sent to an integrated ERP system



View Collaboration Rooms app


● View collaboration rooms where the user was or is a participant

dmc Manuf_Networks_Supplier_Admin


Supplier Profile app


● Edit the basic information of the organization's supplier profile



dmc Manuf_Networks_Supplier_Admin





● Accept collaboration invitations to the users themselves or on behalf of the users' own organization

dmc Manuf_Networks_Supplier_User






dmc Manufacturing_Extension_Provider


Register OAuth 2.0 Clients app


● Register OAuth 2.0 clients with Network




dmc Manufacturing_Extension_Provider

-Network Extension Development

Manage Extensions app


● Register and modify extension applications

ac_broker EQUIPMENT_DELETE

TEMPLATE_DELETE




Roles required in addition to dmc roles.



ac_broker EQUIPMENT_READTEMPLATE_READ




Roles required in addition to dmc roles.


● View connectivity between tags and equipment

ac_broker TEMPLATE_READ -Manufacturing Automation


Templates app Assigned users can do the following:

● View templates

ac_broker TEMPLATE_EDIT -Manufacturing Automation



● Update, view, and delete templates



ac_broker TEMPLATE_DELETE




● Create, update, view, and delete templates

ac_broker MODEL_READ -Manufacturing Automation


Models app Assigned users can do the following:

● View a model

ac_broker MODEL_EDIT -Manufacturing Automation



● View and update a model

ac_broker MODEL_DELETE -Manufacturing Automation



● Create, update, view, and delete a model

ac_broker AC_ORG_DATA_READ



Equipment app Assigned users can do the following:

● View an item of equipment

ac_broker AC_ORG_DATA_EXPERT



Equipment app Assigned users can do the following:

● Create, update, view, and delete an item of equipment




ac_broker GROUP_READ -Manufacturing Automation


Groups app Assigned users can do the following:

● View groups

ac_broker GROUP_EDIT -Manufacturing Automation



● View and update groups

ac_broker GROUP_DELETE -Manufacturing Automation



● Create, update, view, and delete groups

ac_broker PART_READ -Manufacturing Automation


Spare Parts app Assigned users can do the following:

● View spare parts

ac_broker PART_EDIT -Manufacturing Automation



● View and update spare parts

ac_broker PART_DELETE -Manufacturing Automation



● Create, update, view, and delete spare parts

ac_broker FAILURE_MODE_READ



Failure Modes app Assigned users can do the following:

● View failure modes



ac_broker FAILURE_MODE_EDIT




● View and update failure modes

ac_broker FAILURE_MODE_DELETE




● Create, update, view, and delete failure modes

ac_broker INSTRUCTION_READ



Instructions app Assigned users can do the following:

● View an instruction

ac_broker INSTRUCTION_EDIT




● View and update instructions

ac_broker INSTRUCTION_DELETE




● Create, update, view, and delete an instructions

ac_broker ANNOUNCEMENT_READ



Announcements app


● View announcements




ac_broker ANNOUNCEMENT_EDIT



Announcements app


● View and update announcements

ac_broker ANNOUNCEMENT_DELETE



Announcements app


● Create, update, view, and delete announcements

ac_broker FUNCTIONAL_LOCATION_READ



Locations app Assigned users can do the following:

● View locations

ac_broker FUNCTIONAL_LOCATION_EDIT




● Update and view locations

ac_broker FUNCTIONAL_LOCATION_DELETE




● Create, update, view, and delete locations

ac_broker USER_AUTH_READ -Manufacturing Automation


User Authorizations app


● View user authorizations



ac_broker USER_AUTH_EDIT -Manufacturing Automation




● View and edit user authorizations

ac_broker USER_AUTH_DELETE





● Create, edit, view, and delete user authorizations

ac_broker DOCUMENT_READ -Manufacturing Automation


Documents app Assigned users can do the following:

● View documents

ac_broker DOCUMENT_EDIT -Manufacturing Automation



● View, edit, and delete documents





● Create, edit, view, and delete documents

ac_broker DOCUMENT_READ -Execution Manufacturing Master Data Management



● View materials




ac_brokerain_broker

CONFIGURATION_EDIT

-Network Administration Application Settings app


● Add, view, and edit users

● Add, view, and edit invitee users

● Add and delete email domains for automatic user onboarding

● Maintain the external IDs of integrated systems

● Manage external systems to add SAP IoT as an external system

● Change other application settings



ac_brokerain_broker

CONFIGURATION_DELETE



● Add, view, edit, and delete users

● Add, view, edit, and delete invitee users

● Add and delete email domains for automatic user onboarding

● Maintain the external IDs of integrated systems

● Manage external systems to add SAP IoT as an external system

● Change other application settings

ac_broker CONFIGURATION_READ



● View the users, invitee users, and other application settings




ac_brokerain_broker

COMPANYPROFILE_DELETE

-Network Administration Company Profile app


● View and edit the organization's company profile

● Add and edit invitee organizations

● Add and edit subsidiaries

ac_broker COMPANYPROFILE_EDIT



● View and edit the organization's company profile

ac_broker COMPANYPROFILE_READ



● View the organization's company profile

ac_brokerain_broker

DPP_AUTH -Administration Administration Data Protection and Privacy app


● View your personal data and the personal data of other data subjects



ain_broker PARTNERS_DELETE


Business Partners app


● Send connection requests to business partners

● Accept connection requests from business partners

● Disconnect from business partners

● Maintain the external IDs of business partners

ain_broker PARTNERS_EDIT -Network Manufacturing Network Configurations



● Send connection requests to business partners

● Accept connection requests from business partners

● Disconnect from business partners

● Maintain the external IDs of business partners




ain_broker PARTNERS_READ -Network Manufacturing Network Configurations



● View the details of business partners

ain_broker DOCUMENT_READ -Execution Manufacturing Master Data Management



● View material attachments

ac_broker EQUIPMENT_READ

TEMPLATE_READ






● View subscriptions, timers, or business rules

ac_broker EQUIPMENT_DELETE

TEMPLATE_DELETE






● View, create, update, and delete subscriptions, timers, or business rules


4.4 Manage Users and Authorization

After provisioning of SAP Digital Manufacturing Cloud is complete for your organization, you can configure authorization using role collections and assign users to relevant role collections.

Context

To manage users and authorization, you can use any of the following methods:

● Use SAP Cloud Identity Services - Identity Authentication for user management and map role collections to user groupsThis is recommended for the use of SAP Digital Manufacturing Cloud. For more information, see Manage Users Using SAP Cloud Identity Services - Identity Authentication [page 120].

● Use the default SAP ID Service for user management and assign role collections directly to S-users or P-usersThis is recommended only for partners or trial customers. For more information, see Manage Users Using SAP ID Service [page 128].

● Use your own corporate identity provider to provide identity authentication directly● Use SAP Cloud Identity Services - Identity Authentication as a proxy to delegate the authentication to your

own corporate identity provider

For the last 2 methods, refer to the user assistance of SAP Cloud Identity Services - Identity Authentication and the documentation for your own corporate identity provider.

NoteSAP Digital Manufacturing Cloud reuses some SAP Asset Central apps and functions. Business users that share the mail domain of the Primary Contact Person you enter when onboarding your organization, can use these apps when you assign them an appropriate role collection in your identity provider. Business users that have a different mail domain must also be added in the Application Settings app to have an authorization to use these apps and functions.

4.4.1 Manage Users Using SAP Cloud Identity Services - Identity Authentication

Using the SAP Cloud Identity Services - Identity Authentication service, you can delegate identity authentication to an identity provider (IdP). In addition, by mapping role collections that define permissions to user groups in the IdP tenant, you can manage authorization in a more flexible way.

4.4.1.1 Configure Identity Federation

To configure identity federation using SAP Cloud Identity Services - Identity Authentication, the SAP Business Technology Platform subaccount administrator configures trust to the Identity Authentication tenant as an



https://help.sap.com/viewer/6d6d63354d1242d185ab4830fc04feb1/Cloud/en-US

identity provider. Correspondingly, the Identity Authentication tenant administrator registers the SAP Business Technology Platform subaccount as an application in the tenant.

By configuring this mutual trust relationship, the SAP Business Technology Platform subaccount can request and obtain authentication assertions from Identity Authentication.

The workflow is illustrated as follows:

Related Information

Trust and Federation Options with SAP Business Technology PlatformFederation Attribute Settings of Any Identity Provider

4.4.1.1.1 Configure Trust to Identity Provider

As an SAP Business Technology Platform subaccount administrator, configure trust to an SAP Cloud Identity Services - Identity Authentication tenant as an identity provider.

Prerequisites

You have obtained the SAML 2.0 metadata file for the Identity Authentication tenant from the tenant administrator. For more information on downloading the SAML 2.0 metadata, see Tenant SAML 2.0 Configuration.


https://help.sap.com/viewer/65de2977205c403bbc107264b8eccf4b/Cloud/en-US/cb1bc8f1bd5c482e891063960d7acd78.html

https://help.sap.com/viewer/65de2977205c403bbc107264b8eccf4b/Cloud/en-US/6d073332bc5743fdb7f7f06bde499ab7.html

https://help.sap.com/viewer/6d6d63354d1242d185ab4830fc04feb1/Cloud/en-US/e81a19b0067f4646982d7200a8dab3ca.html

https://help.sap.com/viewer/6d6d63354d1242d185ab4830fc04feb1/Cloud/en-US/e81a19b0067f4646982d7200a8dab3ca.html

Procedure


2. From the side bar menu, choose Security Trust Configuration .3. Add a new trust configuration.

a. Choose New Trust Configuration.b. In the New Trust Configuration window, enter a meaningful name and description for the identity

provider.c. Either copy-paste the SAML 2.0 metadata or upload the SAML 2.0 metadata file for the tenant.d. Save the configuration.

NoteThe Origin Key is generated by the system based on the metadata file you upload. The Link Text you enter, is used as the display name of the trusted identity provider.

4. Optionally, edit the default identity provider - SAP ID service - and set it to inactive.

As a result, only users managed by your Identity Authentication tenant can be added as members and manage the subaccount.



4.4.1.1.2 Configure Trust to SAP Business Technology Platform Subaccount

As an Identity Authentication tenant administrator, configure trust to an SAP Business Technology Platform subaccount by registering it as an application in the tenant. This application represents the SAP Digital Manufacturing Cloud application hosted in the subaccount.

Prerequisites

You have obtained the SAML 2.0 metadata file for the SAP Business Technology Platform subaccount from the subaccount administrator. To download the metadata, use this URL: https://<subdomain>.authentication.<regionHost>/saml/metadata.

Examplehttps://bestrun.authentication.eu10.hana.ondemand.com/saml/metadata

You can find the subdomain or region on the overview page of the subaccount.

Procedure

1. Log on to the administration console of the Identity Authentication tenant.

2. Go to Applications & Resources Applications and add an application.

Define a meaningful and identifiable application name like SAP Digital Manufacturing Cloud.

3. Select the newly added application.4. On the Trust tab, choose SAML 2.0 Configuration.5. In the Metadata File field, upload the SAML 2.0 metadata file for the SAP Business Technology Platform

subaccount.6. Save the changes.


4.4.1.1.3 Configure SAP Digital Manufacturing Cloud Application in Identity Authentication Tenant

You can configure the SAP Digital Manufacturing Cloud application to define user IDs, assertion attributes, access control, and a home URL.

Context

User ID

The user ID or subject name identifier, is a user attribute that is recognized by the application as the unique ID representing a user. We recommend using the email address of the user for SAP Digital Manufacturing Cloud.

CautionDon't change the subject name identifier after the initial setup. Otherwise, the same user could be recognized as a different user. In the worst case, the application can run into an error.

Assertion Attributes

Configure an assertion attribute for user groups. You can use these attributes to enable mappings between role collections in the SAP Business Technology Platform subaccount and the user groups for authorization management.

User Application Access

By default the access level is Internal, which means that all users managed by the Identity Authentication tenant have access to the application. For higher security, we recommend using the Private access.

Home URL

Set the HOME URL of your SAP Digital Manufacturing Cloud application.

This URL is automatically generated when you subscribe to the application in the SAP Business Technology Platform cockpit. You can obtain it by choosing the Go to Application button.

Procedure

1. Log on to the administration console of the Identity Authentication tenant.2. In the Identity Authentication Service screen, choose Applications & Resources > Applications.3. Select the tenant you would like to use in order to modify the tenant details.4. On the Trust tab, choose Subject Name Identifier and select the basic attribute E-Mail.

5. On the Trust tab, choose Assertion Attributes and add the following assertion attribute.



User Attribute Assertion Attribute

Groups Groups

NoteThe system is case-sensitive.

6. On the Authentication and Access tab, choose User Application Access and then select Private.7. In the header area, choose Home URL, enter the URL for your SAP Digital Manufacturing Cloud application,

and save.

4.4.1.2 Manage Users and Authorization

This section describes a typical workflow.

Context

The typical workflow is illustrated as follows:

4.4.1.2.1 Create User Groups

By creating user groups in the Identity Authentication tenant , you can organize users and manage authorization more efficiently. You can map the user groups to the role collections in the SAP Business


Technology Platform subaccount. Permissions to the SAP Digital Manufacturing Cloud application are controlled based on the mappings.

Procedure

1. Log on to the administration console for the tenant.2. Under Users & Authorizations, choose User Groups.3. Add user groups.

Next Steps

You can add users manually to user groups or assign users to user groups while importing the users.

4.4.1.2.2 Import Users for SAP Digital Manufacturing Cloud

As the administrator of an SAP Cloud Identity Services - Identity Authentication tenant, you can import users of SAP Digital Manufacturing Cloud using a CSV file.

Prerequisites

● You're assigned the Manage Users role for the tenant.● You've created user groups that correspond to the role collections in the SAP Business Technology

Platform subaccount.● You've prepared a CSV file for import.

If you enter the data in the CSV file as text, you must separate the entries with commas. If you enter more than 1 value in a single entry, separate the values within the entry with commas and enclose the entry in quotation marks.Be sure to keep the entry headers in the CSV file. In addition, leave no spaces between the entries.

CautionIf you want to update a user using a CSV file, include the new information and also repeat all information that remains unchanged. If you include only new information, the information that isn't repeated is deleted.

ExamplePrepare the following CSV file:

status,mail,firstName,lastName,groups active,[email protected],Anderson,Adams,"DMC_Admin,DMC_User"



active,[email protected],Maria,Lin,DMC_User

For a full list of supported attributes, see SAP Cloud Identity Services - Identity Authentication.

Context

Using the import function, you can assign users to an application while managing authorization and user status.

You can also add users manually ( Users & Authorizations User Management Add User ) to the IdP tenant. However, the users don't automatically get access to an application with Private access control, which is required for productive environments. To assign a user to such an application, you must still use the import function.

In addition, manually added users don't automatically get required authorizations - group assignments - to access the application.

For more information about user management in SAP Cloud Identity Services - Identity Authentication, see User Management.

Procedure

1. Log on to the administration console for the tenant.2. Under Users & Authorizations, choose Import Users.3. In the application list, select the application representing SAP Digital Manufacturing Cloud.4. Browse to the CSV file and then choose Import.

5. To send activation emails to the imported users, choose Send E-Mails Send .

4.4.1.2.3 Configure Role Collection Mappings

As an SAP Business Technology Platform subaccount administrator, configure role collection mappings by assigning role collections to user groups created in your Identity Authentication tenant. The users within the user groups get the authorizations defined by the role collections.

Prerequisites

You've obtained the names of the relevant user groups from the administrator of the Identity Authentication tenant.


https://help.sap.com/viewer/6d6d63354d1242d185ab4830fc04feb1/Cloud/en-US/33838e0760f8411daf758a1c11818cc4.html

https://help.sap.com/viewer/6d6d63354d1242d185ab4830fc04feb1/Cloud/en-US/228428f9f476449cafd841a68d75b234.html

NoteYou need the names, not the display names.

Procedure


2. Choose Security Trust Configuration .3. Choose the trust configuration for your Identity Authentication tenant.

4. Choose Role Collection Mappings.5. Choose New Role Collection Mapping.6. In the Create Role Collection Mapping window, select a role collection and enter the name of a user group in

the Value field.7. Save the role collection mapping.

4.4.2 Manage Users Using SAP ID Service

If you don't have a strong need to configure an SAP Cloud Identity Services - Identity Authentication tenant for user management, you can use the default identity provider for your SAP Business Technology Platform subaccount: the SAP ID service. For example, as a trial customer, you don't have many users to manage or, as a partner, most or all of your users are developers.

Prerequisites

If you want to grant authorizations to users from SAP ID service in your subaccount, you must ensure that they have a user account in SAP ID service.

● To obtain an S-user, you can use the user management on the SAP One Support Launchpad .



http://help.sap.com/disclaimer?site=https%3A%2F%2Fsupport.sap.com%2Fen%2Fmy-support%2Fusers.html

NoteIf you require a change to the e-mail address of an S-user, create an incident under the component XX-SER-SAPSMP-USR.

● To obtain a P-user, go to www.sap.com and register a new user using their e-mail address.Users already registered with the SAP ID service (for example, at SAP Community or SAP Developer Center ) don't need to register again.

Procedure


2. From the side bar menu, choose Security Role Collections .3. Choose the role collection to which you want to assign users.4. Go to the Users section and choose Edit.5. Enter the user ID of the user that you want to assign to the role collection. If the user only exists in a

connected identity provider, choose the identity provider and enter the e-mail address.

6. To add more users, choose (Add a user).7. Save your changes.

Results

You've assigned the user to the selected role collection. The user has all of the authorizations of the role collection.

4.5 Onboard Your Organization

As an administrator and the first user of the SAP Digital Manufacturing Cloud application, you onboard your organization to the application.

Prerequisites

You've at least 1 role assigned for the dmc application.


http://help.sap.com/disclaimer?site=https%3A%2F%2Fwww.sap.com

http://help.sap.com/disclaimer?site=https%3A%2F%2Fwww.sap.com%2Fcommunity.html

http://help.sap.com/disclaimer?site=https%3A%2F%2Fdevelopers.sap.com

http://help.sap.com/disclaimer?site=https%3A%2F%2Fdevelopers.sap.com

Context

Onboarding consists of 2 steps:

1. Onboard your organization.In this step, you're asked to fill in some information about your organization. You can update this information later in the Company Profile app.

2. Assign a collaboration role to your organization.You have to select a collaboration role to use the functions provided by Manufacturing Network. You can skip this step if you don't intend to use Manufacturing Network.

CautionYou can't change the collaboration role you enter. If you're unsure which role to choose, skip this step, and complete the onboarding process.

If you want to use the Manufacturing Network functions later, you can choose any Manufacturing Network app (for example, Collaboration Rooms) and the system prompts again to select a role.

Procedure

1. Log on to the application. You're navigated to the Organization Onboarding page.2. Complete the required information.

Section Field Description

Company Details [Required] Company Name The company name must be unique for SAP Digital Manufacturing Cloud.

[Required]Website

[Required]Roles By default your organization is onboarded as an Operator. This means that you can import assets from Asset Central Foundation. If you want to onboard equipment that isn't defined in the SAP Asset Intelligence Network, choose Manufacturer. You can choose several roles for your organization. You can also change the roles assigned to organization in the Company Profile app.

Country/Region

Primary Contact Person First Name

Title / Last Name



Section Field Description

[Required] Email Address The email address of the contact person is used to send some notifications from the application.

NoteSAP Digital Manufacturing Cloud reuses some SAP Asset Central apps and functions. Business users that share the mail domain of the Primary Contact Person you enter when onboarding your organization, can use these apps when you assign them an appropriate role collection in your identity provider. Business users that have a different mail domain must also be added in the Application Settings app to have an authorization to use these apps and functions.

3. Choose Save and Next.4. Do 1 of the following:

○ Select the collaboration role (Customer or Supplier), depending on your business needs and choose Save.

○ If you're unsure which role to select, choose Skip Now.5. You're navigated back to the homepage and can start using the application.

4.6 Activate User Account

To use SAP Digital Manufacturing Cloud, you need to activate your user account with the identity provider (IdP) as well as the SAP Digital Manufacturing Cloud application itself.

Prerequisites

● Your IdP administrator has configured a user account for you in the IdP tenant.● Your IdP administrator has configured the user application access in such a way that you can access the

SAP Digital Manufacturing Cloud application.


Context

If your administrator has configured SAP Cloud Identity Services - Identity Authentication as the identity provider, you receive an account activation email from SAP Cloud Identity Services - Identity Authentication when your user account is created in the tenant. If you don't receive the activation email or you can't find it (check in your spam or junk folders), contact your IdP administrator to send a password reset email, as follows:

1. Go to Users & Authorization User Management .2. Select the user.3. Under Authentication, choose Password Details, and then choose Send E-Mail.

Procedure

1. If necessary, activate your user account with the identity provider.2. Open the URL for SAP Digital Manufacturing Cloud.3. Log on to the application.

NoteIf more than 1 identity provider is configured and remains active, don’t enter your user name and password directly. Instead, choose the identity provider first and then enter your user name and password.

4. If the Machine/Equipment Model and Orchestration group is available to your user account, open any app in this group and then close it.

5. If the Collaboration Rooms app is available to your user account, open this app and then close it.



5 Prepare for API Integration

Make the following preparations for making API calls on SAP Digital Manufacturing Cloud. This is required for third-party development as well as some system integration scenarios.

The following scenarios require you to prepare for integration following the steps below:

● Develop extensions based on APIs published by SAP Digital Manufacturing Cloud on SAP API Business Hub

● Connect to SAP Digital Manufacturing Cloud from another system (e.g. SAP S/4HANA) for inbound calls● Run cloud processes designed in the Production Process Desginer● Call SAP Digital Manufacturing Cloud services (for example, SFC Start service) in a cloud-based

production process

Related Information

SAP Digital Manufacturing Cloud APIsSAP Digital Manufacturing Cloud ß Manufacturing Network APIs

Operations Guide for SAP Digital Manufacturing CloudPrepare for API Integration PUBLIC 133

http://help.sap.com/disclaimer?site=https%3A%2F%2Fapi.sap.com%2Fpackage%2FSAPDigitalManufacturingCloud

http://help.sap.com/disclaimer?site=https%3A%2F%2Fapi.sap.com%2Fpackage%2FSAPDMCManufacturingNetwork

5.1 Assign a Service Plan to a Subaccount

Assign a service plan for Digital Manufacturing Cloud Services to a subaccount. You can then create service instances under this service plan in the spaces in this subaccount.

Prerequisites

The Digital Manufacturing Cloud Services entitlement has been allocated to your SAP Business Technology Platform global account.

Context

Procedure

1. Log on to the SAP BTP cockpit and select a region.2. Select a global account.3. Choose Entitlements.4. Select the Subaccounts mode, select one or more subaccounts, and then choose Go.

Note that the Services mode is only for displaying available services.5. Assign an appropriate service plan to each subaccount.

a. Choose Configure Entitlements Add Service Plans .b. In the service catalog, search for Digital Manufacturing Cloud Services.c. Select the appropriate service plan, corresponding to your license.

6. Save the configurations.


Prepare for API Integration

5.2 Create an Organization

Create an organization in an SAP Business Technology Platform subaccount. This organization is automatically mapped to the subaccount.

Context

An organization is required for creating spaces for development.

Procedure


2. Choose Enable Cloud Foundry.3. In the Create Cloud Foundry Organization window, enter a name for the organization.4. Choose Create.

5.3 Create a Space

Create spaces for different purposes in an SAP Business Technology Platform subaccount. For example, create one space for development and another for test, and allocate different quotas to different spaces.

Optionally, manage quota plans and restrict service quotas (and other quotas) to the space.

For detailed instructions on creating spaces, see Create Spaces.

Related Information

Creating the Cloud Foundry Organization and Space


https://help.sap.com/products/BTP/65de2977205c403bbc107264b8eccf4b/2f6ed22ccf424dae84345f4500c2d8ea.html?version=Cloud

https://help.sap.com/viewer/a96b1df8525f41f79484717368e30626/Cloud/en-US/dc18bac42270468d84b6c030a668e003.html

5.4 Create a Service Instance

Create an instance of Digital Manufacturing Cloud Services under a particular service plan.

Procedure


2. Select a space.

3. Choose Services Service Marketplace and then select the Digital Manufacturing Cloud Services tile.4. Choose Instances.5. Choose New Instance.6. Create a new instance, as follows:

a. Select the service plan insights, execution, partner or supplier based on your license.b. [Optional] Specify parameters.c. [Optional] Bind the service instance to an application that has already been deployed to the same

space.d. Enter a name for the instance.e. Choose Finish.

Related Information

Use the command line to create a service instance

5.5 Create a Service Key

Create a service key for a service instance to generate credentials.

Context

There're two ways to create a service key:

● Automatically create a service key by binding the service instance to an application



https://help.sap.com/viewer/65de2977205c403bbc107264b8eccf4b/Cloud/en-US/a872531845d6416b8fa07a8b84875d7e.html

● Create a service key manually

NoteYou need to bind the service instance to an application afterwards.

Procedure

Create a service key manually, as follows1. Go to your subaccount.

a. Log on to the SAP BTP cockpit and select a region.b. Select a global account.c. Select a subaccount.

2. Select a space.

3. Choose Services Service Marketplace and then select the Digital Manufacturing Cloud Services tile.4. Choose Instances.5. Create a service key, as follows:

a. Select an instance.b. Choose Service Keys.c. Choose Create Service Key.d. Enter a name for the service key and then choose Save.

Results

When the service key is created, make a note of the following:

Parameter Description

public-api-endpoint The base URL for making calls on public APIs

clientid A unique string representing the registration information provided by a client, the recipient of an access token

clientsecret The secret passphrase configured for the client


Parameter Description

url Authorization server that authenticates the client and grants authorization

The URL has this pattern: https://{subdomain}.authentication.{regionHost}.

The token service URL is the combination of this URL and /oauth/token: https://{subdomain}.authentication.{regionHost}/oauth/token

Related Information

Use the command line to create a service key

5.6 Register an OAuth 2.0 Client

To connect to Network, the service instance bound to your client application must be registered with Network as an OAuth 2.0 client. Use the Register OAuth 2.0 Clients app to make the registration.

Context

The registration of OAuth clients is required for making API calls on Network. Therefore, it's also relevant for the quality info record integration for PPAP with SAP S/4HANA Cloud.



https://help.sap.com/viewer/65de2977205c403bbc107264b8eccf4b/Cloud/en-US/0f48b2e84d73489692450ea7bf4d1916.html

6 Manage Members in an SAP Business Technology Platform Account

You can manage members on different levels: global account, subaccount, organization, and space.

NoteThese instructions are applicable only to the Cloud Foundry environment.

A member must be a user managed by the trusted identity provider. The SAP ID service is the default identity provider; as long as it's not set to inactive, you can add S-users as members at various levels.

To configure destinations in a subaccount, you must be a subaccount member.

To configure integrations with other systems in a space, you must be a space member with the Space Developer role.

To perform development-related tasks in a space, you must be a space member with the Space Developer role.

Related Information

Managing MembersRoles and Permissions

Operations Guide for SAP Digital Manufacturing CloudManage Members in an SAP Business Technology Platform Account PUBLIC 139

https://help.sap.com/viewer/65de2977205c403bbc107264b8eccf4b/Cloud/en-US/cc1c676b43904066abb2a4838cbd0c37.html

http://help.sap.com/disclaimer?site=https%3A%2F%2Fdocs.cloudfoundry.org%2Fconcepts%2Froles.html%23orgs

7 Add an Identity Authentication Tenant Administrator

As an administrator for an SAP Cloud Identity Services - Identity Authentication tenant, you can add more administrators in the administration console.

Prerequisites

You're assigned the Manage Tenant Configuration role.

Procedure

1. Log on to the administration console for the tenant.

2. From the side bar menu, choose Users & Authorizations Administrators .

3. In the administrator list, choose (Add) and then choose User.4. Enter the email, first name, and last name for the user that you want to add as an administrator.

If a user with the email already exists in the system, the First Name and Last Name fields are automatically filled.

5. Assign the appropriate roles to the new administrator.6. Save your entries.

Related Information

SAP Cloud Identity Services - Identity Authentication Documentation


Add an Identity Authentication Tenant Administrator

https://help.sap.com/viewer/6d6d63354d1242d185ab4830fc04feb1/Cloud/en-US/bbbdbdd3899942ce874f3aae9ba9e21d.html

8 Decommissioning Tenants, Data Return and Deletion

If you decommission one or several tenants, SAP deletes the customer data once the contract period ends. You can request the return of this data before it's deleted by SAP.

You trigger the decommissioning of a system/tenant using a request for termination, for instance, when you cancel a contract is canceled by you or when a contract expires. The termination starts with a notification period: As a customer, you receive a notification to inform you that your contract is going to be terminated and that you can request the return of your data using service ticket. You request the data return at any point in time until the termination date.

After the termination date, SAP triggers the decommissioning process of the system/tenant. Your customer accounts are deactivated and your customer data is deleted by technical means according to local legal requirements.

To decommission your tenants and request the return of customer data, follow this procedure:

1. To create a decommissioning request, raise an incident through SAP Support Portal .2. In this request, state the Tenant ID, Termination Date, and whether you request Data Return.3. Include the following information:

○ Support Component: Onboarding & Operations Issue: MFG-DM-OPS○ Short Text: DMC Data Replication: Data Return request as part of the decommissioning request○ Priority: Medium

You receive further information on how to recover your customer data from your DevOps team.

NoteYou must collect you customer data before the final termination date. SAP deletes all customer data at the end of the termination period.

Operations Guide for SAP Digital Manufacturing CloudDecommissioning Tenants, Data Return and Deletion PUBLIC 141

http://help.sap.com/disclaimer?site=https%3A%2F%2Fsupport.sap.com%2Fen%2Findex.html

9 How to Contact Us

Contact us if you encounter any issues that you can't resolve by yourself or if you want to provide feedback.

Context

● If you encounter technical issues, contact us by reporting an incident on the SAP Support Portal .These issues include unexpected downtime, denied access, missing authorizations, and so on.To report an incident, you must have an S-user account.

Application Components

Application Component Description

MFG-DM General Issues

MFG-DM-MD Master Data

MFG-DM-ME Manufacturing Execution

MFG-DM-ME-REO Resource Orchestration

MFG-DM-MA-PP Production Process Designer

MFG-DM-MI Manufacturing Insights

MFG-DM-MI-RPT Standard Reports

MFG-DM-MI-OEE Overall Equipment Effectiveness

MFG-DM-MN Manufacturing Network

● If you want to leave any feedback on our documentation, choose the icon on each help page. We value your feedback and use it to continuously improve the documentation.


How to Contact Us

http://help.sap.com/disclaimer?site=https%3A%2F%2Fsupport.sap.com%2F

Important Disclaimers and Legal Information

HyperlinksSome links are classified by an icon and/or a mouseover text. These links provide additional information.About the icons:

● Links with the icon : You are entering a Web site that is not hosted by SAP. By using such links, you agree (unless expressly stated otherwise in your agreements with SAP) to this:

● The content of the linked-to site is not SAP documentation. You may not infer any product claims against SAP based on this information.● SAP does not agree or disagree with the content on the linked-to site, nor does SAP warrant the availability and correctness. SAP shall not be liable for any

damages caused by the use of such content unless damages have been caused by SAP's gross negligence or willful misconduct.

● Links with the icon : You are leaving the documentation for that particular SAP product or service and are entering a SAP-hosted Web site. By using such links, you agree that (unless expressly stated otherwise in your agreements with SAP) you may not infer any product claims against SAP based on this information.

Videos Hosted on External PlatformsSome videos may point to third-party video hosting platforms. SAP cannot guarantee the future availability of videos stored on these platforms. Furthermore, any advertisements or other content hosted on these platforms (for example, suggested videos or by navigating to other videos hosted on the same site), are not within the control or responsibility of SAP.

Beta and Other Experimental FeaturesExperimental features are not part of the officially delivered scope that SAP guarantees for future releases. This means that experimental features may be changed by SAP at any time for any reason without notice. Experimental features are not for productive use. You may not demonstrate, test, examine, evaluate or otherwise use the experimental features in a live operating environment or with data that has not been sufficiently backed up.The purpose of experimental features is to get feedback early on, allowing customers and partners to influence the future product accordingly. By providing your feedback (e.g. in the SAP Community), you accept that intellectual property rights of the contributions or derivative works shall remain the exclusive property of SAP.

Example CodeAny software coding and/or code snippets are examples. They are not for productive use. The example code is only intended to better explain and visualize the syntax and phrasing rules. SAP does not warrant the correctness and completeness of the example code. SAP shall not be liable for errors or damages caused by the use of example code unless damages have been caused by SAP's gross negligence or willful misconduct.

Bias-Free LanguageSAP supports a culture of diversity and inclusion. Whenever possible, we use unbiased language in our documentation to refer to people of all cultures, ethnicities, genders, and abilities.

Operations Guide for SAP Digital Manufacturing CloudImportant Disclaimers and Legal Information PUBLIC 143

www.sap.com/contactsap

© 2022 SAP SE or an SAP affiliate company. All rights reserved.

No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP SE or an SAP affiliate company. The information contained herein may be changed without prior notice.

Some software products marketed by SAP SE and its distributors contain proprietary software components of other software vendors. National product specifications may vary.

These materials are provided by SAP SE or an SAP affiliate company for informational purposes only, without representation or warranty of any kind, and SAP or its affiliated companies shall not be liable for errors or omissions with respect to the materials. The only warranties for SAP or SAP affiliate company products and services are those that are set forth in the express warranty statements accompanying such products and services, if any. Nothing herein should be construed as constituting an additional warranty.

SAP and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP SE (or an SAP affiliate company) in Germany and other countries. All other product and service names mentioned are the trademarks of their respective companies.

Please see https://www.sap.com/about/legal/trademark.html for additional trademark information and notices.

THE BEST RUN

https://www.sap.com/about/legal/trademark.html

Date post:	05-Apr-2022
Category:	Documents
Upload:	others
View:	3 times
Download:	1 times