Oracle Fusion Cloud ERP is secure as delivered. Nobody can do anything until they are given roles and data access. The work in a project is to give each user exactly what their job needs, no more and no less, and to keep it that way after every quarterly update.
This guide is for consultants and security administrators doing the build, and for finance controllers who sign off who can do what. Oracle's own reference is the Securing ERP guide, and the Security Console itself is described in the Securing Applications guide.
How Fusion security works
Security in Fusion answers one question: who can do what, on which data. Two parts work together.
- Function security decides what a user can do. It comes from roles.
- Data security decides which data they can do it on, such as which ledgers or business units.
A job role on its own is not enough in ERP. A General Accountant with no data access set sees no ledger. Note also that data roles are an HCM concept. Oracle no longer uses them in ERP, so ERP data access is assigned separately against each job role.
Role types
| Role type | What it represents | Example | Assigned to users? |
|---|---|---|---|
| Job role | A job someone does | Accounts Payable Manager, General Accountant | Yes |
| Abstract role | A person's relationship with the business, not their job | Employee | Yes |
| Duty role | A group of privileges for one part of a job | A supplier invoice duty | No, only inside job or abstract roles |
| Aggregate privilege | A privilege bundled with its data security policies | Access to a work area or report | No, and it cannot be copied or changed |
Job and abstract roles inherit duty roles. Duty roles can inherit other duty roles and aggregate privileges. For General Ledger, Oracle supplies job roles such as General Accounting Manager, General Accountant and Financial Analyst.
Copy, do not edit
Oracle's predefined roles start with the code prefix ORA_. You cannot change their function security policies, Oracle's data security policies or their hierarchy. Oracle's own guidance is also not to hand predefined roles out without thought. They carry wide access, and some can count against your subscription. The accepted approach is to copy the nearest predefined role and remove what the job does not need.
The Security Console gives two copy options.
| Option | What you get | Effect of later Oracle changes |
|---|---|---|
| Copy top role | A new top role that still points to Oracle's original duty roles | Changes to those duty roles reach your copy |
| Copy top role and inherited roles | A new top role with new copies of every role below it | Your copy is insulated from changes to the originals |
Copying the top role only is lighter to maintain. Copying the full hierarchy gives full control, but you then own every duty role and must apply Oracle's changes yourself. We usually copy the top role and go deeper only where a duty role must change.
Set a naming standard before anyone builds a role. Never start a custom role code with ORA_. The Security Console adds a default prefix or suffix to copies, and you can set these on the Roles Administration page. A copied role does not take over the users of its source role, so you assign users yourself.
Setting up security roles: the steps
1. Map jobs to roles
List every finance job in scope, for example payables clerk, payables manager, general accountant and controller. For each, note the nearest predefined role, the privileges to remove and the data it needs. Get the finance controller to sign this matrix. It is the baseline for testing and audit.
2. Build the custom roles
Open the Security Console from Tools > Security Console. You need the IT Security Manager role. Copy the predefined roles, remove unneeded duties and privileges, and save. Track larger copy jobs under Administration > Role Status. Use Compare Roles to check your copy against its source.
3. Create users
Create users through the Security Console or the Manage Users task. User attributes such as business unit, department and job feed provisioning rules later.
4. Assign roles, by hand or by role mapping
For a small user base, assign job roles in the Security Console. For larger ones, use role mappings, created with the Manage Role Provisioning Rules task in Setup and Maintenance. A mapping grants a role when a user's assignment meets all its conditions, such as department and job. With Autoprovision set, the role is added and removed as the assignment changes. Requestable and self-requestable options let managers or users request roles that match the conditions. The Autoprovision Roles for All Users process applies mappings across the enterprise.
5. Assign data access
Use the Manage Data Access for Users task to give each user and job role its security context, such as a business unit for an Accounts Payable Manager. For General Ledger users, use Manage Data Access Set Data Access for Users. Data provisioning rules can automate this from work assignments.
6. Design data access sets for ledgers
A data access set is created automatically, with full read and write access, when you create a ledger or ledger set. You can add others:
- Full ledger access to a ledger or ledger set.
- Primary balancing segment value access to selected values, often matching legal entities. A parent value covers all its children.
Each can be read only or read and write, and you can mix levels. Ledgers in one set must share a chart of accounts and calendar. Use segment value security rules only where a real control needs account-level restriction. They add maintenance.
7. Check segregation of duties
Agree the conflicts that matter first: creating suppliers and paying them, entering and approving invoices, posting journals and approving them. The Security Console has a separation of duties check for roles you build. It is turned on with the profile option ASE_SEGREGATION_OF_DUTIES_SETTING on the Manage Administrator Profile Values page. Oracle Risk Management offers wider SoD analysis and checks before access is granted. Either way, review conflicts at user level as well as role level, since a user with two clean roles can still hold a conflict.
8. Test with real users
Test each custom role as a named test user with real data access. Check the Navigator menu, work areas, visible business units and ledgers, and what the user must not see. Record results against the signed role matrix. Our role design and SoD test playbook and UAT approach cover this in detail.
The quarterly update impact
Fusion is updated every quarter, and Oracle may change predefined roles. Changes to Oracle duty roles can reach a role you copied at top level only. Changes do not reach duty roles you copied yourself. Each quarter, read the release readiness material for Financials, compare affected roles, apply what you need to your custom roles, and rerun a short security regression pack. See how to test Oracle Fusion quarterly updates.
Security setup checklist
- Role matrix of jobs, roles, removed privileges and data access signed by finance
- Naming standard agreed; no custom role codes starting with ORA_
- Custom roles copied from predefined roles, not assigned as delivered
- Copy option (top role only or full hierarchy) decided and recorded per role
- Every job role paired with data access: business units, ledgers or data access sets
- Role mappings tested for joiners, movers and leavers
- SoD conflicts listed, checked at role and user level, and exceptions approved
- Positive and negative tests passed for each role with named test users
- Implementation consultant roles removed from users once setup is complete
- Quarterly role review and security regression pack scheduled
Security should not wait for the last month of the build. Set up test users with real roles early, as described in our Fusion Financials setup sequence.
How Egisedge helps
Egisedge Technologies is an Oracle Partner, founded in 2019, that implements Oracle Fusion Cloud ERP, HCM and SCM. Cybersecurity is one of our listed capabilities. We have delivered multiple Oracle projects. Our directors bring long Oracle finance experience: Anshuman Yadav has 20+ years in Oracle EBS and Fusion and finance transformation, and Nikhil Yadav has 16+ years in Oracle Finance, SCM and OTM. Our offices are in India, and our offshore teams cover GCC, UK/Europe, US and Australia/NZ working hours. See our Oracle Fusion implementation services.
Need a role design, an SoD review or a security clean-up before your next quarterly update? Email info@egisedge.com.
Frequently asked questions
Can I edit a predefined Oracle Fusion role?
Not in any useful way. Predefined roles have codes starting with ORA_, and you cannot change their function security policies, Oracle's data security policies or their role hierarchy. The normal approach is to copy the predefined role in the Security Console and change the copy.
What is the difference between a job role and a duty role in Oracle Fusion?
A job role matches a job a person does, such as Accounts Payable Manager, and is assigned to users. A duty role is a group of privileges for one part of a job. Duty roles are not assigned to users directly; they sit inside job or abstract roles.
How do I give a General Ledger user access to only some ledgers?
Use data access sets. A data access set can give full access to a ledger or ledger set, or access to selected primary balancing segment values, as read only or read and write. Assign it to the user's job role with the Manage Data Access Set Data Access for Users task.
Do quarterly updates affect custom roles?
They can. Oracle updates may change predefined roles, and those changes do not always flow into your copies. Check the release readiness material for your product area each quarter, apply relevant changes to your custom roles and retest key users.
Talk to Egisedge about ERP Financials
Tell us where you are and we'll reply within one working day with next steps.