SAP SuccessFactors Proxy Rights: Automatic All-Module Access on November 13

31 October 2026 | SAP documentation published 2 October 2026 | Production effective date: 13 November 2026 | Status: documented for 2H 2026, not yet verified live in any specific production tenant. An administrator who can create proxy assignments is not necessarily someone who should be able to act as another employee. SAP SuccessFactors is separating those two privileges in its 2H 2026 release. The important catch is in the migration: existing holders of Proxy Management are automatically granted Proxy Rights with every proxy module selected. SAP designed this to preserve current behavior, but it makes a pre-production access review worth doing. This is not a newly announced change today; it is a documented October release change with a near-term production date. SAP What's New, PLA-57182, latest revision 2 October 2026.

The security question hiding inside a routine release

Imagine an HR operations administrator who needs to assign a proxy for a colleague during leave. Their job may require opening the Proxy Management screen, but it does not automatically follow that they need to impersonate every user in their target population across all supported modules. Previously, the Proxy Management permission combined access to the administration interface with broad proxy capability. SAP is splitting that behavior into two separately controlled permissions. The business opportunity is least-privilege access; the operational risk is assuming the new permission split automatically narrows existing roles. It does not. SAP's before-and-after permission matrix.

Exactly what changes on 13 November?

Proxy Management now controls the ability to access the Proxy Management UI and create assignments for the role's target population. Proxy Rights, found under General User Permission, controls the ability to act as a proxy for the target population and to configure group-to-group proxy assignments. A Proxy Rights role can select all supported modules or a subset. The role definition has three distinct dimensions: Access Population (who can act), Target Population (whose identity can be proxied), and Proxy Modules (where proxy access applies). These are not interchangeable controls. SAP's official configuration and RBP prerequisites.

Migration behavior matters: When the release takes effect, users who already hold Proxy Management are granted Proxy Rights with all proxy modules selected. SAP says no manual migration is required. This is not evidence of a newly created privilege beyond what those administrators could already do: before the split, Proxy Management itself enabled broad proxy access. Rather, SAP preserves that access instead of silently revoking it. If your security policy intended some administrators to manage assignments without acting as proxy, this release gives you a mechanism to enforce that separation, but your team must review and narrow the inherited rights. SAP's automatic-grant statement.

Two permission details that can surprise auditors

Reporting is not automatically report-by-report restricted. SAP warns that selecting the Reporting proxy module or its submodules gives access to all reports. Similarly, selecting the Performance Management Forms proxy module gives access to all Performance Management forms. SAP directs customers to the Proxy Management administration tool for more granular restrictions on reports and forms. Do not equate module selection with granular object-level authorization. SAP's module-selection warning.

Explicit one-to-one assignments still matter. A person can act as proxy through Proxy Rights or through an explicit 1:1 assignment created in Proxy Management. When both apply, SAP says the explicit 1:1 assignment takes priority. That means removing or narrowing a group-level right is not a complete review of effective proxy access: administrators should also inspect applicable direct assignments. Conversely, a role needs Proxy Management to open the management interface; Proxy Rights alone is not the same as administration access. SAP's permission prerequisites and precedence rule.

Who should take action?

SuccessFactors security owners: identify roles granting Proxy Management and the users and groups receiving those roles. Record the intended business purpose, target population, and proxy modules. HRIS administrators: determine which people only need to maintain proxy assignments and which genuinely need to act as proxy. Internal audit: request evidence of current rights, the post-release migration, and the decision to retain or narrow access. Implementation partners: verify the behavior in a 2H 2026 Preview tenant and prepare a controlled production change rather than relying on a generic release checklist. These are recommended control activities, not SAP-mandated configuration steps. SAP's release note and administrative path.

A practical five-step review before production

1. Establish the baseline

In Admin Center > Manage Permission Roles, find roles with Proxy Management. For each role, document the access population and target population. Identify roles used by external partners, support administrators, HR operations, and any broad technical groups. Do not export employee-sensitive data into uncontrolled spreadsheets. A role inventory should distinguish the capability to manage proxy relationships from the capability to act as a proxy. SAP's role configuration guidance.

2. Confirm the migration in Preview

In a Preview tenant with the 2H 2026 release, check whether the corresponding Proxy Rights permission appears and whether all modules are selected for migrated roles. Record what you actually observe, including the tenant release/build and test date. SAP documents the intended migration, but the existence of a release note is not proof that a particular tenant has already received it. Avoid changing production permissions based solely on a screenshot from another customer's environment. SAP release status, valid-as-of date, and enablement.

3. Apply least privilege deliberately

For an administrator who only needs to create assignments, retain the necessary Proxy Management permission and assess whether Proxy Rights should be removed. For someone who genuinely acts as proxy, limit the target population and select only required modules. Review Reporting and Performance Management Forms separately because of SAP's broad-access warning. Treat the decision as a business authorization review, not a cosmetic role cleanup. Test both permitted and forbidden scenarios with authorized test identities. SAP's permission separation and module warnings.

4. Test direct proxy assignments and regression scenarios

Verify that an authorized administrator can still create a proxy assignment; a user without Proxy Rights or an explicit assignment cannot proxy into a target; a user with selected module rights cannot proxy into unselected modules; and explicit 1:1 assignments behave according to SAP's documented precedence. If an administrator uses proxy access for operational support, confirm the necessary work still functions. These are proposed acceptance tests and must be adapted to the customer's enabled modules and authorization model. SAP's documented proxy rules.

5. Preserve an audit trail and assign ownership

Record the before-and-after role configuration, test identities, results, approver, and production change reference. The same 2H 2026 release documents a V2 generation of RBP change audit reports with more fields and faster data availability. SAP notes that Audit Log Service can return two record sets for one RBP change during the transition; downstream consumers should distinguish them using objectType. The V2 report has its own prerequisites, including enabled change audit logging. Do not assume it is already enabled in your tenant. SAP What's New, PLA-56544: RBP change audit reports V2.

How this fits with other RBP changes

Proxy rights are not the only authorization-related change in the 2H release. SAP also documents a route to assign Learning administrator roles through RBP. That capability requires Learning to be integrated and sealed and to run version 2H 2026 or later; role changes are synchronized through a job rather than taking effect immediately. It is a separate feature and should not be mistaken for the Proxy Rights migration. For customers managing HR and Learning security together, it is sensible to coordinate the two reviews while keeping their prerequisites and evidence separate. SAP Learning administrator assignment guide.

Availability, scope, and what remains unknown

SAP classifies module-level proxy access control as a Major change, with Automatically on enablement and General Availability lifecycle for software version 2H 2026, valid as of 13 November 2026. The official entry's latest revision is 2 October 2026. That lifecycle classification is not proof of activation in a specific customer's production environment today. This article does not claim that a tenant has been tested, that every customer uses proxy assignments, or that the migration increases permissions beyond their pre-release effective access. Confirm tenant readiness, effective role assignments, and the actual deployment window with your SAP release resources. SAP technical details and change history.

The architect's takeaway

The headline is not that SAP is giving administrators a dangerous new power. The more useful observation is that the release preserves broad existing proxy access while introducing the controls to narrow it. A system migration that avoids breaking current processes can also preserve an authorization design that deserves a second look. Before 13 November, the strongest outcome is a short, evidence-backed decision for every broad proxy role: keep, narrow, or remove the ability to act as proxy, and verify the decision in Preview. Primary SAP source: Module-Level Proxy Access Control in Role-Based Permissions.

Official references

SAP SuccessFactors What's New: Module-Level Proxy Access Control in Role-Based Permissions (PLA-57182; HCM-7ED0-308A); SAP SuccessFactors What's New: Change Audit Reports for RBP Now Available in Two Versions (PLA-56544); SAP Help: Learning Administrator Role Assignment Through RBP.