SAP Knowledge Base Article - Public

2959619 - Dynamic Groups - Users with permission to Manage My Group can see user information

Symptom

Dynamic Groups - Users with permission to Manage My Group can see user information

Environment

SAP SuccessFactors HXM Suite

Reproducing the Issue

  • If a user goes to "Settings" > "Groups" > creates a group
  • For example using people pool fields "Country" = Germany and "date of birth" for example less than today
  • The group membership is updated with all users from Germany with a date of birth less than today - so basically every user from Germany
  • You can then check the membership list go to "Take action" > "display options" and select date of birth and/or country
  • Now the user can see all German users data (first name, last name, date of brth, job code, location, country)
  • They can do this with any of the fields in the people pool.
  • Even if they just setup the Dymanic group for "Country" Germany - they can then see all users names, job codes and locations for anyone in Germany.

Cause

When user get the permission to Manage My Group, he/she could filter users without target population restriction for the fields like First Name, Middle Name, Last Name, Job Code and Location, and the specific general group fields under Mange My Group People Pool

Resolution

 Working as designed

Keywords

Dynamic Groups, Manage My Group , KBA , LOD-SF-PLT-DYG , Dynamic Groups (My Groups - Not RBP) , Problem

Product

SAP SuccessFactors HXM Core 1911 ; SAP SuccessFactors HXM Suite all versions