Question: How to restrict access to EnableNow in regards to licensing (SuccessFactors & EnableNow)

[amarx74]

Hello everyone, 

We have the issue that we want to roll out EnableNow for a limited population only. Yet, in regards to licenses, we do not see any clean solution to restrict users in SuccessFactors not to access EnableNow (via SSO), so users outside the population do not generate costs just by accidentally opening the SAP Companion via the question mark button at the top. 
Is there any technical solution to this issue?

[Anton_Mavrin1 · Accepted solution]

This could be done via Single Sign-On configuration. You can create a group in you corporate Identity provider (e.g. MS Entra ID) and assign this group to the SAP Enable Now application, so that only users who are members of this group can access SAP Enable Now.

[amarx74 · Accepted solution]

Whe thought of that too, but we noticed that as soon as EnableNow is connected with SF, users get this login popup if they are not set up for the SSO with EnableNow. Will this disappear once the grouping in IAS (our identity provider) is set up? Currently, only a small population will use EnableNow and we want to avoid all the others getting this popup when opening SuccessFactors.

[amarx74 · Accepted solution]

Whe thought of that too, but we noticed that as soon as EnableNow is connected with SF, users get this login popup if they are not set up for the SSO with EnableNow. Will this disappear once the grouping in IAS (our identity provider) is set up? Currently, only a small population will use EnableNow and we want to avoid all the others getting this popup when opening SuccessFactors.

[Anton_Mavrin1 · Accepted solution]

What you can try is to add these parameters to the SAP Companion settings in SFSF. enableExternalUsage=true;externalUsageTimeout=<time in seconds required for employees to complete the SSO authentication> This trick prevents the failed authentication popup from appearing if the SSO authentication against the IdP fails in the background. The parameters were designed for external content consumption scenarios via SAP Companion, but they have also proven useful as workarounds for cases like yours.

[amarx74 · Accepted solution]

Thank you so much for your quick help 🙂

[Kevin_Norris · Accepted solution]

Are their similar parameters that can be utilised to prevent the failed Authentication pop up in SAP WorkZone ?