Epicor Security Group Design Worksheet
Security groups drift. People change roles, groups gain menus nobody removes and one administrator account ends up doing everything. A worksheet that scores each group makes the riskiest ones obvious.
| Security group | Business function | Users | Data sensitivity (1-5) | Write menus | SoD conflict? | Group owner | Last review | Exposure score | |
|---|---|---|---|---|---|---|---|---|---|
48 | |||||||||
30 | |||||||||
30 | |||||||||
20 | |||||||||
50 |
Exposure is a simple planning score, users times sensitivity plus the number of write menus. It helps rank groups for review and is not an Epicor-calculated figure. Confirm actual group setup in Security Group Maintenance for your version.
Access review support
Want help analysing an Epicor user and group export for outliers? Request an optional review.
Optional. The tool and every export work without this. No spam.
How to use the worksheet
List each security group, its business function, how many users hold it and how sensitive its data is on a one to five scale. Count the write menus it grants, mark any segregation of duties concern and assign an owner. The exposure score ranks groups, so you can start your review with the highest numbers and set a review date for each.
- One group per job function, not per person
- A named business owner for every group
- Review dates and evidence kept
- SoD conflicts flagged and mitigated
Design principles
Give users the minimum menus and companies needed for their function. Build groups around roles such as planner, buyer and shop floor user, then assign users to one or a small number of groups. Avoid copying one user's access to another. Keep administrative rights in a small dedicated group and use named accounts.
Segregation of duties
Typical conflicts include creating a supplier and approving its payments, entering and approving purchase orders, and adjusting inventory and counting it. Where small teams cannot separate duties, document compensating controls such as a periodic review of changes. Mark these rows so they are reviewed more often.
Common mistakes
Granting a broad group to fix one urgent request, never removing access when staff move, sharing generic accounts and forgetting integration users. Also review who can modify BAQs, BPMs and security itself, since those rights can bypass many other controls.
Frequently Asked Questions
How many security groups should we have?
As few as your roles require. Most manufacturers need a modest set of role-based groups for shop floor, planning, purchasing, finance, sales and administration. Too many near-identical groups become hard to review, and too few create over-broad access.
Where do I manage Epicor security groups?
Security groups are maintained in the Security Group Maintenance area, where menus, companies and options are assigned, and users are added in User Account Maintenance. Exact screen names can vary by version, so check your own menu.
How often should access be reviewed?
At least annually, and more often for finance and administrative groups or after reorganizations. Many audit programs expect quarterly review for the most sensitive groups, with evidence of who reviewed and what changed.
What about API and integration users?
Treat them as real users. Give each integration its own account with the narrowest security group and record the owner. Shared admin accounts for integrations are a common audit finding and hard to trace.
We can help review user access exports and flag outliers, and keep any AI access to your Epicor data within the same role rules.
Related Tools
Epicor Kinetic Upgrade Checklist
A phase-by-phase upgrade checklist covering inventory, testing, integrations, cutover and rollback for Epicor Kinetic.
EpicorEpicor REST API v2 URL Builder
Fill in server, instance, company and service to get a ready OData URL, a curl command and the required headers for the Epicor REST API v2.
EpicorEpicor BPM Directive Design Template
A fill-in design document for BPM method and data directives covering trigger, conditions, actions, testing and rollback.
EpicorEpicor BAQ Query Template Generator
Fill in company, days back and status filters to get a starter SQL for an open jobs BAQ, plus a design checklist for the Query Builder.
More Epicor tools
See all- Epicor Kinetic Job Status Reference
- Epicor DMT Import Template Worksheet (Part and BOM)
- Epicor MRP Run Checklist
- Epicor Safety Stock and Reorder Point Calculator
- Epicor EOQ and Lot Sizing Calculator
- Epicor Resource Group Burden Rate Calculator
- Epicor Shop Floor OEE Calculator
- Epicor Job Cost Variance Worksheet
- Epicor Shop Floor Labor Reporting SOP Template