Epicor Security Group Design Worksheet
Security groups drift. People change roles, groups gain menus nobody removes and one administrator account ends up doing everything. A worksheet that scores each group makes the riskiest ones obvious.
| Security group | Business function | Users | Data sensitivity (1-5) | Write menus | SoD conflict? | Group owner | Last review | Exposure score | |
|---|---|---|---|---|---|---|---|---|---|
48 | |||||||||
30 | |||||||||
30 | |||||||||
20 | |||||||||
50 |
Exposure is a simple planning score, users times sensitivity plus the number of write menus. It helps rank groups for review and is not an Epicor-calculated figure. Confirm actual group setup in Security Group Maintenance for your version.
Access review support
Want help analysing an Epicor user and group export for outliers? Request an optional review.
Optional. The tool and every export work without this. No spam.
How to use the worksheet
List each security group, its business function, how many users hold it and how sensitive its data is on a one to five scale. Count the write menus it grants, mark any segregation of duties concern and assign an owner. The exposure score ranks groups, so you can start your review with the highest numbers and set a review date for each.
- One group per job function, not per person
- A named business owner for every group
- Review dates and evidence kept
- SoD conflicts flagged and mitigated
Design principles
Give users the minimum menus and companies needed for their function. Build groups around roles such as planner, buyer and shop floor user, then assign users to one or a small number of groups. Avoid copying one user's access to another. Keep administrative rights in a small dedicated group and use named accounts.
Segregation of duties
Typical conflicts include creating a supplier and approving its payments, entering and approving purchase orders, and adjusting inventory and counting it. Where small teams cannot separate duties, document compensating controls such as a periodic review of changes. Mark these rows so they are reviewed more often.
Common mistakes
Granting a broad group to fix one urgent request, never removing access when staff move, sharing generic accounts and forgetting integration users. Also review who can modify BAQs, BPMs and security itself, since those rights can bypass many other controls.
Frequently Asked Questions
How many security groups should we have?
As few as your roles require. Most manufacturers need a modest set of role-based groups for shop floor, planning, purchasing, finance, sales and administration. Too many near-identical groups become hard to review, and too few create over-broad access.
Where do I manage Epicor security groups?
Security groups are maintained in the Security Group Maintenance area, where menus, companies and options are assigned, and users are added in User Account Maintenance. Exact screen names can vary by version, so check your own menu.
How often should access be reviewed?
At least annually, and more often for finance and administrative groups or after reorganizations. Many audit programs expect quarterly review for the most sensitive groups, with evidence of who reviewed and what changed.
What about API and integration users?
Treat them as real users. Give each integration its own account with the narrowest security group and record the owner. Shared admin accounts for integrations are a common audit finding and hard to trace.
We can help review user access exports and flag outliers, and keep any AI access to your Epicor data within the same role rules.
Related Tools
Epicor Kinetic Upgrade Checklist
A phase-by-phase upgrade checklist covering inventory, testing, integrations, cutover and rollback for Epicor Kinetic.
EpicorEpicor REST API v2 URL Builder
Fill in server, instance, company and service to get a ready OData URL, a curl command and the required headers for the Epicor REST API v2.
EpicorEpicor BPM Directive Design Template
A fill-in design document for BPM method and data directives covering trigger, conditions, actions, testing and rollback.
EpicorEpicor BAQ Query Template Generator
Fill in company, days back and status filters to get a starter SQL for an open jobs BAQ, plus a design checklist for the Query Builder.
More Epicor tools
See all- Epicor Kinetic Job Status Reference
- Epicor DMT Import Template Worksheet (Part and BOM)
- Epicor MRP Run Checklist
- Epicor Safety Stock and Reorder Point Calculator
- Epicor EOQ and Lot Sizing Calculator
- Epicor Resource Group Burden Rate Calculator
- Epicor Shop Floor OEE Calculator
- Epicor Job Cost Variance Worksheet
- Epicor Shop Floor Labor Reporting SOP Template
New to Epicor ERP? Start with the Epicor ERP guide and toolkit, or plan with Training Path Builder, ERP Certification Study Planner, Upgrade Path Planner.
Keep exploring
Free tools
- Epicor Kinetic User Access Request Form TemplateA fill-in form for requesting, changing or removing Epicor user access, with security group, company and approval fields.
- Epicor Kinetic Private AI Layer Blueprint GeneratorGenerate a shareable private AI architecture plan for Epicor Kinetic on-premises, with components, security controls, rollout phases and open questions for IT.
- Epicor UD Table Design WorksheetAn editable worksheet for planning user defined tables and fields before you build them in Epicor, with a column count and key check.
ERP fixes and how-tos
- Epicor Kinetic: Menu Item Missing or Access Denied for a UserEpicor Kinetic user cannot see a menu item or gets an access denied message? Check security group, menu security, company access, license and role settings in order.
- Why Is Epicor So Slow? A Kinetic Performance ChecklistDiagnose slow Epicor Kinetic: separate client, app server, SQL Server, BAQ and network causes, with a step-by-step checklist and ways to tell slow from down.
- How to Add AI to Epicor Kinetic On-Premises Without Moving Your DataReference architecture for a private AI assistant on Epicor Kinetic on-premises: BAQ and REST v2 access, SQL replica, local LLM, roles, audit and rollout.
AI on your ERP
- Private AI for Epicor Kinetic Cloud, Outside the Multi-Tenant BoundaryRun a private LLM on Epicor Kinetic private cloud or Kinetic Cloud data via BAQs, REST v2 and Data Fabric, keeping sensitive manufacturing data off shared AI.
- AI for Epicor Kinetic Quality: Non-Conformances, CAPA, Inspection and TraceabilityAI for Epicor Kinetic quality: summarize non-conformances, find repeat defects, draft CAPA and trace lots, with audit-ready logs and on-prem deployment.
Integrations
- How to use ChatGPT with Epicor KineticConnect ChatGPT to Epicor Kinetic through a custom GPT with Actions, an exported dataset, or a private gateway. Covers BAQs, auth, data controls and when to go private.
- How to add AI agents to Epicor KineticHow to add AI agents to Epicor Kinetic: a tool layer over the REST v2 API and BAQs, MRP exception triage, PO expediting, and human approval before any write.
Software
- Epicor KineticEpicor Kinetic explained for manufacturers: modules, REST API, BAQs, deployment, strengths, limits and alternatives to compare before choosing or upgrading.
- Epicor CPQEpicor CPQ is a cloud configure-price-quote product with visual 3D configuration for manufacturers. Modules, ERP integrations and alternatives explained.