When you want ERP Analytics and HCM Analytics to share one FDI instance, you should activate the new analytics subscription and link it to the existing FDI instance during the activation process. Linking at activation ties the analytics services to the same environment, giving you a unified setup where data connections, security, and user access are managed in one place. This avoids fragmentation and ensures both analytics offerings are immediately available under the same instance. If you activate but don’t link right away, the subscription will exist but won’t be connected to that FDI instance, which means extra steps later to attach it and potential configuration drift. Creating a separate FDI instance for HCM adds unnecessary complexity and maintenance, and attempting to merge subscriptions after activation isn’t the intended workflow. Linking during activation provides a clean, consolidated setup from the start.

The changes to security assignments must flow automatically by having the security-user data stored where the ADW used by your FDI instance can read it. Filling the oax_user schema in that ADW with the necessary user and role mappings provides a centralized, automatically-consumed source for security updates. When this schema is seeded with the proper data, FDI can pick up and apply changes without manual imports, ensuring that access controls stay in sync as security assignments evolve in the system. Using a local CSV file would require ongoing manual loading and wouldn’t automatically propagate updates. The ERP system and the HCM schema hold business data, not the dedicated security mapping that ADW uses to govern access for FDI, so they don’t provide the automatic synchronization mechanism needed.

FAW controls who can see which data through data roles and data filters. To override default data security for specific users, you create a custom data role and attach data filters that specify permissible values for certain dimensions (for example, a particular business unit, department, or other dimension you’re using to segment data). Assigning this custom role to the user makes their data access follow these filters, effectively tailoring visibility for that individual while preserving the overarching security framework. This approach is preferable to altering the global policy or changing environment settings, which would impact all users or require broad changes. It’s also not about identity provisioning or SSO—those handle who a user is, not precisely what data they can view—so they don’t achieve per-user data override.

Once you’ve created the custom security group and assigned users to it, the next essential step is to map the required data, duties, and licensed roles to that group. This is where you translate membership into actual permissions: mapping data access defines what records and data the group can see; mapping duties determines what actions the group can perform within the application; and assigning licensed roles ensures the group has the appropriate permissions tied to its license entitlements. Without these mappings, the group exists as a container, but its members wouldn’t inherit specific access rights. Enabling SSO, exporting configurations, or deleting the group aren’t part of establishing the group's permissions and are unrelated to the immediate next step after grouping and adding users.