Oracle Fusion Cloud HCM Security: Data Roles and Audit

Oracle Fusion Cloud HCM holds salaries, bank details, national identifiers and the hire, change and termination events that drive access everywhere else, so who can see which people, and who can bulk load changes, is one of the most consequential access decisions an organisation makes. Fusion HCM separates what a user can do (function security, through roles) from which records they can do it to (data security, through HCM security profiles combined into data roles). Getting that split right, and controlling the bulk load and integration paths, is what stops a support user from reading the whole workforce or a compromised account from changing payment details at scale. This guide goes below the suite-level view in the Oracle E-Business Suite and Fusion Security Guide into HCM job and data roles, person and organisation security profiles, role provisioning, HCM Data Loader access, sign-in controls and audit policies. It is written for HCM security administrators, HR systems teams and the security and audit staff who review them.

This is an independent guide from NHI Mgmt Group, based on Oracle's public Fusion Cloud HCM security documentation as of November 2026. It is not sponsored or reviewed by Oracle. Product features change, so confirm settings against Oracle's current documentation.

Key takeaways

Data roles are yours to build. Oracle delivers no predefined HCM data roles: each one combines a job role with security profiles that you design, so data scope is a customer decision from day one.
Keep security profiles off job roles. Oracle recommends assigning security profiles through HCM data roles or abstract roles, not directly to job roles, because people with the same job usually need different data.
View All profiles are the privileged access. Predefined profiles such as View All Workers and View All People grant enterprise-wide record access; track every data role that includes them.
Restrict security objects in HCM Data Loader. Set Enable Restrict Access to Security Related Business Objects to Yes so only roles with Load HCM Security Data can bulk load users, role mappings and security profiles.
Auditing is off until you turn it on. Configure business object attributes and Manage Audit Policies, including Personal Payment Method in HCM Payroll, before you need the evidence.

How identity and access work in Oracle Fusion Cloud HCM

A Fusion user account is linked to a person record, and roles reach the account either by direct assignment in the Security Console or automatically through role mappings evaluated against the person's assignments. Sign-in is through local credentials with optional multifactor authentication, or through SAML 2.0 single sign-on with your identity provider.

Role types

Role type	What it represents	Data security	Typical examples
Abstract role	A person's general relationship to the enterprise	Security profiles can be assigned directly, for example for basic data access	Employee, Line Manager, Contingent Worker
Job role	A job function, built from duty roles and privileges	Reaches data through an HCM data role, not directly	Human Resource Specialist, IT Security Manager
Duty role	A reusable group of privileges for one duty	Inherited by the job role	HCM Data Load (ORA_HRC_HCM_DATA_LOAD_DUTY)
HCM data role	A job role plus the data its holder may access	Security profiles for person, organisation, position, payroll and other objects	Human Resource Specialist for one legal employer (you name and build it)
Privilege	Access to a function or a data action	Function or data security	Manage Audit Policies (FND_MANAGE_AUDIT_POLICIES_PRIV)

HCM security profiles

A security profile identifies a set of instances of one HCM object type, using criteria that all apply together. Profiles are reusable and can include each other, for example an organisation profile inside a position profile to secure positions by department or business unit. Managing them requires the IT Security Manager job role.

Profile type	What it secures	Design point
Person (Managed Person)	People the user can act on	Scope by organisation, manager hierarchy or area of responsibility; most sensitive profile
Person (Public Person)	People the user can find in the worker directory and some lists of values	Broader than managed person is normal; keep it separate
Organisation	Departments, legal employers, business units	Reuse inside person and position profiles
Position	Positions	Nest an organisation profile rather than duplicating criteria
Legislative Data Group	Country-specific payroll and legislative data	Limits payroll staff to their countries
Payroll and Payroll Flow	Payrolls and payroll processes	Separate payroll processing from HR maintenance
Country, Document Type, Job Requisition, Talent Pool, Transaction	Those objects	Document type profiles matter for identity documents and visas

By default users cannot see future-dated organisation, position or person records; Include future people, Include future positions and Include future organizations change that per profile. Oracle notes that View All Workers excludes future-dated person records while View All People includes every person record, contacts and future-dated records included. Enable future access only for the roles that process new hires.

Admin roles and privileged access

IT Security Manager: manages security profiles, data roles, users and MFA settings in the Security Console. Oracle's MFA documentation asks for a custom role based on IT Security Manager to manage MFA. Hold it for a small security administration group and never combine it with HR transactional roles.
Application Implementation Consultant: a broad implementation role that includes Manage Audit Policies. Use it during implementation only, then remove it from named users and keep a break-glass procedure.
Internal Auditor: holds View Audit History (FND_VIEW_AUDIT_HISTORY_PRIV). Give auditors this role rather than an administrative one.
View All data roles: any HCM data role built on View All Workers, View All People or View All Positions is enterprise-wide access to personal data and belongs in your privileged access register.
Payroll and HR separation: a role that can both change a worker's Personal Payment Method and approve or run payroll defeats the control that catches payroll diversion. Model it in your Segregation of Duties Guide matrix.

Role provisioning

Role mappings with the Autoprovision option grant roles automatically when a person's assignment matches the mapping's conditions, and remove them when it no longer matches. The Autoprovision Roles for All Users process compares every current assignment with every current mapping; Oracle advises running it after creating or editing mappings and after bulk loads, no more than once a day, with Send Pending LDAP Requests scheduled daily to apply future-dated requests. A user left with no roles is suspended automatically by default. This makes role mappings the main joiner, mover and leaver control: review every mapping that grants an administrative or View All role as carefully as a direct grant. See the Identity Lifecycle Event Design Guide.

Copying and changing roles

Customise by copying predefined job, abstract and duty roles in the Security Console rather than editing them, and use the console's Compare Roles, role hierarchy and Simulate Navigator Menus features to check what a copied role actually grants before you assign it.

Integrations, API tokens and service accounts

HCM Data Loader

HCM Data Loader (HDL) bulk loads and updates HCM objects from files placed in Oracle WebCenter Content. It is the fastest legitimate way to change thousands of records, so it needs the tightest scoping.

Access	Role or privilege	Control
Import and load files	HCM Data Load duty role (ORA_HRC_HCM_DATA_LOAD_DUTY)	Only in custom integration roles with a named owner
Upload files to WebCenter Content	Upload data for Human Capital Management file based import (HCM_DATALOADER_IMPORT_RWD)	Grant to the integration account, not to HR users
Download exports	Download data from Human Capital Management file based Export (HCM_DATALOADER_EXPORT_RWD)	Separate from import; exports contain personal data
Delete staged data and protected data sets	HRC_DELETE_HDL_STAGE_DATA, HRC_HDL_DEL_PROTECTED_DS	Restrict; deleting staged data removes evidence of what was loaded
Configure HDL	Manage Configuration of HCM Data Loader (HRC_MANAGE_CONFIGURATION_HCM_DATA_LOADER)	Security administrators only
Load security objects	Load HCM Security Data (HRC_LOAD_HCM_SECURITY_DATA_PRIV) with Enable Restrict Access to Security Related Business Objects set to Yes	Covers User, Role Mapping, Delegated Role, security profiles, Areas of Responsibility and Exclusion Rule objects
Start HDL through REST	Create HCM Data Loader Data Set Using REST Service (HRC_CREATE_FILE_DATA_SET_USING_REST_PRIV), enforced from release 25A	Grant only to the integration that calls createFileDataSet

Oracle notes that business object access is checked when a data set is imported, and data sets imported before the restriction was switched on can still be processed. Switch the restriction on early and clear old staged data sets. The integration account's own data roles still decide which people it can load, so give it a security profile that matches the integration's real scope rather than View All by habit.

REST and SOAP integration accounts

Inbound API calls can authenticate with tokens through an Oracle API Authentication Provider defined in the Security Console under API Authentication, with JWT, SAML or STS token types, a trusted issuer whose name matches the JWT iss value, and an imported public certificate. Oracle recommends JWT for a system account created for a specific application, because a password-based system account expires under the password policy. For integration accounts generally:

One account per integration: each with its own custom role and data role, so audit history names the integration.
MFA exclusions only where needed: Oracle allows MFA exclusion for automation users in non-production environments through Configure MFA Exclusion on the user account; prefer token authentication for production automation.
Owners and reviews: record an owner for every integration account and include it in access reviews. See the SaaS API Token Security Guide.

Sign-in: SSO and MFA

Single sign-on: on the Security Console Single Sign-On tab, add a SAML 2.0 identity provider, test it on the Diagnostics and Activation tab, then enable it. Enable Chooser Login Page keeps the local sign-in option visible for break-glass accounts.
MFA for local accounts: in Security Console User Categories, set Enforce MFA During Sign-in to Requires MFA and choose factors. Oracle lists email, SMS, Oracle Mobile Authenticator passcode and notification, FIDO passkey authenticators and bypass codes. SSO users are not prompted to enrol, so MFA for them is enforced in your identity provider. Prefer FIDO passkeys for administrators. See the MFA Guide.

Logging and detection

Audit policies

Fusion records create, update and delete events on HCM business objects, including bulk uploads, once auditing is configured. Auditing is disabled by default. Select the objects and attributes on the Configure Business Object Attributes page, then enable auditing on the Manage Audit Policies page; auditing starts immediately. Review results under Navigator, Tools, Audit Reports.

Payroll diversion evidence: in the HCM Payroll application, audit Personal Payment Method, which holds a person's payment method details, along with Element Entry and Element Entry Value. See the Payroll Diversion Fraud Guide.
Security changes: audit the security profile and role mapping objects your administrators change, and use the User and Role Access Audit Report and User Password Changes Audit Report from the Security Console reporting set.
Sign-in activity: Oracle documents how to get user sign-in and sign-out information and how to read SSO federation logs; export them to your SIEM.
Dormant accounts: run the Inactive Users Report and act on accounts with no sign-in, especially integration and implementation users.

Detection ideas

Personal Payment Method changes followed quickly by a payroll run, or several changes to the same bank account across different workers.
New or edited role mappings that grant View All data roles or IT Security Manager.
HDL loads of security-related objects, or loads from an account outside its normal schedule.
Large HCM extracts or HDL exports by a user who does not normally run them.

Metrics that show it is working

Number of users holding a data role with a View All person profile, trending down.
Share of administrators and HR users signing in through SSO with phishing-resistant MFA.
Integration accounts with a named owner and token authentication, against the total.
Time from termination to account suspension through autoprovisioning.
Personal Payment Method changes verified out of band before the next payroll.

Hardening baseline

Area	Baseline setting (NHI Mgmt Group recommendation)
Data security	Reusable organisation, person and position profiles combined into named HCM data roles; no profiles on job roles; View All limited and listed
Future-dated access	Include future people only on roles that process new hires
Provisioning	Role mappings with Autoprovision for standard access; Autoprovision Roles for All Users and Send Pending LDAP Requests scheduled
HDL	Enable Restrict Access to Security Related Business Objects = Yes; import and export rights split; REST initiation privilege granted only to the integration
Sign-in	SAML SSO with MFA at the identity provider; Requires MFA for local accounts; chooser page for break-glass
API access	Oracle API Authentication Provider with JWT for system accounts
Audit	Audit policies on person, assignment, Personal Payment Method, element entries and security objects; audit history viewing through Internal Auditor

Rollout plan

Baseline: export users, roles and data roles, and list every data role that uses a View All profile. Turn on audit policies first so the clean-up itself is recorded.
Design profiles: build reusable organisation and person profiles per legal employer or business unit, then new data roles that use them. Test in a non-production environment with Simulate Navigator Menus and test users.
Move users: change role mappings to the new data roles for one population, run Autoprovision Roles for All Users, and check access with HR. Roll back by restoring the previous mapping and rerunning the process.
Lock HDL: switch on the security object restriction, split import and export, and move integrations to token authentication.
Enforce sign-in: enable SSO and MFA, with a tested break-glass account.
Review: quarterly access reviews of View All roles, administrators and integration accounts. See the Access Reviews Guide.

NHI Mgmt Group's view on scale: a small organisation with one legal employer may reasonably run a handful of data roles with organisation-wide person profiles for HR, provided payroll and security administration are separated. Multinationals should scope every HR and payroll data role by legislative data group and legal employer from the start, because retrofitting scope after go-live means re-provisioning thousands of users.

Common misconfigurations

View All as the default: implementation data roles built on View All Workers stay in production and are copied into business-as-usual roles.
Profiles attached to job roles: the job role grants the same data to everyone who holds it, against Oracle's recommendation.
Implementation users kept: Application Implementation Consultant and IT Security Manager remain on consultant accounts after go-live.
Unrestricted HDL: the security object restriction is left at its default, so any HDL-capable role can load users and role mappings.
Shared integration account: one password-based account with View All serves several integrations, so audit history cannot tell them apart.
No payment method audit: Personal Payment Method changes are not audited, leaving payroll teams without a record when a worker reports missing pay.

Framework mapping

HCM control	NIST SP 800-53 Rev 5	NIST CSF 2.0	MITRE ATT&CK technique addressed
HCM data roles and security profiles	AC-6, AC-2	PR.AA-05	T1213 Data from Information Repositories
Payroll and HR separation	AC-5	PR.AA-05	T1098 Account Manipulation
Role mappings and autoprovisioning	AC-2	PR.AA-01	T1078.004 Cloud Accounts
SSO, MFA and token authentication	IA-5	PR.AA-01	T1078.004 Cloud Accounts
Audit policies and reports	AU-2, AU-6	DE.CM-03	T1098 Account Manipulation

Practitioner checklist

Every HCM data role has an owner, a documented scope and no security profile attached at job role level.
Data roles using View All Workers, View All People or View All Positions are listed and reviewed quarterly.
Include future people is enabled only on new-hire processing roles.
IT Security Manager and Application Implementation Consultant are held by a small named group, with implementation users removed.
Role mappings granting privileged roles are reviewed like direct grants; autoprovisioning jobs run on schedule.
Enable Restrict Access to Security Related Business Objects is set to Yes and Load HCM Security Data is tightly held.
HDL import, export and REST initiation privileges are split and granted to named integration accounts.
SSO is enabled with MFA at the identity provider, and local accounts use Requires MFA.
Audit policies cover person, assignment, Personal Payment Method, element entries and security objects.
Audit reports, sign-in data and federation logs reach the SIEM.

Oracle Fusion Cloud HCM Security: Control Data Roles, Security Profiles, Loaders and Audit