Skip to Content
Author's profile photo Former Member

How to create and give module wise project IMG access to SAP Consultants

SPRO Project IMG Authorization

                                                             

How to create and give module wise project IMG access to SAP Consultants

Recently I have come up with a requirement where in out of all SAP HCM modules client want to keep up few modules like EREC, TIME & ESEP with themselves for supporting internally with their own teams.

The requirement was in such a way that only the assigned member should have access to his own module for config and development activities and no other module access should be given to him.

For Instance: E Rec Consultant should have only access to EREC SPRO nodes, Tcodes & Tables and he should not be able to view other nodes in SPRO except EREC and in the same way for ESEP & TIME consultant.

Solution :

Following steps are done in order to achieve the above requirement along with the basis and technical team.

v

  Steps for creating a project and defining team members for the project.

1.    1. Goto Tcode : SPRO_ADMIN

/wp-content/uploads/2015/07/1_744720.png

2.    2. Click on Create Project

/wp-content/uploads/2015/07/2_744746.png

3.    Enter Project name in the prompt & enter description and save.

/wp-content/uploads/2015/07/3_744748.png

4.    4. Click on scope tab, select the first option “Specify project scope by making manual selections in  Reference IMG”

/wp-content/uploads/2015/07/4_744750.png

5.  5. Now click on Specify scope button, and select the relevant entries for you. If you want all select all. You need to navigate through the menu and make sure

        that basis transactions are not added. Generally SU01, SU02, PFCG and many other transactions gets added.

/wp-content/uploads/2015/07/5_744753.png

6.  Now click on “generate project IMG” button and it will prompt and ask to create in background and background job will be generate to activate the project.

/wp-content/uploads/2015/07/6_744754.png

7.  Once the project is created you can also create project views thorough Project views tab, where in you can manually create new project IMG view.

    In the project view tab click on create and enter view name in the prompt and click on Manual selection in Project IMG

/wp-content/uploads/2015/07/7_744755.png

8.  Click on select tab to select Project IMG view manually and save.

/wp-content/uploads/2015/07/8_744756.png

9.    Generate Project IMG view and we can see only the defined nodes of the project in IMG view.

/wp-content/uploads/2015/07/9_744757.png

10. Add project team members through Proj. Team members tab.

/wp-content/uploads/2015/07/10_744761.png

11. Assign project & project IMG view to team members so that only these members will have access to view his project.

/wp-content/uploads/2015/07/11_744762.png

12. Once the Project IMG is created with the help of Technical team have created one table with fields Tcode and Project name as 

    below.

/wp-content/uploads/2015/07/12_744763.png

This means that anyone authorized to this TCode will have access to that project.

13. This Tcode will have access to my Project same as SPRO where I will give authorization of this Tcode to Consultant and he will have

      access to only this Project IMG as per the logic return backend on the table given above and will remove the Standard SPRO

      authorization so that he will not be able to view or access other SPRO nodes then his project.

14.  Now goto PFCG , enter the role name ,description required and save.

/wp-content/uploads/2015/07/13_744769.png

/wp-content/uploads/2015/07/14_744768.png

15. Click on Menu tab, and click on Utilities menu available in menu bar.Select Customizing auth, and click in add button and select

    option IMG project, and select the project you have created (or required one).

/wp-content/uploads/2015/07/15_744774.png

16. Now all the transactions in that project will be added (>=20000 generally). Click on Save button and goto Authorizations tab and

    manage the authorizations.

/wp-content/uploads/2015/07/16_744777.png

17. You can remove the unnecessary transactions from s_tcode like SPRO, SUO1, PFCG and so on object and generate project

18. Create a new role and keep adding TCodes as per to table to give access to different projects to consultant where he will have

    access to only the assigned project & IMG as below.

/wp-content/uploads/2015/07/17_744778.png

Hope it will he helpfull.

Thank you.

Deepak Sajjan

Assigned Tags

      8 Comments
      You must be Logged on to comment or reply to a post.
      Author's profile photo Former Member
      Former Member

      Thanks a lot Deepak,


      It is very useful document for me.


      Regards

      Fuad

      Author's profile photo Former Member
      Former Member

      Nice document....

      Thanks for the information

      Author's profile photo Former Member
      Former Member

      Hi,

      Really nice document:)

      One question: Could you be more specific about functionality of table in step 12 ?

      Author's profile photo Aasish Varghese
      Aasish Varghese

      Step 12 is not clear.  But tell Step# 11 are excellent.

      Author's profile photo Subir Mookherji
      Subir Mookherji

      Hi Deepak,

      How to change status for the project which we create.. and once the status is finished what will happen for the project.

      Author's profile photo Kumar Raju
      Kumar Raju

      I have done the above steps.. even then user was able to see other nodes as well. Step 12 is not clear. please explain

      Author's profile photo Jose Ricardo Saavedra Forero
      Jose Ricardo Saavedra Forero

      Same as comments already posted, Excellent explanation but in step 12 , Do not explain how

      Author's profile photo Edwin Rullan
      Edwin Rullan

      Given : One PRD / ONE QAS / ONE DEV

      Actors

      Implem team

      AMS  Team

      Will this solve the issue if we have a PILOT Project by the Implem team then Support/AMS will come in then ROLLOUT will be delivered by the implementation team. Will this segregate the config from both teams to manage which TR will come firmly for the same config objects?

       

      Kindly advise