Business Partner Authorization Tips and Tricks

[d_marmeliuc]

Hello again!

 

In the spirit of helping customers in their move to SAP S/4HANA and to Business Partner I have often found myself being asked many questions in regards to the authorization part of the Business Partner and how to tackle it.

 

Based on that I compiled a short guide on how to approach these questions of the Business Partner and some useful scenarios.

 

! Kindly seek the help and guidance of your security consultant when creating and generating new roles as if this activity is not done and tested correctly it can have grave consequences.!

 

First let’s start with the Roles, but before we do that, I would like to point out that what print-screens will be shown below will be of Template Roles and Standard SAP fields.  Please extrapolate to your own unique scenarios.

 

1. Got to transaction PFCG


2. Go on the Role field and press F4


3. On the “Roles” tab type in *Business*

 

 

4. Select a role like “SAP_CA_BP_DISPLAY_FS” and now click on Display

 

 

 

5. Go to the “Authorizations” tab and click on Display Authorization Data


6. From here we can see Object class and all the Authorization Objects we need

 

 

From a logic perspective the role we are on if attributed to a user would only allow the user to have a display only role when accessing the BP transaction and that is based on a multitude of objects that have the value of Display:

 

 

For details on each individual object please deep dive in the link below:

https://help.sap.com/viewer/864321b9b3dd487d94c70f6a007b0397/7.31.25/en-US/08e44ae047ff4f518c84dcf76...

 

 

 

Right now we covered the foundation upon which we will build our roles for our unique situations and for that I made up some likely scenarios below:

 

1. I want to have separate roles for my Customer Team and my Vendor team

 

 

In order to achieve this functionality we will use our template role above and create 6 additional roles: 3 for the Customer Team(admin,change and display) and 3 for Vendor Team (admin,change and display).

Once we have the roles created we can go in the authorization object B_BUPA_RLT make them custom:

 

Customer Display:

We are adjusting the BP Role to only include the 000000, FLCU01 and FLCU00 with the activity of Display

 

 

Customer Create/Change

We are adjusting the BP Role to only include the 000000, FLCU01 and FLCU00 with the activity of either Change or Create depending on the Role.

 

 

 

The same process is applied for the Vendor Team, but instead of FLCU01 and FLCU00 we will have FLVN01 and FLVN00 and of course different activity types based on each specific role.

 

 

 

 

2. Besides the roles for each team I need certain fields to behave differently depending on who is viewing it

 

For this activity we will be using help of the Authorization Object B_BUPA_FDG and a customizing activity under the SPRO->Cross Application Component->SAP Business Partner->Business Partner->Basic Settings->Authorization Management->Define Field Groups Relevant to Authorizations

 

 

 

For the exercise at hand I have defined field group 9 which is Bank Details, as I want this field to be visible only for the Create and Change roles I created above, and hidden for the Display role.

 

As we did the customizing, lets now adjust the role of Customer Display, under the B_BUPA_FDG object with the following setting:

 

 

The setting basically exclude field group 9(Bank Details) from the list of fields available to be displayed while having this Customer Display role on your user.

 

 

3. I have specific Business Partner/Account Group that I do not want certain employees to touch, as I have a specific team which handles that specific account group

 

This scenario is even trickier as it involves customizing, master data and authorization change.

 

Let’s first start with the customizing for which we will go to SPRO->Cross Application Component->SAP Business Partner->Business Partner->Basic Settings->Authorization Management->Maintain Authorization Groups

 

 

Now we are going to create an Authorization Group like “TEST” as seen below and we will save our work.

 

 

 

 

 

Now we move to the master data part in which we choose our “specific” Business Partner we perform a change on field AUGRP which is on the Control Tab of the Business Partner under the Control Parameters view with the “TEST” value:

 

 

 

 

For this exercise we will change just one BP but for an entire Account Group you can use the MASS transaction to change multiple BPs with the field in question.

 

 

 

The last piece of the puzzle is to change the authorization on our Role, on the B_BUPA_GRP object:

 

Before:

 

After

 

With the change above it means that the user with the Display Role will only be able to see Business Partners that do not have the TEST Authorization Group.

 

 

4. If you also want to limit the F4 search help when searching for a specific Business Partner please read and implement the note: https://launchpad.support.sap.com/#/notes/2441447

 

Please take the above as just an example of what can be done. Of course certain situations and scenarios may see a combination of different aspects, but with the above information as a baseline I am sure you will be able to achieve it and combine field, authorization groups and roles to best suit your needs.

 

Another important activity when tackling roles and authorization is to test one specific activity under 1 user. That means you work your way up from scenario number 1 to 3 and beyond, testing and validating each part of the process.

Do not start customizing a role with multiple authorization on it as you may find yourself spending days on a activity that can be accomplished in minutes, as roles can overwrite each other and you will be back to square 1 ?

 

Hope you liked the ideas plus the tips and tricks above.

 

As usual thank you and see you later.