In this blog, I will provide you with a quick guide on how to use the Mass Maintenance function included in the 'Maintain Business Roles - Fiori App' to apply the new Functional Area restriction introduced with the 2402 upgrade of SAP S/4HANA Cloud Public Edition.
First, I recommend that you take a few minutes to read this blog written by my colleague ulrich.hauke.
Now that you have the basics, let's follow the steps below:
1 – Go to the IAM Information System Fiori App
2 - Click on "Business Role - Restriction", add "Restricted" in the Access Restriction field, and add "Functional Area" in the Restriction field (it needs to be written as is; typing it all in lowercase will not work). Click "Go".
Next, click on the "Download Items" button to download a spreadsheet containing all business roles with a restricted functional area and no value. This format allows for easy manipulation.
3 – Download your spreadsheet. (Note: I am using Windows.)
4 – Please take a look at the spreadsheet file.
5 – I recommend editing the spreadsheet for ease of reading and filtering information. Please convert the text into columns and then apply the filters.
6 – Filter the spreadsheet using fields “Access Categories” and “Restriction Types” – I first selected “Read” as Access Category and “General” as Restriction Type.
Copy the Business Role ID so you can paste them into the "Maintain Business Roles - Fiori App". This will enable you to apply the restrictions to this combination: "Read" = Access Category & "General" = Restriction Type.
7 - Now, go to the "Maintain Business Roles - Fiori App" and select "Business Role ID". Change the function to "equal to" and then paste the values you have copied. Please ensure that you set "equal to" as the default value before pasting. If you fail to do this, you risk adding other Business Roles that are not intended to be changed.
8 – Select all Business Roles, then click on “Mass Change”
9 – In the "Mass Change" window, you need to select "Restrictions" as the Area, "Read, Value Help" as the Access Category, and "Change General Restriction Values" as the Restriction Change. Keep in mind that this is the exact combination you filtered in the spreadsheet.
10 – Click "Next Step". Then select "Functional Area" as the General Restriction Values and click on the pencil icon to edit the restriction value.
11- Select “Unrestricted Access”
Important Note - As a strategy for risk mitigation, we recommend setting all values to unrestricted access prior to the 2402 Upgrade to avoid disruption to your business users' authorizations. After the 2402 upgrade, you will then have ample time to apply the functional area restrictions according to your business needs.
12 - Click 'Review', then 'Submit'.
You now will see the “Unrestricted Access” applied to all the selected Business Roles.
You will need to run this process for as many combinations as you have between the Access Category and Restriction Type. In the previous example, we considered the combination where "Read" is the Access Category and "General" is the Restriction Type. Another example would be the combination of "Read" as the Access Category and "Enterprise Project" as the Restriction Type, and so on.
However, there is a minor alteration in the procedure for the last example where the Restriction Type is configured at the Enterprise Project Level. Therefore, you need to select "Change Restriction Values" in the mass maintenance window. Please refer to the screens below for a visual guide:
To filter the spreadsheet based on the last example combination, set "Read" as the Access Category and "Enterprise Project" as the Restriction Type.
Copy business roles to the "Maintain Business Roles" app as described above.
Select the Mass Change Wizard. However, as described above, instead of selecting "Change General Restriction Values," you should select "Change Restriction Values." This change will impact the "Enterprise Project," not the General Restriction.
Follow the same steps as described above in steps 10 to 12.
After you've completed the steps, proceed to your next combination. While the step-by-step guide may seem lengthy due to all the tasks that need to be accomplished, I anticipate that after your initial run-through, you'll be able to complete this activity quite quickly.
In addition to this blog, my colleague Thomas Schachner created two great videos:
a) How to maintain restriction field functional area using the mass change wizard
b) How to maintain restriction field functional area - single change
I recommend taking advantage of the Functional Area, as it will give you greater control over your authorizations moving forward.
More Information on SAP S/4HANA Cloud, Public Edition:
- SAP S/4HANA Cloud, public edition, release info here
- Product videos on our SAP S/4HANA Cloud, public Edition and SAP S/4HANA YouTube playlist
- SAP S/4HANA PSCC Digital Enablement Wheel here
- Early Release Webinar Series here
- Inside SAP S/4HANA Podcast here
- openSAP Microlearnings for SAP S/4HANA here
- Best practices for SAP S/4HANA Cloud, public edition, here
- SAP S/4HANA Cloud, public edition, Community: here
- Feature Scope Description here
- What’s New here
- Help Portal Product Page here
Follow us via @SAP and #S4HANA or follow @Marco_Valencia
- SAP Managed Tags:
2 Comments
