Adding to my previous question, so when we use cloud, we do security administration using Business role in Fiori Apps library but when its just on-premise and fiori, we do administration using SAP GUI..
Hi pascal, I see that you have completely done this role configuration from fiori but this authorization assignment could be easily done via sap gui rite. Please correct me if I am wrong. Is it that while integrating with cloud we should follow this process ??
Hi sumithra. In this particular, I was using an SAP S/4HANA Cloud (Essentials - fka, Multi-Tenant), which can only be accessed via a web browser, hence the Fiori Launchpad. If you are looking at SAP S/4HANA Extended or Private Cloud Edition, then yes, the access is via GUI.
Excellent video. What would have made this even more useful is if (1) you would have explained what is a good way to export all this info (incl restriction details) in order to perform an effective access review (2) what does the SoD check button do that is shown there and (3) are there any tools available (similar to GRC, CSI) that help with reviewing the appropriateness of access rights more automatically.
Hi Suman. Thanks for the comment. If you mean can you restrict a user to access ALL the data in the system based on a region or country, the answer is no. You have to remember that the authorisations are determined by authorisation objects that are directly dependent on the objects for which you are trying to set a restriction. For example, it would not make sense to use the Purchase Organisation to restrict in what Plant you can create a production order ! So, it could be that in some cases a region or country code can be used for authorisation but that will not be the case for all authorisations. Hope this helps.
Dear Pascal, Wonderful video for the beginners:) Thanks a lot for sharing this video. We have nearly 50 master business roles to be created in S/4 HANA Cloud and derived roles are expecting to be nearly 1000+ roles ( 50*21 = 1050). We are facing challenges in creating all these 1000+ derived roles manually in the system as it is time-consuming and involves the manual creation of roles. I have already gone through the blog Mass Maintenance of Business Roles in SAP S/4HANA Cloud, but again this suggestion also leads to creating more number of files as the same as the number of derived roles. Does anyone come across this situation? Do we have any provision to automate or doing mass derived roles creation in the S/4 HANA cloud system? Thanks Sindhu
Thanks for the good video. Is the same business role viewable through PFCG. If the business role is the same as PFCG role, then i think if the role has been restricted at auth. object level, but not at level of restrictions, then the role will follow according to auth. object level. Am i right.
Check the IAM Information System app for what is setup specifically in your system, or check the Fiori Apps library (list view - which tells you the standard catalog to role relationship for an app)
