Identity and Access Management

Access to business applications is controlled by role-based authorization management. You assign Business Roles to Business Users, and the roles provide access to business tasks. Business Users are defined as employees, contractors, or other individuals that need access to the SAP S/4HANA Cloud system.
A Business Role is assigned to a Business User to grant permission to access applications in SAP S/4HANA Cloud. One or more Business Catalogs have been assigned to a Business Role. Business Catalogs include access to one or more applications, dashboards, or displays of data. Administrators can control visibility to the data granted through the catalog by applying General Restrictions to Business Catalogs. By maintaining access restrictions, you can define the subset of all existing business objects a user can view (read) or edit (write) when working with a particular business role.
The Business Catalog defines which access categories are available (Value Help, Read, Write), and for which fields restriction values can be maintained. The fields vary per catalog, as they are based on the fields within the apps in the catalog. The Business Role aggregates restrictions for all Business Catalogs.
Administrators define a restriction based on a supported field (e.g. company code, country, controlling area, etc.). Supported restriction fields vary per Business Catalog, as they are based on the fields within the apps in the catalog. You can restrict data access for the Value Help, Read, and Write separately. Read access always includes Value Help access, and Write access always includes Read access.