Controlling Data Access with Data Locking

You can use data locking to ensure that the right people have write access at the right time:

• Lock data entry to any combination of driving dimensions and specific dimension elements.
• Changes in the lock status automatically propagate up or down the hierarchy (that is, locking a parent locks all descendants; locking all children automatically locks the parent).
• Open and Locked states are complemented with a Restricted entry state which limits entry only to the node owner or the owner of an ascendant node.

There are several options to consider when modeling a solution to control data access:

• Data access profiles in security offer a static solution.
• Data locking is a more dynamic/flexible solution.
• Cell locking is story specific.
• Access to stories and models depends on which folder they are in as well as whether they are shared.

Data locking lets you set up locks on specific data intersections of a model, which prevents the data changes via data entry and by other planning operations (such as allocations) in stories.

Data locking must be enabled in the model preferences, and you must have the proper permissions to configure data locking.

In a story, locked and restricted cells for public versions appear as read-only. Optionally, you can also delegate ownership of the data locks to members of a dimension. Data locking owners can change the state of the locks that they own.

Go to Model Preferences of the planning model and click Access and Privacy. Activate Data Locking and set the Default Lock State. The default lock state can be either Open or Locked.

• A hierarchy is needed so that statuses of parents can be inherited by children for example.
• The owner property requires either teams or users, or both.
• The person responsible property can be used to determine the owners.

• Data Locking Owner: This property is created in the organization dimension when data locking is enabled.
• Reviewer: This is not used in data locking (it can be used in an calendar Process).
• Hierarchy: Children inherit the locks of parents.
• Person Responsible: Users here can be inherited from the owner property.

Version and Date are mandatory driving dimensions. The driving dimensions further define the specific intersection of data that will be locked.

For example, if you want to lock data for a specific member of an Organization dimension, you would need to include the Organization dimension as a driving dimension.

Select the data region for the lock. For example, 2025, Southeast, Forecast version.

Select Show Grid to display a grid of the driving dimensions where you can set the lock state of each intersection:

• Open: Values are unlocked for this combination of members in table, and can be changed by any users who have permissions to enter values for the model.
• Restricted: Values can be changed only by a user who has effective ownership of locks on this combination of members. Select the restricted cell and select Add Owner under a driving dimension and choose one or more owners for the selected member of that driving dimension.
• Locked: Values cannot be changed for this combination of members in a table.

When you change the state for a parent member in a dimension, the same state is applied to its children as well. For example, if you lock North America, then the United States and Canada will also be locked.

In the example below, you select the Configure the Data Lock icon to start. Then, after choosing Entity as a new driving dimension, the Enable Ownership option is selected. This will prompt the system to look up owners from the entity dimension. In this example, the Organization Type dimension is Entity, however, it depends on the dimensionality of the model as to which dimension is the organization type. For example, in cost center planning, the Cost Center dimension would be the Organization Type dimension.

• Data Locking Owner: Can contain one or more teams and users.
• Person Responsible: Can contain only one user.
• Review: A custom property and can contain only one user.

In a story, you can set and view data locks by cell.

The statuses include:

• Open: any user with the appropriate authorizations can change the data.
• Locked: no one can change the data.
• Mixed State: a combination of open and locked statuses, for example, a parent will have a mixed state if one of its children has a different status.

Turn the indicators on or off in a story by going to More Actions → Show/Hide → Data Locks from the story table.

Note

Data locking can be used with advanced filtering.

Data locks can be scheduled in the SAP Analytics Cloud Calendar as long as:

• There's a single owner.
• There's no assignee support.
• There's no parent process.

If a user is logged on as the owner, they can change Restricted data.

If a user is logged on as a non-owner:

• Assuming they have the Planner Reporter role, they cannot change the data lock status.
• They can set the cell to ignore data locks and change the data but they cannot publish it.

In order to use data locking, non-owners require a role that includes Read access to the Data Locking activity (in a role).

Visit SAP Help for more information on Permissions