Working with SAP Analysis for Microsoft Excel Workbooks

Once a user has customized the query results by navigating and adding formatting elements, the user wants to save this workbook for future use. How can the user ensure that authorized users can easily access and execute the workbook?

This lesson covers one option, which is to save workbooks in roles. The authorization administrator has to set up security measures to control who can save workbooks in which roles, and who can access workbooks from which roles.

So far, in our course, we have used SAP Analysis for Microsoft Excel in the following ways:

1. Launching SAP Analysis for Microsoft Excel
2. Open Data Source
3. Connect to the SAP BW/4HANA system.
4. Select and execute a Data Source (query or query view)
5. Navigate in the displayed query result (for example, drill down and filter)

You can also use SAP Analysis for Microsoft Excel to create workbooks.

A SAP Analysis for Microsoft Excel workbook has the following features:

• The workbook can feature multiple queries and query views.
• Queries and query views within the workbook can have specific navigation states.
• The workbook allows for simultaneous refreshing of all queries and query views upon opening.
• Individual queries and query views can also be refreshed independently.
• Workbooks can be saved with or without data.
• Excel design elements such as charts and formatting can be incorporated into the workbook.

Instead of executing individual queries or query views, reporting users rather execute SAP Analysis for Microsoft Excel workbooks.

To grant authorizations for working with SAP Analysis for Microsoft Excel workbooks, the authorization object S_RS_AO is used.

(1) The authorization object S_RS_AO.

(2) The authorization object S_RS_AO has four fields: Analysis Client Technical Name, Analysis Client Object Type, Owner of a Reporting Component, and Activity.

In the authorization example shown here:

• (3) The user is allowed to Execute (16) SAP Analysis for Excel workbooks 00.
• (4) The workbooks must begin with U00_CC.
• (5) Any user can own the workbook. The owner is the creator of the workbook.

When saving an analysis workbook, which typically contains data generated from executed queries or query views, various security considerations come into play. These include the interactions between authorizations for S_RS_AO, authorizations for S_RS_COMP and S_RS_COMP1, and analysis authorizations assigned to the reporting user.

These authorizations must be cleanly aligned with each other.

As already pointed out, a workbook can consist of several queries and query views. To ensure users access data for specific queries and views according to their authorizations, set workbooks to refresh automatically upon opening. Saved data (snapshot data) from a previous execution will not be displayed.

Also, this security setting can be enhanced by saving a workbook without any data at all. These security settings can be found in the Design Panel under the Components tab:

• Refresh Workbook on Opening: Saved data is not displayed because all queries and query views are refreshed together immediately. The disadvantage is that the refresh can take a long time.
• Remove Data Before Saving: The workbook is saved empty (without data). This option can be combined with the option Refresh Workbook on Opening so that all queries and query views are refreshed together immediately, or can be refreshed individually.

Key users can save SAP Analysis for Microsoft Excel workbooks to roles, allowing other reporting users to conveniently access the relevant workbooks for task completion.

To save an SAP Analysis for Microsoft Excel workbook to an SAP BW/4HANA role, choose File → Analysis → Save Workbook on a Platform → Save a Workbook to the SAP Business Warehouse Platform.

Aside from authorization object S_RS_AO, authorization objects S_USER_AGR and S_USER_TCD are needed to save an Analysis workbook to a role.

S_USER_AGR (Authorizations: Role Check) defines the activities that can be executed for a role. S_USER_AGR comprises the following two fields:

• In the Activity field, at least one of the following values is required: 01 (Add or Create), 02 (Change), 03 (Display), and 06 (Delete).
• In the Role Name field, one or several specific roles created for the purpose of saving workbooks to them are required.

  Note that the user must be a member of all these specific roles.

S_USER_TCD (Transactions in Roles) defines the transactions that can be assigned to a role. Authorization object S_USER_TCD has only one field:

• In the Transaction Code field, the value RAAOE is required.

When an Analysis workbook is assigned to a role, the transaction code RAAOE is automatically added to the role menu for launching SAP Analysis for Microsoft Excel workbooks via SAP GUI.

On the one hand, the transaction RAAOE entry in the role menu requires the key user to possess the S_USER_TCD authorization object with the value RAAOE.

On the other hand, the reporting user launching an analysis workbook via SAP GUI requires the S_TCODE authorization object with the RAAOE value to be allowed to execute the RAAOE transaction. By the way, this authorization with the object S_TCODE and value RAAOE is automatically added to the profile generated by the profile generator.

The following are the prerequisites for a key user to save Analysis workbooks to roles:

1. Authorizations for the authorization object S_RS_AO
2. Authorizations for the authorization object S_USER_AGR
3. The key user must be a member of the specific role(s) so that they can be entered in authorization object S_USER_AGR.
4. Authorization for the authorization object S_USER_TCD to be allowed to assign the transaction RAAOE to the role menu.

The following are the prerequisites for a reporting user to launch Analysis workbooks:

1. Authorizations for the authorization object S_RS_AO
2. The user must be a member of the specific role(s) where the workbooks have been saved to, when the user wants to launch them from there.
3. Authorizations for the authorization object S_USER_AGR and S_USER_TCD are not needed.

If the reporting user launches the workbooks via SAP GUI, the user needs more authorizations:

1. Authorizations for the authorization object S_TCODE with the Transaction Code value RAAOE
2. Authorizations for the authorization object S_GUI with the Activity value 61
3. Authorizations for the authorization object S_RS_FOLD with the SUP_FOLDER value ' '
4. Authorizations for the authorization object S_RS_TOOLS with the COMMAND value WEBPUBLISH

To summarize, in the security implementation plan, identify who must save workbooks to roles, the roles needed, and how to organize and share workbook roles.