Controlling Data Access with Data Locking

Objective

After completing this lesson, you will be able to Configure and use data locking.

Configure Model-Based Data Locks

Why use data locking?

You can use data locking to ensure that the right people have write access at the right time:

Lock data entry to any combination of driving dimensions and specific dimension elements.
Changes in the lock status automatically propagate up or down the hierarchy (that is, locking a parent locks all descendants; locking all children automatically locks the parent).
Open and Locked states are complemented with a Restricted entry state, which limits entry only to the node owner or the owner of an ascendant node.

Data Locking Options

There are several options to consider when modeling a solution to control data access:

Data access profiles in security offer a static solution.
Data locking is a more dynamic/flexible solution.
Cell locking is story-specific.
Access to stories and models depends on which folder they are in as well as whether they are shared.

Implement Data Locking for a Model

Data locking lets you set up locks on specific data intersections of a model, which prevents the data changes via data entry and by other planning operations (such as allocations) in stories.

Data locking must be enabled in the model preferences, and you must have the proper permissions to configure data locking.

In a story, locked and restricted cells for public versions appear as read-only. Optionally, you can also delegate ownership of the data locks to members of a dimension. Data locking owners can change the state of the locks that they own.

1. Enable Data Locking

Go to Model Preferences of the planning model and click Access and Privacy. Activate Data Locking and set the Default Lock State. The default lock state can be either Open or Locked.

Data locking enabled in the model preferences settings.

2. Maintain the Organization Type Dimension

Data Locking Owner: This property is created in the organization dimension when data locking is enabled. The owner property requires either teams or users, or both.
Person Responsible: The person responsible property can be used to determine the owners. Users here can be inherited from the owner property.
Reviewer: This is not used in data locking (it can be used in an calendar Process).
Hierarchy: A hierarchy is needed so that statuses of parents can be inherited by children for example. Children inherit the locks of parents.

Data Locking Ownership enabled for the Entity (top) and the different columns that are explained above it.

3. Define Driving Dimensions

Version and Date are mandatory driving dimensions. The driving dimensions further define the specific intersection of data that will be locked.

For example, if you want to lock data for a specific member of an Organization dimension, you would need to include the Organization dimension as a driving dimension.

4. Select Data Region

Select the data region for the lock. For example, 2025, Southeast, Forecast version.

5. Set Locks

Select Show Grid to display a grid of the driving dimensions where you can set the lock state of each intersection:

Open: Values are unlocked for this combination of members in table, and can be changed by any users who have permissions to enter values for the model.
Restricted: Values can be changed only by a user who has effective ownership of locks on this combination of members. Select the restricted cell and select Add Owner under a driving dimension and choose one or more owners for the selected member of that driving dimension.
Locked: Values cannot be changed for this combination of members in a table.

When you change the state for a parent member in a dimension, the same state is applied to its children as well. For example, if you lock North America, then the United States and Canada will also be locked.

Configure the Data Lock Dimensions

In the example below, you select the Configure the Data Lock icon to start. Then, after choosing Entity as a new driving dimension, the Enable Ownership option is selected. This will prompt the system to look up owners from the entity dimension. In this example, the Organization Type dimension is Entity, however, it depends on the dimensionality of the model as to which dimension is the organization type. For example, in cost center planning, the Cost Center dimension would be the Organization Type dimension.

Data locking owners section highlighted in the Data Locking dialog.

Optimizing the Planning Area

Performance in planning models depends on queries and planning actions. These two factors can be optimized to reduce processing time when working with large public versions.

By optimizing the planning area, you keep the data size manageable and can work on data that’s relevant to you. You can think of the planning area as a version’s data used for all planning actions, that you can filter out and refine for a private version. Its size will vary depending on the model settings. Optimizing the planning area is especially useful when you’re trying to limit the data size of a model with a large public version.

You enable the planning area in the Model Preferences, under the Data and Performance tab. Click the toggle under the Optimize Recommended Planning Area section. Select whether you want to limit the planning area based on data locking, data access control and model privacy, or both. Note that for both options to be effective, data access control and data locking must be enabled and configured.

Model Preferences for Data and Performance

You can limit the size of the planning area either using data access control, data locking, or both. This corresponds to the recommended planning area that decreases the size of a private version size when you create it based on data access and data locking.

Data access restrictions give you access to the data for which you have write access.
Data locking restrictions give you access to the data regions that are unlocked. When you edit a public version, or create a private one, the application stores a reduced data snapshot but still shows locked data outside of that snapshot.

When working with a public version in a story, the planning area filters the data based on what data you've permission to edit. Only data that you've edit permissions for will be put into edit mode. When creating a private version, you have the option to copy the recommended planning area to the private version. Data actions and multi actions only affect data within your planning area.

Enable and Configure Data Locking in a Planning Model

Business Scenario

You've completed the forecast income statement and you need to block any changes to the data. To do this, you will implement data locking in your data model.

What skills will you develop in this practice exercise?

In this practice exercise, you will:

Access the Entity dimension in the model and configure the Person Responsible
Update the Access and Privacy settings to enable data locking
Configure the Data Locking for the model

ExerciseStart Exercise

Lock-Related Settings in Data Tables

When using data locking, there are two related settings in data tables in stories:

Data Disaggregation: The data disaggregation settings provide more control over how values are spread from parent members to leaf members. Enabling the following options will change how data disaggregation will occur and prevent disaggregation to those locked (by data locking) or invalid (due to relationship validation) leaf members that would otherwise normally receive values.
Input Enablement: Some restrictions automatically make cells appear as read-only in a table, while other restrictions allow you to edit the values in restricted cells but won’t allow you to publish changes to restricted members.

Model-Based Data Locks

Access Data Locks

In a story, you can set and view data locks by cell.

The statuses include:

Open: any user with the appropriate authorization can change the data.
Locked: no one can change the data.
Mixed State: a combination of open and locked statuses, for example, a parent will have a mixed state if one of its children has a different status.

Turn on the Data Lock Indicator

Turn the indicators on or off in a story by going to More Actions → Show/Hide → Data Locks from the story table.

Turn the indicators on or off in a story by going to More Actions then Show/Hide, and select Data Locks from the story table

Note

Data locking can be used with advanced filtering.

Scheduling Data Locks

Data locks can be scheduled in the SAP Analytics Cloud Calendar as long as:

There's a single owner.
There's no assignee support.
There's no parent process.

Owner Access

If a user is logged on as the owner, they can change Restricted data.

If a user is logged on as a non-owner:

Assuming they have the Planner Reporter role, they can’t change the data lock status.
They can set the cell to ignore data locks and change the data but they can't publish it.

In order to use data locking, non-owners require a role that includes Read access to the Data Locking activity (in a role).

Additional Information

Visit SAP Help for more information on Permissions

Use Data Locking

Task 1: View Data Locking as the Lock Owner

Business Scenario

You have a model that requires input from a colleague. You only want them to be able to edit certain cells, so you configured your data locking in the model. Because the model and story are not in a public folder, they are shared with your colleague.