Effective data access management is pivotal in ensuring operational efficiency and security within SAP environments. Addressing this crucial aspect can significantly enhance the accuracy and reliability of business processes, empowering professionals to make more informed decisions.
Managing Data Access
Objective
After completing this lesson, you will be able to manage data access in SAP Responsible Design and Production.
Introduction
Data Access Management
In SAP Responsible Design and Production, you can control user access to company codes and sales organizations. Data access can be configured in the Manage Data Access application.
The Manage Data Access application provides a Company Code filter that allows you to filter by access rights to one or more companies, as well as by full access to all companies.
To filter by access to all companies, use the wildcard * in the filter. The same option is available for the Sales Organization filter, which allows you to filter by full access to all sales organizations.
To grant access, go to the Manage Data Access application, and choose Grant Access. You can select one or multiple users. Then, choose from the following data access types:
Grant Data Access
| Name | Description |
|---|---|
| Unlimited Access | This data access type provides access to all companies and all sales organizations, including those that will be replicated in the future. In the Configure Reports application, the user is able to create report configurations with all company codes and sales organizations. |
| Limited by Company Code | This data access type provides access to selected companies and all sales organizations that belong to these companies, including all sales organizations of the selected companies that will be replicated in the future. In the Configure Reports application, the user is able to create report configurations only with the selected companies and the sales organizations that belong to these companies. |
| Limited by Sales Organization | This data access type provides access only to selected sales organizations. In the Configure Reports application, the user can create report configurations only with the selected sales organizations. |
Note
Once you save your choices, they will be visible in the Data Access table, where you can view all access permissions that have been granted to individual users.
On this overview page, you can grant access rights, but you cannot remove them.
To remove access rights, you must go to the object page of a specific user where their authorizations and assigned report configurations are displayed.
Access Authorizations
To edit data access for an individual user:
- Search for the user in the table view.
- Navigate to the detail page of the selected user.
On the object page, you can view the access rights granted to this user and a list of the report configurations to which this user is assigned.
Only report configurations in an active and historic status are displayed.
- To add or remove access rights, choose Edit.
To add access rights to the user, choose Add.
Only choose this option when you want to extend access rights.
When you save your changes, the system merges the permissions as follows:
- The Unlimited Access type replaces all existing authorizations.
- The Limited by Company Code access type replaces any authorizations to specific sales organizations that are part of the selected company.
Note
If you want to reduce the access rights, you first must remove the previously granted broader access.The system then checks if the user is assigned to any report configurations that contain the company code or sales organization you want to remove access rights from.
The removal of access rights is validated only with report configurations assigned to the user that are in an active or historic status. If there are such report configurations, an error message with details about the impacted report configurations is displayed.
You can resolve the issue by either removing the user from the assignees in the report configuration or by adjusting the access rights based on filters of the report configuration.
The details page in the Assigned Report Configurations section allows you to navigate to the assigned report configuration in the Configure Reports application.
Use Cases
Use Case 1
A user has already been granted unlimited access and any other access type is added:
In this case, the user's access authorizations will remain unlimited.
For example, if a user has already been granted the Limited by Company Code access type, the Limited by Sales Organization access type, or both, and an Unlimited access type is added, their status will be unlimited.
Use Case 2
A user has already been granted the Limited by Company Code access type (for example, the company code is A):
If the Limited by Sales Organization access type is added (for example, sales organization A1) and this sales organization is associated with the already granted company code, the user will have the following access right:
Limited by Company Code: The company code is A, and the user has access to all sales organizations that belong to this company code.
If the Limited by Sales Organization access type is added (for example, sales organization B1), and this sales organization is not associated with the already granted company code, the user will have the following access rights:
- Limited by Company Code: The company code is A, and the user has access to all sales organizations that belong to this company code.
- Limited by Sales Organization: The company code is B and the sales organization is B1.
Use Case 3
A user has already been granted the Limited by Sales Organization access type (for example, the sales organization is A1).
If the Limited by Company Code access type is added (for example, company code A), and this company code is associated with the already granted sales organization, the user will have the following access right:
Limited by Company Code: The company code is A, and the user has access to all sales organizations that belong to this company code.
- If the Limited by Company Code access type is added (for example, company code B), and this company code is not associated with the already granted sales organization, the user will have the following access rights:
- Limited by Company Code: The company code is B and the user has access to all sales organizations that belong to this company code.
- Limited by Sales Organization: The company code is A and the sales organization is A1.
Use Case 4
A user has already been granted the Limited by Company Code access type (for example, the sales organization is A) and the Limited by Sales Organization access type (for example, A1) that belongs to the granted company code:
If the Limited by Company Code access type is added (for example, company code B), the user has the following access rights:
- Limited by Company Code: The company code is A, and the user has access to all sales organizations that belong to this company code.
- Limited by Company Code: The company code is B, and the user has access to all sales organizations that belong to this company code.
Summary
Control user access to company codes and sales organizations in SAP Responsible Design and Production.
In the Manage Data Access application, grant one of the following access types:
- Unlimited
- Limited by Company Code
- Limited by Sales Organization
Edit access rights via the user’s detail page, merging new permissions with existing ones.
Validate the removal of access rights against active and historical report configurations.
Navigate to assigned report configurations to resolve access issues and adjust permissions as needed.