‘0910572022 13:22 Business Partner Authorization Tips and Ticks | SAP Blogs r askaQl Vy Like nswers Blogs Events. Programs Resources. Wh k 3) RSS Feed Technical Articles Dorin Marmeliuc October 16,2020 | Sminute read Business Partner Authorization Tips and Tricks 31 @ 14,192 Hello again! In the spirit of helping customers in their move to SAP S/4HANA and to Business Partner | have often found myself being asked many questions in regards to the authorization part of the Business Partner and how to tackle it. Based on that I compiled a short guide on how to approach these questions of the Business Partner and some useful scenarios. ' Kindly seek the help and guidance of your security consultant when creating and generating new roles as if this activity is not done and tested correctly it can have grave consequences.! First let's start with the Roles, but before we do that, | would like to point out that what print-screens will be shown below will be of Template Roles and Standard SAP htpssblogssap.com202011016/op-authorizationtps-andricks! na‘0910572022 13:22 Business Partner Authorization Tips and Ticks | SAP Blogs fields. Please extrapolate to your own unique scenarios. Follow 1 Got to transaction PFCG 2.Go on the Role field and press F4 3.On the “Roles” tab type in *Business* w Like 3) RSS Feed DEO Ol stores ae (DB Seaee [ES Gown) (Pe) (2) She bn er png anes oe ne (Sig (BS) (aan) 4, Select a role like “SAP_CA_BP_DISPLAY_FS" and now click on Display 5. Go to the “Authorizations” tab and click on Display Authorization Data htpssblogssap.com202011016/op-authorizationtps-andricks! anavarnsi2022 13:22 Business Partner Authorization Tip and Ticks | SAP Blogs 6. From here we can see Object class and all the Authorization Objects we need 3) RSS Feed From a logic perspective the role we are on if attributed to a user would only allow the user to have a display only role when accessing the BP transaction and that is based on a multitude of objects that have the value of Display: Group/Obyect/Authoreatn/ Feld Mantenanc.. A, Vale BS Oye Cans AAA Fania “EB Asthorestin Obj 6 BUPA ATT Changed -Autoreeton T_$342006101 Changed “2 WAcTvT Changed ir Day “B AMTHTYe Staniad +B Anwaa Standard +1 awa Standard CAE puoreaion Object 8_BUPAFOG Chenged {CAD huthorztin T_S342006104 Changed *B Aros Stoniad Bact _ Changed _ rena CE Ateraaton Obje 6 BPA GRE Changed TSP tuthoezton T_SH2006101 Changed “2 Wactvr Chenged ir Desay + Accu - Stondad (O° rboreaton Objec: 8 BUPA RUT Changed ‘CAP futhoreatin T 542006100 Changed B @acir Changed YP Dssey Ane Standard + M839 authorzaton Object &_BUPA SW Standard » BOS authrzaton Obj 8 BUPRLEZT Changed C82 utoreaton Obiec BAUER. FOG Cranoed C2 utzon Objec: CCAR Changed + nS authozatin Objecr 5 TCOOE anual For details on each individual object please deep dive in the link below: https://help.sap.com/viewer/864321b9b3dd487d94c7016a007b0397/7.31.25/en- US/08e4420047f14f518c84dcf768b9c141 htm! htpssblogssap.com202011016/op-authorizationtps-andricks! ana‘0910572022 13:22 Follow Business Partner Authorization Tips and Ticks | SAP Blogs w Like ight now we covered the foundation upon which we will build our roles for our 3) RSS Feed inique situations and for that | made up some likely scenarios below: 1. [want to have separate roles for my Customer Team and my Vendor team In order to achieve this functionality we will use our template role above and create 6 additional roles: 3 for the Customer Team(admin,change and display) and 3 for Vendor Team (admin.change and display). ‘Once we have the roles created we can go in the authorization object B_BUPA_RLT make them custom: Customer Display: We are adjusting the BP Role to only include the 000000, FLCUO1 and FLCUOO with the activity of Display ole 2 S9P cA BP DSA FS ae. Carte es Yep kes (en Prneh rae Ben fme fakes a Customer Create/Change We are adjusting the BP Role to only include the 000000, FLCUO1 and FLCUOO with the activity of either Change or Create depending on the Role. htpssblogssap.com202011016/op-authorizationtps-andricks! ana‘0910572022 13:22 Business Partner Authorization Tips and Ticks | SAP Blogs w Like 3) RSS Feed ‘The same process is applied for the Vendor Team, but instead of FLCUO1 and FLCUOO we will have FLVNO1 and FLVNOO and of course different activity types based on each specific role. own g anes res ae Cont 2 Oy ier Meret [2p one, nan tome 2. Besides the roles for each team | need certain fields to behave differently depending on who is viewing it For this activity we will be using help of the Authorization Object 8_BUPA_FDG and a customizing activity under the SPRO->Cross Application Component->SAP Business Partner->Business Partner->Basic Settings-> Authorization Management- >Define Field Groups Relevant to Authorizations htpssblogssap.com202011016/op-authorizationtps-andricks! ena‘0910572022 13:22 Business Partner Authorization Tips and Ticks | SAP Blogs - SAP Busnes Partner + [es && Activation Switch for Functions Follow 2 Business Partner + Basic Settings , Bushess Partner Rakes 7 + LS Notes 6 Like . Number Ranges and Groupings , Business Partner Types + [es Field Groupngs 3) RSS Feed + [23 Screen Configuration ~ Authorizaton Management + [25 @ Maintain Authorizaton Grouss + [25 @ Maintan Authorzaton Types + [25 @ Define Field Groups Relevant to Authorizations) + [By © Generate and Assign Authorizations For the exercise at hand | have defined field group 9 which is Bank Details, as | want this field to be visible only for the Create and Change roles I created above, and hidden for the Display role. | Change View “Field Groups for Authorization”: Overview Sp New Enis (3 5S 9 [EL Ue (GRicmanea Bark Dealt ‘As we did the customizing, lets now adjust the role of Customer Display, under the B_BUPA_FDG object with the following setting: a a oof Seite Poramed Boe, omc Feaee enews Set oom ior The setting basically exclude field group 9(Bank Details) from the list of fields available to be displayed while having this Customer Display role on your user. htpssblogssap.com202011016/op-authorizationtps-andricks! ena‘0910572022 13:22 Business Partner Authorization Tips and Ticks | SAP Blogs Follow 3.| have specific Business Partner/Account Group that | do not want certain 1 Like employees to touch, as | have a specific team which handles that specific account group 3) RSS Feed This scenario is even trickier as it involves customizing, master data and authorization change. Let's first start with the customizing for which we will go to SPRO->Cross Application Component->SAP Business Partner->Business Partner->Basic Settings- > Authorization Management->Maintain Authorization Groups > SAP Busness Partner + [Es @ Activation Swech for Functions Business Parmer = Basie Settings Business Partner Rakes Notes Number Ranges and Groupes Business Partner Types Feld Groupings Screen Confguraton ‘threat Managen + [ee & Mantan Authorization Types + [és ® Detne Ftd Groups Relevant to Authorizations + [BS & Generate and Assign Authorzatons D pa Now we are going to create an Authorization Group like “TEST” as seen below and we will save our work. htpssblogssap.com202011016/op-authorizationtps-andricks! ma‘0910572022 13:22 Follow Business Partner Authorization Tips and Ticks | SAP Blogs op Eo me Ge Group object [pupa w Like 3) RSS Feed Now we move to the master data part in which we choose our “specific” Business Partner we perform a change on field AUGRP which is on the Control Tab of the Business Partner under the Control Parameters view with the “TEST” value: Dey nf (onto Bsns Paro (Gen) Praga Name [saceves crates sen) sus [renzew_so00_a retinas me canes Tater prod Ome pecarengeate | Tate ago “rrp Tobe me Meath | rate poo me aaa Hous ta Earnest | ym net 4 © ee eet rat ssn fo sath pt (De Nae of Bes Pr. © me onto adn ns 0m Gee Monpemert Dra Fld [sevoco-aucnp Pram hae (arcane zonoe = [a000) htpssblogssap.com202011016/op-authorizationtps-andricks! ana‘0910572022 13:22 Follow Business Partner Authorization Tips and Ticks | SAP Blogs w Like this exercise we will change just one BP but for an entire Account Group you can |se the MASS transaction to change multiple BPs with the field in question. 3) RSS Feed Display in BP role (000000 Business Partner (Gen.) | Sl] Control Parameters 8? Type i Athoretion Guy [FEST] Test Authreaton Group Pre Format qo The last piece of the puzzle is to change the authorization on our Role, on the B_BUPA_GRP object: (owns abe oo an (Games Or fo “ rs ‘ov ue After owns g sts for etn os ioomns ‘Sarasa heen Gee foward ay oer ares [Pores ese ‘Roenen Ge With the change above it means that the user with the Display Role will only be able to see Business Partners that do not have the TEST Authorization Group. htpssblogssap.com202011016/op-authorizationtps-andricks! ona‘0910572022 13:22 Follow Business Partner Authorization Tips and Ticks | SAP Blogs w Like 4. If you also want to limit the FA search help when searching for a specific Business Partner please read and implement the note https://launchpad.support.sap.com/#/notes/2441447 3) RSS Feed Please take the above as just an example of what can be done. Of course certain situations and scenarios may see a combination of different aspects, but with the above information as a baseline | am sure you will be able to achieve it and combine field, authorization groups and roles to best suit your needs. Another important activity when tackling roles and authorization is to test one specific activity under 1 user. That means you work your way up from scenario number 1 to 3 and beyond, testing and validating each part of the process. Do not start customizing a role with multiple authorization on it as you may find yourself spending days on a activity that can be accomplished in minutes, as roles can overwrite each other and you will be back to square 1? Hope you liked the ideas plus the tips and tricks above, As usual thank you and see you later. rt Moderator htpssblogssap.com202011016/op-authorizationtps-andricks! son‘0910572022 13:22 Business Partner Authorization Tips and Ticks | SAP Blogs Assigned Tags SAP S/4HANA [01l0W Security; #BP RSS Feed #Employ » H#S/4HANA w Like #S/4HANA Movement Viewmore...) si ilar Blog Posts a Power Week Atlanta - SAP Partners Build Extensions for SuccessFactors, S/4HANA, and Business ByDesign By Quintus Smith Oct 20, 2017 Tips and Tricks on Field Modifications in Transaction BP, CVI in S/4HANA By Dorin Marmeliue Jun 17, 2020 SAP Fiori for SAP S/4HANA ~ Troubleshooting Tips and Tricks in $/4HANA On-Premise By Jorge Baltazar Nov 27, 2017 Related Questions Vv Vendor number(KNAI-LIFNR) & Customer number(LFAI-KUNNR) is showing grey out - BP- S4 By Abhinav sap Sep 02, 2019 ‘S/4HANA Business partner approach: which roles for Ship-To? By Patrick Fichtner May 1, 2017 Contact Person By Former Member Nov 08, 2016 Join the Conversation VY htpssblogssap.com202011016/op-authorizationtps-andricks! nna(0910572022 13:22 Business Partner Authorization Tips and Ticks | SAP Blogs SAP TechEd Tune'ig|foritech talk. Stay for inspiration. Upskill your future SAP = © —SAPBTPLeamning Broup RR 27 sR ll nology Platform Learning Journeys, ~ = _Join-th Corner Discussion Group. 3 Comments You must be Logged on to comment or reply to a post. Sunil Gopala Krishnan June 23,2021 at 2:39 pm Hello Sir, Thank you very much for giving all the details. Like1 | Share Moataz ABU KARAT ‘August 31, 2021 at 11:27 am Just stumbled across this, great detail and easy to follow. Very helpful article, thanks for sharing Dorin! Like1 | Share Cristiano Procacei htpssblogssap.com202011016/op-authorizationtps-andricks! ana‘0910572022 13:22 Business Partner Authorization Tips and Ticks | SAP Blogs 3 November 16, 2021 at 9:44 pm Greetings, | would need more detailed information, | should be able not to display any support teams no longer used on ITSM but without deleting anything at the level of BP etc etc it can be done? TKS Like © | Share Find us on Privacy Terms of Use Legal Disclosure Copyright Trademark Preferéncias de Cookies Newsletter Support htpssblogssap.com202011016/op-authorizationtps-andricks! sana