Set Up Data Locking
Use data locking in SAP Analytics Cloud to prevent changes to specific data at different stages of the planning process. As a planning modeler, you can set up data locking and specify areas of model data to lock, restrict, and unlock, and you can also delegate ownership of data locks to other planners.
Configuring Data Locking
Use data locking in SAP Analytics Cloud to prevent changes to specific data at different stages of the planning process. As a planning modeler, you can set up data locking and specify areas of model data to lock, restrict, and unlock, and you can also delegate ownership of data locks to other planners.
Prerequisites
-
Data Locking must be enabled in the model preferences before you can start configuring it. For details, see Set Up Model Preferences.
- You must have the appropriate permissions to work with data locking. See Data Locking Permissions for details.
Context
When to Use Data Locking
There are several ways to secure data in your model. Use data locking on model data that needs to be unlocked at certain stages of the planning process and then locked again, and when you want to delegate data security to other users who aren’t admins. For an overview of other data security features like validation rules and data access control, see Learn About Data Security in Your Model.
If you're looking for information about value locks, see About Value Lock Management instead. This is a separate feature that lets users control how data entry in a table is disaggregated.
How Data Locking Works
You configure data locks in a grid layout, by choosing driving dimensions and setting combinations of their members as locked, open, or restricted.
In a story or analytic application, locked and restricted cells for public versions appear as read-only, and cannot be changed by data entry or other planning operations. (You can plan on these cells by selecting Ignore Data Locks () from the table context menu, but data locks will still be enforced when you publish the version.)
Delegating Ownership of Data Locks
-
They can make changes to restricted data.
-
They can set locks to a more restrictive state, for example, Open to Restricted, or Restricted to Locked.
-
For members that are children or descendants of the member that they own, they become data locking managers. They can open restricted or locked data that they manage. For example, as the data locking owner for Footwear in EMEA, you become the data locking manager for Sneakers in Germany. You can't change the overall value for Footwear in EMEA once it's locked, but you can unlock different products and countries to change the distribution of that value.
Users with the appropriate permissions can also change the state of data locks from a story or analytic application. To do so, right-click the table or select (More Actions), then choose Manage Data Locks... ( ).
For example, if your organization is carrying out a forecast across different regions for 2018 Q4, this feature lets you lock all the model data for regular users, and grant permission only to regional managers to update their own region’s data for the Forecast version in 2018 Q4. For a detailed workflow based on this example, see Example: Applying Data Locks to a Regional Forecast.
Scheduling Data Locks
If you're using data locking frequently in your planning processes, you can create manual data locking task in the calendar to establish a schedule and coordinate with data locking owners. You can also schedule data locking tasks that lock the data automatically at a certain time. See Schedule Data Locks in the Calendar for details.
Data Locking Permissions
A few different permissions are required to set up and work with data locking. In general, users with the Planning Modeler or Planning Admin role will configure data locking, and users with the Planner Reporter role may be able to change the state of data locks.
The following table shows the permissions for data locking, the roles that include them, and the required license types. For background information, see Permissions.
Permission | Description | Standard roles | License requirement |
---|---|---|---|
Create | Lets you turn on data locking for a model. | Admin, Modeler | SAP Analytics Cloud for planning, professional edition |
Update | Lets you set up data locking for a model, including turning it off. | Admin, Modeler | SAP Analytics Cloud for planning, professional edition |
Delete | Lets you turn off data locking for a model. | Admin, Modeler | SAP Analytics Cloud for planning, professional edition |
Maintain | Lets you change the state of data locks. | Admin, Modeler, Planner Reporter | SAP Analytics Cloud for planning, professional edition or standard edition |
Read | Lets you see the data locks in a table. | Admin, Modeler, Planner Reporter, Viewer | SAP Analytics Cloud for planning, professional edition or standard edition |
Data locking tasks can also require permissions for the specific model and dimensions involved:
Data Locking Permission | Model Permission | Dimension Permission | |||||||
---|---|---|---|---|---|---|---|---|---|
Task | Create | Read | Update | Delete | Maintain | Read | Update | Read | Update |
Turn data locking on | X | X | X | X | |||||
Turn data locking off | X | X | X | X | |||||
Change the default lock state | X | X | X | X | |||||
Change the driving dimensions | X | X | X | X | |||||
Turn ownership on or off for a dimension | X | X | X | X | |||||
Change responsible users for a dimension | X | X | X | X | |||||
Change owners from the data locking dialog | X | X | X | X | |||||
Change any lock state | X | X | X | X | X | ||||
Change locks that you own or manage | X | X | X | X | |||||
View locks | X | X | X |
Exceptions and Limitations
Check the following points to make sure that data locking works for your use case:
-
Power users: Data locks do not apply to users with the admin role, or the user who created the model. These users can import data, delete data, and publish their changes to public versions, even if it affects locked data.
-
Models with measures: When measures are added as a driving dimension, a data lock on one measure will impact data management in the modeler for all other measure values that belong to the same set of dimension members. This issue affects importing and deleting fact data in the modeler. For details about this behavior in models with measures, see Treatment of Measures from the Same Set of Dimension Members.
-
Advanced filters: If you need to use data locking on tables with advanced filters, check Data Locking with Advanced Filters to make sure your filter is compatible.
-
Restricted measures and accounts: Data locks cannot be directly set on restricted measures or accounts in a story. These cells will not appear locked in a table. However, data locks will still be enforced when you try to publish the changes and changes to locked values will not publish.
Procedure
Results
The data locks that you configured are applied to the model data in stories.
For the dimensions that have data locking ownership enabled, the Data Locking Owner column is added in the Modeler. You can add data lock owners for each member by adding their IDs in this column.
Data Locking with Advanced Filters
Some types of advanced filters aren’t compatible with data locking. In this case, none of the cells in the filtered table will be locked. Data locks will still be enforced when you publish the version, so you might not be able to publish all of your changes. The table shows the following warning: Data lock visualization is disabled as some of the active filters are not supported: Advanced Filters
Compatible advanced filters need to follow these rules:
-
They can’t explicitly exclude members, either by the Exclude () option in the table context menu, by an exclude condition, or by a Does not equal operator.
-
They need to contain a certain combination of dimension members, known as a Cartesian product: Each dimension member included in the filter needs to be included for all of the other dimensions’ member combinations in the filter.
To follow this rule, you’ll usually need to avoid picking members from different hierarchy levels in the filter conditions, too. For example, a condition that includes 2022 H1 isn’t considered equivalent to one that includes 2022 Q1 and Q2.
For these reasons, it’s usually easiest to create a compatible advanced filter by right-clicking a selection of table cells that meets the second condition and selecting Filter ().
For a detailed example of this rule, consider a table that has a Product Group dimension and a Geography dimension added to the rows:
A | B | C | D | E | F | |
---|---|---|---|---|---|---|
1 | Geography | America | Canada | |||
2 | Product Group | Cell Phones | Laptops | Cell Phones | Laptops | |
3 | Account | Units Sold | – | – | – | – |
-
Any individual cell
-
Cell Phones and Laptops for both Canada and America (cells C3-F3)
-
Cell Phones and Laptops for America (cells C3-D3) or Canada (cells E3-F3)
-
Cell Phones for America and Canada (cells C3 and E3) or Laptops for America and Canada (cells D3 and F3)
Example: Applying Data Locks to a Regional Forecast
In this scenario, you restrict changes to forecast data using data lock ownership in SAP Analytics Cloud.
Your company is preparing a sales forecast for 2018 Q4, and you want to allow regional sales executives to enter or import data for their own regions. However, you want to prevent users from changing any data that they are not responsible for, and you want to lock all data after the forecast deadline.
- Open the model that contains the forecast.
- Ensure that the Organization dimension has a Person Responsible column, with each sales executive assigned to the appropriate region.
- Select Model Preferences.
- On the Access and Privacy tab, set Data
Locking to ON, and choose
Locked as the Default Lock State.
Select OK.
The model data will be locked by default.
- Select (Save Model).
- Select (Configure Data Locks).
- In the Edit Driving Dimensions section of the Data Locking page, select +Add a new Driving Dimension and choose Organization.
- Select the Enable Ownership and Copy Responsible
Users checkboxes for the Organization dimension.
These settings will create a Data Locking Owner column for the Organization dimension, and copy the users from the Person Responsible column to it.
- Select Finish Editing.
- Select Show Grid.
- For the Forecast version, drill into the Date dimension to show 2018 Q4. In the 2018 Q4 Forecast column, set the lock state for all regions to Restricted.
- Select Done.
When working with the model data in a story, regional sales executives can now make changes to the data for the 2018 Q4 Forecast in their own region. All other changes to public versions are prevented.
- When the forecast deadline passes, open the Data Locking page again and change the state of the 2018 Q4 Forecast cells from Restricted to Locked.
Any changes to the public model data are now prevented. Now that the data is locked, the sales executives won't be able to change the lock states, although data locking managers can still reopen the locked members if they need to.