You define an authorization by listing the operational objects allowed (for example, company code or business area) and the editing functions allowed (for example, create, change, delete) for a standard authorization object. You can always define several authorizations for each authorization object.
For each authorization object, you can assign authorizations on one or more independent levels. This restricts access to documents depending on, for example, the company code, business area, document type, account type and account. There is an authorization object for each level which determines how you enter the corresponding authorizations.
An example of an authorization object is "Accounting document: Company code authorization". With this standard authorization object, two specifications are required to assign authorization:
The possible activities are defined in the system. You can find the activities and their keys for each authorization object in the TACTZ table.
Most authorization objects have a similar structure, that is, two specifications are necessary for each object. The first specification lists values for a field in the object to be protected (company code for example) and the second lists a series of activities. Via this combination, you can differentiate the permitted activities distinctly. For example, you can restrict the creation and changing of documents to one company code, but permit the display of documents in other company codes.
Defining authorizations
The assignment of authorizations is divided into three groups:
You can assign general authorizations for the individual functions defined in the standard system.
You can assign organizational authorizations for:
You can assign functional authorizations, for example, for the account type, the document type or the customer, vendor or G/L account.
Checking the general authorization
If you want to prevent an employee from carrying out certain functions, you can do this by assigning a general authorization. The system checks this authorization when the employee selects a function and prevents him or her from carrying out the function if no corresponding authorization exists.
Example: The authorization object "Accounting document: Company code authorization" has been assigned to the function for posting documents. When you select this function, the system checks whether you have authorization to post documents (activity 01) in at least one company code. Posting is only permitted to employees who are allowed to post in at least one company code.
With the organizational and functional authorizations, you further limit this general authorization.
Checking the organizational and functional authorizations
When an employee attempts to carry out an activity, the system checks whether he or she
These authorization checks are always carried out after a user makes an entry. If all authorization checks were passed successfully, the next activity can be carried out. Otherwise, the system rejects further processing.
You can protect customer and vendor master record fields from being changed using the "Customer: Change authorization for certain fields" and "Vendor: Change authorization for certain fields" authorization objects. You can read about which requirements have to be fulfilled for this in the chapters on the topic Prepare to change customer master records and Prepare to change vendor master records.
When assigning authorizations for one-time accounts, you should note that master data is entered during document entry with the one-time account method. If you want to limit the processing of master data using the assignment of authorizations, you must take this into consideration.
Authorization objects in Financial Accounting
The Financial Accounting component contains predefined authorization objects. These are described in the following. You define authorizations for these objects by entering the required values in the fields for the objects. If you do not want any restrictions, you can enter * in the corresponding field.
Caution: Authorization groups
are contained in certain authorization objects. These objects have been
defined to protect individual master records, accounts or document types. If
you do not require this special protection, you need not define any
authorizations for these objects. By omitting these authorizations, the
processing options of your employees are not restricted. For all other
authorization objects, you must assign authorizations to
enable processing with the objects.
Customizing authorizations
The specifications which you make when configuring the Financial Accounting module are stored in tables. For assigning authorizations, the configuration tables are grouped into authorization groups. You can assign tables to authorization groups as you wish.
For example, the tables for the payment program have been assigned to authorization group FC12 and the tables for the organizational units in Financial Accounting to group FC01.
You assign authorization for the tables and therefore for configuration by specifying the required authorization classes and activities (maintenance and display) for table maintenance (under the "Basis - Administration" object class for the authorization object. You can assign authorization to tables not belonging to any authorization group via the group "NC".
If you want to change the standard allocation of tables, you should take into consideration that there are tables which may need to be maintained by the accounting clerks. These include, for example, the table with the exchange rates for foreign currencies. Consequently, these individual accounting clerks require authorization to maintain these tables. These tables have therefore been grouped together in separate groups in the standard system (FC31 for posting periods, FC32 for exchange rates, FC24 and FC35 for available amounts).
The standard system has authorizations which are specially adapted to Financial Accounting. These authorizations which are grouped together in SAP standard profiles, generally give authorization for all organizational units.
You need to define authorizations for Accounts Receivable in a company with several company codes. Authorizations for accounts receivable accounting clerks, who are responsible for different company codes or business areas, often only differ when company codes or business areas are listed in the objects (organizational authorizations). Authorizations referring to account types, document types and bank data processing (functional authorizations), however, are always differentiated. Therefore, it is recommended not to group all authorizations into one profile for an accounts receivable clerk, but instead to set up one profile for assigning company code-specific or business area-specific authorizations and one profile for all further authorizations.
To do this, you define the following profiles:
Two profiles are assigned to each employee. For example, you would assign profiles DEBI_0001 and DEBI_ALL to an accounts receivable accounting clerk in company code 0001.
With the profile DEBI_0001, you assign authorization for all activities in customer master records and customer accounts in company code 0001. The master records in company code 0002 can be displayed only. For all further activities in this company code, do not assign any authorization.
The corresponding profile for company code 0001, DEBI_0001, is as follows:
For all other company codes, you define corresponding profiles. Via a functional authorization profile, you can also specify which general master record functions are permitted and which account types can be posted. You can assign this profile to all accounts receivable accounting clerks.
With the profile DEBI_ALL, you assign a general maintenance authorization for master records. You also assign authorization to post to all customer accounts and G/L accounts as well as authorization to process the documents posted to these accounts.
The corresponding profile DEBI_ALL is as follows:
You specify authorizations for the individual workplaces by defining authorizations for the standard authorization objects. You define an authorization by listing the permitted business attributes (such as company code or business area) and the permitted activities (such as create, change or delete) for a standard authorization object. You can define several authorizations for each authorization object.
Select the object for which you want to define one or more authorizations from the list of authorization objects. Via Authorization -> Create, you can define new authorizations by entering the required values in the predefined fields.
You can use the standard authorizations and change them as necessary to meet your own requirements.
You transport authorizations as follows:
You can find further information on authorizations in the R/3 Basis online documentation. Here you select the "System Administration" area. Then select the "Users, authorizations, system security" document.
The authorization objects are also documented online. To find this documentation, select the "Financial Accounting" object class from the list of object classes within the SAP system. Then position the cursor on a particular authorization object and select Utilities -> Documentation.
By means of Utilities -> Technical name, you can display the technical name for each authorization object. By means of Utilities -> Display fields, you can find out which values can be entered when defining a standard authorization object. This generally includes the list of permitted business objects (such as company code) and of permitted activities (such as create, change and delete).