Authorizations for Customizing (SAP Library

Authorizations for Customizing

To be able to perform Customizing activities, you need authorizations for:

Authorization to perform Customizing projects

The authorization object S_PROJECT allows you to process Customizing projects, e.g. change, display or delete projects, maintain status information and project documentation and analyze projects.

Authorization in project management with cross-project effect

The authorization object S_PROJECTS allows you to perform activities in the Customizing project management with cross-project effect, e.g. create and change project templates and create projects.

Authorization for the IMG activities of a Customizing project

You can assign authorizations for the IMG activities of each Customizing project, or each project view. Create a role for each Customizing project (view) and assign the Customizing project or view to this role. The authorizations to perform all activities in the Customizing project or view are generated in the profile generation.

You can restrict the access of a user to the rows of a table by business organizational units. One possible use would be that a user is only allowed to display and change the contents of a particular work area, e.g. a country or plant, in a table. See Line-oriented authorization.

Activities

You must create (at least) two roles to provide all Customizing authorizations, as follows:

A copy of the roles Customizing project member (technical name: SAP_BC_CUS_CUSTOMIZER) or Customizing project administrator (technical name: SAP_BC_CUS_ADMIN) delivered by SAP
A new role to which you can assign a Customizing project or project view
Possibly a composite role combining these two roles

Copy the Customizing role delivered by SAP in the role maintenance (transaction PFCG). This role should contain the authorization objects S_PROJECT and S_PROJECTS.

Create a new role and assign a Customizing project or project view to it. Choose Utilities ® Customizing auth. from the Menu tab.

Choose whether you want to insert IMG activities from a Customizing project or a project view into the role with the Insert key.

The transaction codes and other authorization objects required to maintain tables for this Customizing project (view) are determined automatically and imported into the role.

If you have assigned users (resources) to Customizing projects in the project administration, you can copy them into the roles. Choose User. The assigned users are copied into the role.

Note

If you have assigned a Customizing project or a project view to a role, this prevents the manual assignment of transactions. Conversely, you cannot use a role to which you have assigned transactions manually to create Customizing authorizations.

See create roles in the role maintenance documentation.