Authorizations for tasks (R_UC_TASK) / Best Practice SEM-BCS authorization

Question

Dear Experts,
I am quite new to authorizations and in particular to SEM-BCS authorization. So I would be happy if you could help me with the following requirement:
We have to setup an authorization concepts for SEM-BCS. Among others we want to setup authorizations for consolidations tasks using authorization object R_UC_TASK. With this authorization object certain tasks can be restricted to certain characteristic values u2013 e.g. for a certain consolidation group or a certain consolidation unit. We have defined a role each for certain consolidation tasks. These roles are not restricted to any characteristic value yet. We have for instance a role u201Cregional controlleru201D who is allowed to perform certain BCS tasks on a regional level (consolidation unit level). This would mean that we would have to create the role u201Cregional controlleru201D for all consolidation units u2013 see example below:
Role 1: Regional Controller u2013 Cons. Unit 1000
Role 2: Regional Controller u2013 Cons. Unit 1100
Role 3: Regional Controller u2013 Cons. Unit 1200
Role n: Regional Controller u2013 Cons. Unit n
We have more than 400 consolidation units. So this would require a high effort. Is there instead a possibility of creating one role based on authorization object R_UC_TASK which just defines which activities can be performed (without restricting access to a certain consolidation unit). , and using second role which defines the consolidation unit access? u2013 see example below:
A
Role: Regional Controller
Role: Cons Unit 1000
B
Role: Regional Controller
Role: Cons Unit 1100
C
Role: Regional Controller
Role: Cons Unit 1200
In this case we only would have to maintain one role u201CRegional Controlleru201D and we only would have to assign the restriction for the consolidation unit. How could this be realized?  Or do you have any other ideas to solve this requirement in a simple way?
Moreover I would be happy if you could tell me where I could find best practice scenarios for SEM-BCS authorizations.
Thanks a lot in advance!
Best regards
Marco

Answer 1

Hello Marco,
you can enter a master role in the description tab of a role. All fields populated via program PFCG_ORGFIELD_CREATE can be maintained in the role. All other fields will be taken from the master role. So you only need to populate the field for unit with the program.
Good luck
Harry