Business Unit Security Access

I have created a Child Business Unit that has a Parent Business Unit. The Child Business Unit has a team associated with it. The team has members that are all in the Business Unit.
I have restricted access in the security role so that Read access on Entity A is set to Business Unit.
My problem is that when a User from the Busines Unit I have created views the entity they can Read records of people in the Parent Business Unit but I only want them to see records for the Child Business Unit which they are a member of.
Anyone know how to resolve this?
Thanks.

If the issue is with a user from the child BU seeing records in the parent business unit, it is likely a security role issue and you may wan to check the users' security role. In CRM, if more than one security role is being compared (and in this case there
are at least 2, 1 with the team, and the other with the user record) the role with the highest privileges will be taken. Not the most restrictive as some people may think. So my guess is that the user security role has org level read privileges.
You may also consider checking of there is any sharing being done with the record in the child business unit. A user could have easily shared a large chunk of records with one or more users in the parent business unit. If this is the case, you
will need to unshared them one at a time which is time consuming. You may also find a third party tool on Codeplex that will do the unsharing or you may be able to create a console app if you have someone with coding skills.
If the issue is with user seeing related records to the entity, such as seeing emails (that they shouldn't see) of others related to the an account record (that they are allowed to see) for example, this could be the result of inheritance.
I have seen this before going back to CRM 4.0. There is an older document for CRM 4.0 that covers this in depth. I don't have it on hand, I haven't reviewed it in at least 2 years, and I'm not sure if they have anything updated for the
newer versions. Not sure it this applies, since it sounds like the issue is with lower business units seeing parent BU records.
Jason Peterson

Similar Messages

SCRM Business Units/Company & Facility Visibility

Hi Everyone,
Do the SCRM Business Units need to be enabled in order for users to view company and facility profiles? In the past, we have used P4P to view and edit company and facilities without the SCRM business units enabled on each UGM user’s profile. If I want to enable view only access to all company and facility profiles, do I need to enable and add the SCRM business units?
In our current environment, I can view and edit company and facility profiles without the SCRM business units enabled in UGM. However, when I assign users the SCRM login, search, company reader, facility reader permissions without edit options, I receive the “you do not have permission to view this specification.”
I found the following from one of the Oracle documents:
“SCRM now supports business unit (BU) security. Users will only have access to company and facilities they have been granted access to through SCRM business units on the UGM user profile. This feature also filters the users’ business unit selection list, only showing those business units they have    access to. BU security is configurable and can be turned on or off. The default feature configuration is off. If users have no business units of SCRM     assigned to their UGM user profile they will have access to all business units. Business Unit security can be ignored depending on the status of the     business unit on the company or facility profile. There is a configuration available to set up which business unit statuses are included when SCRM BU     security is evaluated: Common.SCRMBusinessUnitSecurity.Enabled”
My questions are as follows:
Is this a bug in our system?
Am I missing a permission for company/facility visibility?
Do the SCRM business units need to be enabled?
Thanks in advance for any assistance.
Nick

Is Common.SCRMBusinessUnitSecurity.Enabled set to true or false? If its set to false you may have found a bug.
If Common.SCRMBusinessUnitSecurity.Enabled is set to false, we only evaluate roles to determine who has read or edit access to a company profile. So the user must have [SCRM_COMPANY_READER] to see company profiles. Only users with [SCRM_COMPANY_EDITOR] can edit companies.
If Common.SCRMBusinessUnitSecurity.Enabled is turned on then we evaluate roles AND SCRM Business Unit association.
The same applies to facilities, however when we evaluate sourcing approval permissions it gets more complex. For sourcing approvals we evaluate workflow permissions, Object Level Security, SCRM BU Security AND GSM BU security of the BU on the associated specification.
For more information around SCRM BU Security in the white papers section in our documentation listing:
Agile Product Lifecycle Mangement for Process Whitepaper Library

How to get access to a business Unit in Fusion Sales Cloud for Incentive compensation user

Hi all,
We are setting up a new environment and we do not seem to get access to the Business Unit.
We have all the roles necessary and have access to the required screens but cannot populate any data as the business Unit DropDown is not showing any values.
Any help is appreciated.

I don't think the IT Security Manager role is going to help you in the Incentive Comp plan UI.
This is a screenshot from my test environment where I have these two roles for the business unit "IC Performance Test". I am not an IC expert and this was set up a couple of years ago, so I don't recall all the details. I have pinged the IC team to comment on this.
Thanks,
Oliver
Fusion Apps Developer Relations
https://blogs.oracle.com/fadevrel

Restricting Access in Solution Manager by Business Unit?

Hi Experts
We are currently in the process of upgrading our Solution Manager to 7.0 EHP 1. Business wants to restrict access in Solution Manager by business unit. Is this possible? Is it possible to create derived roles which restrict on buisness unit without having to custominze? If it is possible which object needs to be maintained? I'm already aware of restricting access by project using S_Project but this still allows users to view other projects. The requirement is that users only view projects for their business unit.
Please advise experts.

Hi There,
I dont see any reason why you cannot acheive your objective in SolMan, You should be able customize views per business under SPRO_ADMIN and derive required view with in PFCG role separated by business.
Yes, You can also do derived roles concept in Solman and restrict by Org Units.
Guys - Do you differ from my opinion?
-AJ
Edited by: AJ on May 19, 2010 3:47 PM

Page Composer EL to access the Business Unit

Hi,
Is it possible to access the Business Unit of the currently logged in user using Expression Language in the Page Composer? If yes, then what is the expression?
Thanks,
Sujoy

Hi Sujoy
There is no universal way to access Business Unit for all pages. If it's shown on the page then you should be able to find its Value property in page composer. Also some
pages expose this via a backing bean attribute, again possibly used in a condition associated with a field on the page - something you'd have to go looking for in page composer.
I am trying to get new ER 20865654 processed with the request to show commonly useful data points to customization users. If you could kindly provide details on your customer use-case it would help promote this feature.
Kind regards
Richard
FA Developer Relations

How to create a new Business Unit

Hello,
I have problem.
Can anyone tell me
1 : How to create a new Business Unit, New Company from Jd Edwards screen means webpage.
2 : Can i find the User Defined Codes means UDC in jd edwards screen.
Thanks,
Shakti Prasad Priyakumar.

First, let me confirm that you are on JDE World, and not JDE Enterprise One/One World. They are very different environments. JDE World is normally a green screen, IBM Client Access based system.
If you are on a JDE World menu and you have the proper security access, just type in UDC on the command line and hit <ENTER>. You hopefully are in a test environment when you do this, since it sounds like you have very little knowledge of JDE. The UDC screen will come up. If you know the system code and code of the UDC table you want to look at, you can key them in and bring up that table. Otherwise, do F5. That will let you search by system code and see what table codes are available in each system. If you are not sure what UDC table you need, you can look at the JDE data dictionary for the data item you are interested in and that will tell you the UDC table, if the data item is UDC based.
As for setting up new business units and company, get to the main general ledger menu. Don't remember the exact path, but you want to get into the setup/define menu for general ledger accounts. There will be separate options there for maintaining companies and for maintaining business units. You want to play with this in a test environment before you do anything for real.
Hope this helps a bit.
John Dickey

Business Rules Security based on work flow

Hello,
How can we enable security on Business Rules, based on the workflow,
for example,
we have Business rule, that is attached to one input form, which opens a window for entering run time prompts for entering
new asset details, and after entering he saves and the planning unit is promoted to next level,
but on the input form, the Business rule is still visible, where by he can enter the the details though the planning unit is promoted,
Is there any way that makes the Business rule access disables/hides as the planning unit is promoted?
Thanks,
murali.

There is currently no out-of-the-box integration between workflow and business rule security.
This thread may help with some alternatives:
Workflow Problem
- Jake

Duplicate detection rule by business unit

Hi there,
Our CRM is used by multiple business units and they have different requirements for duplicate detection rules. For example, BU A would like to detect exact duplicate on Email Address 1 only, and BU B detects duplicates on Mobile only but allows duplicate
email address 1.
I have User 1 in BU A and owns the Email Address 1 duplicate check rule. Then I have User 2 in BU B trying to create a record with duplicate Email Address 1 and the Email Address 1 duplicate check rule fired. The Security role of User 2 allows
CRUD access to Duplicate Detection Rule at business unit level.
How do I configure so that only Mobile rule is fired for User 2, and only Email Address 1 rule is fired for User 1?
Thanks,
Henri

Hello Henri,
OOB duplicate detection is global setting and in case you will use it - the same rules would be used for all users in all BUs. To solve your problem you will have to develop own solution to implement your scenario.
Dynamics CRM MVP/ Technical Evangelist at
SlickData LLC
My blog

Show reports based on business unit in crm 2013

Hi,
I have two reports Partner Report and Manager Report. I have created two business unit Partner and Manager. I want to show Partner report to Partner Business unit as like Manager report show only Manager Business unit. Please tell me how is it possible?

Hi,
Assign business unit level read access to your entity for which you have written the Report.
Assign the respective business unit to the user, in your case assign business unit Partner to user Partner
and business unit Manager to user Manager
Also use filtered view in your report if it is SSRS report.
Regards
Ayaz

Business process and business unit in compliance calibrator

Dear Experts,
Can any one please tell me the use of business process in rule architect and business unit in mitigation control.
Thanks and Regards
A.Rama Krishna

Dear Rama,
Basically business processes are the actual day to day processes any oraganisation carries out. When we have to group tcodes / functions for rule creation , we group them according to a business process so that we can easily relate them to each other within the business process. Eg : Procure to Pay.
So the rules have to be created such that in this process there are no SOD violations in the access given to users. Thus it makes risk analysis more logical and simple for analysis.
Thanks,
Yajuvendra Sonalkar

Error count based on business unit and Vehicle type

Hi,
i have a custom error idoc table which contains idoc no, business unit, vehicle type and error message.
Now here my requirement is to display the total count(Error count) of each message based on business unit and
Vehicle type and display it in the output list as shown below. what is the best way to achieve this as there will be number(atleast 6) of error messages available for a business unit based on vehicle type and there are around 15 business units overall for which i should display the error count.
buisness unit| Vehicle Type | Status | Error message                            |                   Error count
71320            WT10               51          Organizational channel missing                      10
                      WT10              51          SMC Missing                             |                      15
72000          WT20                51            Creation of vehicle not possible|                    12
                    WT20                51            Status change not requested    |                     10
regards,
Mani

Hi,
Assign business unit level read access to your entity for which you have written the Report.
Assign the respective business unit to the user, in your case assign business unit Partner to user Partner
and  business unit Manager to user Manager
Also use filtered view in your report if it is SSRS report.
Regards
Ayaz

GRC AC ARM/ARQ: Approver based on Business Unit / Company...

Dear all.
I am wondering if it is feasible to stablishn approver based on a Business Unit / Company.
That is to say:
At the Access Request Creation functionality the requestor could indicate the first name, last name, ....and also it could indicate an specific company, or business unit.
The requestor also assign some roles for some system.
The requestor Submits the request and it goes to the approver assigned to the company
Regards and thank you.

Hi Neraaj. Thanks for your reply, was great!
So now i am moving to next level. My idea is as follow:
have a user requestor who creates Access Request. They set the user id, the name, last name and the Organization (not the department, not the company,...)
I want to create a BRF+ to send the request to an Organizational owner for the Organization set by the requestor.
For that i don't want to create an agent rule because i have to maintain the relationship Organization-Owner into the decision table.
I want to create a BRF+ rule to fecth the owner of the Organization. Where is this owner set? I want to upload a Organizational strcuture into the Access Control organization Master Data. For each Access Control Organization view you can set different tabs AC users, AC roles and Owners. Just like into the image below:
For that i suppose i need a DB Look up just to search for the Owner set in that tab but i am not pretty sure about:
Where is this relationship located?. I have check at HRP100X tables and i found the organizations objects and more data but nothing like the approver.
Once i have found this relationship i don't know if it is possible to get the owner into a variable and set this variable as the result of the function.
Any advise will be well come.
Regards and thank you.

Elimination Business Units and being able to manually journalize to them

Elimination Business Units are created and marked as consol only under general ledger definition. The assumption based on functionality in previous version of PS including 9.0 and 8.9 is that business units marked as consol only can only be used by the consolidations process. During unit testing, user was able to successfully manually create a journal entry and book to the elimination business unit. Is this a defect or a feature change? If this is a feature change and business user has a requirement that elimination business units can not be manually booked to, how can I meet this requirement?

Hello Brad.
Don't know how you had trouble with any attachments being embedded in a Mail.app message prior to Tiger Mail since all Mail.app versions prior to Tiger Mail didn't support composing or sending HTML formatted messages including when forwarding a message received that was composed in HTML.
If the recipient is accessing the email account via webmail, doubtful it is the computer having this problem. Non-image/photo type attachments should not be available in the body of the message when a recipient accesses the account via webmail regardless that all attachments appear in the body of the message when sent by Mail. The same when a recipient uses Outlook or Outlook Express when receiving non-image/photo type attachments such as Excel, Word or PowerPoint attachments. These type of attachments appear in an attachments only area below the message header and the same with image/photo type attachments that may also appear inline or viewed in place within the body of the message when the message is opened by the recipient.
The recipient can try clearing the cache for the browser used but if the attachments are not available at the server when the message is received, this is a Bell South issue since the attachments are being stripped at the server when received.

Report of all sales orders for a business unit

I am analyzing revenue, and I would like to run a report that would list all sales orders and the value of those orders in a particular business unit.
I require the value of each and every sales contract during a certain period. Can I run a report that lists all sales contracts opened during a particular period?

Hello,
from the standard SAP menu, under: "Logistics --> Sales and Distribution --> Sales --> Information System --> Orders" you can find some transactions reporting sales orders lists, such as VA05 or SDO1, which perhaps could fit your requirements. Otherwise you can create a query to merge the tables containing the information that you need. As of my knowledge there's not an organizational level called "Business unit" in SAP, so you should check if in the transaction mentioned above the field you use to identify the "Business unit" is available.
Hope to be useful.
Best regards,
Andrea

Providing un-secured access to a web report.

Hello Experts,
We have been sending out 'Load Status' emails on a daily basis for various BW loads. Recently we discontinued this process and set up a report based on one of the statistics cube. We got out the link for this web-report to all the users in our daily load status distribution list.
The problem now is that when you click on the link, it pops out a window asking for the log-on information to our production system. But it looks like a few of the users do not have access to the production system and are hence unable to access this web-report.
Is there any way to allow un-secured access to this particular web-report to all users i.e.without a screen asking for log-on information?Is it possible to set up a generic user id for this report that allows all the users to access this report without actually giving them access to our production system?
Thanks
Arvind

Arvind,
What is your BI system version ?
if it is 3.x - then the URL will have a link to your server followed by a Question mark "?" and then some parameters.
The value till the ? mark is the Web service for the same - you can make this Anonymous in SICF but then this would mean that all queries can be accessed through this URL ...
else create an RFC enabled function module based on RRW3_Query_View_data and then use this for your query and expose the same as a web service and make it anonymous ... or have a BSP page to do the same....

Business Unit Security Access

Similar Messages

Maybe you are looking for