How to restrict the authorization to change backgroud configuration

hello , I copy some users from my admin user which contain the sap_all profile. so these uses can change background configuration. now, I want to restrict the authorization that they can only view the background configuration but can not change it . how can I set this authorization? Can I change the sap_all profile? how to set it?
thanks.

Hi,
You can copy the SAP_ALL profile to a new name say Z_SAP_ALL and provide display access to all the authorization object and make sure you remove all the critical tcodes in the Z_SAP_ALL profile.
Once you are done with testing the role assign it to the user.
Also search the threads in the forum...
Rakesh

Similar Messages

How to restrict the user to change the project structure but not the documents?

Hi,
I have created one project assigning different users in Solution manger. I want to risitrict some of the users to change the project structure but simultaneously allwoing the project documents to be created, edited or deleted using solar01 under Project documentation tab. For that I have followed the steps provided in the follwoing link.
http://wiki.scn.sap.com/wiki/display/SM/Howto+Restrict+Changes+to+Project+Nodes+to+Assigned+Team+Members
I am able to restrict the users to change the project structure, but I am not able to allow access to the project documents. It gives me the message "You are not authorised to change the project". This fulfills my one of the requirements. But, Is there any way to restrict the user to change the project structure but not the documents?. Any help will be apperitiated.
Thanks,
Rutvik Uapdhyay.

Hi Rutvik,
Basically there are 2 different authorization role ...you should look for and customize as per requirement in Z* namespace.
role - SAP_SOLAR01_ALL
this take care of objects in Solar01 like tab access etc
role -SAP_SOL_KW_ALL
this takes care of entire documentation within solman
hope this helps
Regards
Prakhar

How to Restrict the users from changing the Default variant of report.

Hello everybody,
The requirement is to restrict the users to save and overwrite the default layout variant (Layout for higher managenet)set for the report, but at the same time they should be able to change and save the other layouts for which they are having access.
I have written the logic in the program which is working fine for all the scenario when we execute the report. But the logic doesnt work if the user is selecting the layout on the output screen of the report.
for e.g if the user runs the report using the layout varaint for which he is having the authorization then he gets the all 4 options so he then he can select the layout for which he is not authorized and he can overwrite.
i have debugged and check as i have found that after the report output is shown all the layout paramater is controllled by the statndard SAP objects.
Can anyone help me out in this issue.
Thankyou in advance.
*to get the default layout variant.
w_save = 'A'.
if p_vari is initial.
    clear disvariant.
    disvariant-report = sy-repid.
    w_variant = disvariant.
    call function 'REUSE_ALV_VARIANT_DEFAULT_GET'
      exporting
        i_save     = w_save
      changing
        cs_variant = w_variant
      exceptions
        not_found = 2.
    if sy-subrc = 0.
      p_vari = w_variant-variant.
    endif.
endif.
*logic to check user authorization to change the layout setting.
if p_vari = c_layout.
    if not sy-uname is initial.
      select single * from agr_users
              where agr_name = c_role
              and   uname    = sy-uname.
      if sy-subrc = 0.
        w_save = 'A'.
      else.
        w_save = ' '.
      endif.
    endif.
endif.
Regards,
Satish.

Hi Maine,
Thanks for your reply.
As you mentioned for your own program, you can control the parameter "I_SAVE", when calling "REUSE_ALV_GRID_DISPLAY".
so already i have use the same logic and control the parameter through I_SAVE and here i am calling method ALV_GRID->SET_TABLE_FOR_FIRST_DISPLAY instead of "REUSE_ALV_GRID_DISPLAY".
and it works fine when we execute the report but the logic doesnt work when the user tries to change and save the layout variant on the output screen of the report.
Regards,
Satish

How to restrict the user to change ALV layout for Standard Report Output

Dear All,
How can i restict the Users to change Output layout of Standard ALV reports,
kindly suggest to solve the issue.
Regards,
Niranjan.G

Hi NIranjan,
In the ALV function module , the i_save can have the below paramater values.
You can add based on your requirement.
I_SAVE = SPACE Layouts cannot be saved.
I_SAVE = 'U' Only user-defined layouts can be saved.
I_SAVE = 'X' Only global layouts can be saved.
I_SAVE = 'A' Both user-defined and global layouts can be saved.
Check the Authorization Object - S_ALV_LAYO in SUIM (Objects by Complex Search)
Activity -23.
Edited by: Raj on Jul 13, 2010 3:05 PM

How to restrict the user to change/enter field value in me21n?

Hi, Experts,
in the me21n screen..for matkl field we need to validate the user authorization.
if that user having the authorization then it should allow to enter value in the matkl(material group) field.
other wise it should not allow.
how to do this validation?
can anybody help me on this.
Thanks and Regards,
venkat

Hi Aprna,
Thanks for your reply, but can you give some code for that.
actually i am new to badi or userexits...
if you can provide code it will be more helpful for me.
Thanks in Advance,
venkat

In MIGO , How to restrict the user to change the posting date?

Hi All,
In MIGO , I want the user to restrict from change in posting date i.e. user should not be able to change the posting date. The system should take to-day date only as a posting date.
Thanks in advance.
GP

Hi,
check this MBCF0005.
EXIT_SAPM07DR_001.
BADI being <b>MB_MIGO_BADI.</b>
<b>Reward points</b>
Regads

How to restrict the user from making any changes in Sales order- item level

Hi to all
How to restrict the users from making any changes in sales order at item level if the same sales order is released by senior user through status profile.
Regards
Anish Parikh
Edited by: anish parikh on Jan 24, 2008 5:16 AM

Hi Anish,
This can be achieved through the roles and authorization.
This can be done through the basis team. they can create user profiles and roles.
For the roles they assign some transaction codes so that they can view the only assigned tr. codes.
Like that ur requirement can be done.
Also u can prevent the user to change any fields in the sales order screen (VA02). for that please modify the authorisations.
Hope i answers.
Reward points if useful.
Edited by: kaleeswaran bhoopathy on Jan 24, 2008 9:57 AM

How will I block/restrict the user to change the payment term in FBL5N?

Hi All,
How will I block/restrict the user to change the payment term in FBL5N????
I have tried on following objects:
F_BKPF_BLA
F_BKPF_BUK
F_BKPF_GSB
F_BKPF_KOA
F_IT_ALV
F_KNA1_BED
F_KNA1_BUK
F_LFA1_BUK
S_ALV_LAYO
But, not succeeded.
=>Actually user runs FBL5N, double click on a record then click on Change icon.
=>Change Payment Term.
Please reply ASAP. Point will be awarded.
With Best Regards
Dharmendra

Hi Dharmendra,
Please set an authorization trace in ST01 and then ask the user to execute the transaction and the steps on the same application server as the o ne on which the trace has been set (valid in case we are talking about mutiple application servers for same <SID>). After this is done switch off the trace,list it and fill all the authorization objects. That might give you the perfect idea.
Regards.
Ruchit.

How to restrict the changes in Relesed PO?.

Hi all,
How to restrict the users to make a changes in the Released PO?. User should make the changes only if it is unreleased by the respective codes.
1. Is there any user parameters like functional authorisation?
2. I have already suggested two solutions to the clients that
1. To restrict the authorisation of TCodes ME22n at the user level, but it's not a suitable solution, if user want to make any changes before releasing, then system is not allow to do the changes.
2. I have made release indicator as a 1 - not changeable if it is released, in release strategy settings. But the system is not allowing the all the users including release codes to make the changes?.
If there is any solution, please reply immediately.
with regards,
Raja.

hi,
if u set release indicator 1, after release is taken place, for any changes, u need to revoke the release. and then change the PO.
even u cant directly block the changes to already released PO, because, in future if at all qty or some changes is required to change, it should allow u to change!

How to restrict the change access in CRM for OLTP orders

Hi Guru's,
Please let me know how to restrict the change access in CRM for the orders that are created in ECC. The ECC orders will only for display in CRM but not for change,
We have the orders that are created in ECC, it will flows to CRM and should restrict the access to get in to the change mode in CRM but as of now CRM system is allowing change mode for ECC orders and ending up with errors.
Is there any additional middleware parameter that needs to be added to SMOFPARSFA table to get this functionality! Please advice! Thank your for your help.
Regards
Suneel

Hi.
You can use the PFCG role to control if the user is able to create, change, delete or only display a business transaction type.
Regards.

How to stop the users from changing the Decimal in SAP

How to stop the users from changing User Profile

Hai,
It is not possible to restrict SU3 to display, because it has only S_TCODE has the authorization object.
If you really want to restrict users from changing their profile you have to remove the SU3 access and give SU1 or SU2 which gives access only to Personnel details and Parameters.
Hope this helps.
Regards,
Yoganand.V

How to restrict the job start conditions (only "Immediate" type) ?

Hi,
We allow our users to schedule and execute in background mode transactions (example IP19, IW38). We gave them for that authorizations (object S_BTCH_JOB with LIST, PROT, RELE and SHOW - objetct S_PROGRAM with BTCSUBMIT).
We would like that users can schedule and execute their jobs only with the u201CImmediateu201D job start condition (in the Start Time screen for the type of start condition : Immediate, Date/Time, After job, After event, or At operation mode).
Another solution: prohibit the scheduling and the execution background job in a certain time interval ...
How can restrict the job start conditions ?
Thank you.
Patrice.

Hi Jan,
Yes, sa38 makes it possible indeed to execute in background into immediate mode a job but
the user have to know the name of the program to be carried out ...
The user knows only the name of these transactions trade. For example, IW38.
In the menu of this transaction, SAP gives the possibility to execute in background :
Program --> Execute in Background --> display of Start Time screen for the type of start condition :
Immediate, Date/Time, After job, After event, or At operation mode).
It is at this time there that we want that the user can only choose the "immediate" mode.
We must thus prohibit the other choices (Date/Time, After job, After event, or At operation mode) ... and
and we don't know how to restrict these other options in this screen "Start Time screen for the type of start condition".
Thank you.
By.

How to restrict the department to not user other departments' equipment?

Dear SAPIENTS,
How to restrict the department to not user other departments' equipment? If suppose any one creating order for equipment having different authorization group then system should not allow me to do this.
Regards,
Kaushal Rai

Kaushal Rai,
Use Authorization group for technical objects, create authorization gruops in IMG and assign the same to the Equipment master and block the other department with the same authorization group. For ristricting the authorization group to other departments after creating and assigning it to the equipment seek help from your BASIS team.
goto the below path for cerating the Authorization group:
IMG - PMCS - Master data in PMCS - Technical Objects - Define Authorization groups:
Here you define the authorization groups, after completion of this step go to the Equipment master in General Data tab page there is a feild Authourization Group, mention the respective authorization group and provide this Authorization gruop value to the respective user in the user role with the help of BASIS Team.
Regards,
Praveen.

How to restrict the user in MIRO for not modifying price

Hi All
My requirement is How to restrict the users in MIRO screen for not modifying Material Prices of only the for specific ROH types .
For example :
Valuation class             RM description
3021                             RM - A
3022                             RM - B
3024                             RM - C
when ever we procure the above Raw materials A,B and C and
the Quantity of each Raw material @ 10 units and value @ 1 INR for each unit
RM - A procured qty 10 @1 total price is INR 10
RM - B procured qty 10 @1 total price is INR 10
RM - C procured qty 10 @1 total price is INR 10
total price of PO is INR 30
when we received invoice material prices are assume it INR 1 is excess for each material.Now the invoice price for each RM has become INR 11.
in MIRO we want restrict the user to change the price from INR 10 to 11.
suggest the best possible ways to restrict in MIRO screen
Thanks & Regards
Mala

Dear:
                  Take help of ABABPER fo implement exit using INVOICE_UPDATE or MRMH0003 Logistics Invoice Verification: Revaluation/RAP exit. If this does not help then seek help of MM functional who will help you to find exit for the required task.
rEGARDS

How to restrict the quantity & rate of MIRO with MIGO and PO

Hi friends,
Can any body tell me how to restrict the quantity & rate of MIRO with MIGO and PO.
e.g. if we have done MIGO for quantity 10 and the rate maintained in the PO is Rs.100.Then at the time of MIRO system should not allow to change the quantity and rate.
How we can do this?
Regards
Purnesh Sharma

Hi,
You are misunderstanding the use of MIRO.
If you change the details in MIRO you are NOT changing anything. You are just entering the price and quantity from the Invoice.
If this price and or qty is different from the GR aqty and PO price then the system will block the invoice for payment (and it can issue messages toinform the buyer if configured correctly).
The whole design of MIRO is based on the principle that you enter EXACTLY what the vendor has put on the invoice. By preventing the users from changing anything you will get NO mismatched invoices, but you will not be paying the vendor the amount specified on their invoice. This will surely cause problems.
If you do want to ensure that ONLY the GR qty and the PO price are used and cannot be changed then why not consider using ERS (Eveluated Receipt Settlement. this is basically self billing.
Effectively you will be paying the vendor based on what you have received in MIGO multiplied by the price from the PO. (which is what you would be doing if you stop any changes in MIRO)
Steve B

How to restrict the authorization to change backgroud configuration

Similar Messages

Maybe you are looking for