SPRO authorization

hi sap experts
I want to give spro authorization to power users in the production system
but only specific department users should get their tcodes under spro
for example if MM users need only authorization of MM related things in SPRO
so how to restrict authorization in SPRO so that particular tcodes/objects can be executed.Even some of the objects under SPRO tree doesn't have t-codes also.
regds
sandeep

hi,
For Individual Users, you use transaction code SU01, give the user name, click on change mode, there under tab Roles, you have SAP standard roles defined, depending on the module and the area on which the user belongs, assign the Roles, Save the details, For Creating your own Role make use of Tcode PFCG, check for SAP help for help on Role Maintainance.
Cheers...
Santosh.
Mark All Usefull Answers.

Similar Messages

Setting SPRO authorization only in disply mode

Hi,
I am working on authorization objects in anew role.. What is the name of the authorization object where I can set the activity for SPRO (Customzing) only in display mode ?
Thanks.
Regards,
Rajesh.

You dont need to do all this. Just create a role and add SPRO to it. Then maintain all the objects in that role to Display (Activity 03) ONLY.
However, this will not allow you access to all the zillion Tcodes that SPRO allows access to. In order to allow this, you will have to manually add ANOTHER S_TCODE object to that role and assign a * in it. So then you have access to all the Tcodes, but Display only.
This will do it for you. It did for me.
Edited by: Kunal Belnekar on Apr 1, 2008 2:53 PM
Edited by: Kunal Belnekar on Apr 1, 2008 2:54 PM

Role with SPRO for FICO

Hello SAP EXperts,
Can anyone tell me how to create a role with SPRO authorization for FICO transactions and roles only. I need to assign a role with which a FICO consultant can do all the customizing related tasks in the development server. Please give some solution.
I invite your valuable inputs
Thanks & Regards
Vanitha
Edited by: Vanitha badampudi on Oct 21, 2008 1:33 PM
Edited by: Vanitha badampudi on Oct 21, 2008 1:36 PM

Hi there,
The easiest way to get all of the t-codes, is for a customising project to be created in the IMG with all of the relevant IMG activities assigned to it. (Your FI CO consultant can assist here.)
Once that has been done, you can go and create a role in PFCG. Select the menu tab, then select Utilities - Customizing Auth. and it will then ask you to select a customising project.
Once you've done that, all IMG activities and transactions for that customising project will automatically be entered into the menu.
You then need to go and maintain and generate the authorisations.
That's my suggestion.
Hope you can use it.
Regards
Lucille

HR Authorizations

Hello All,
I want to give my SAP HR associates all authorizations for HR modules.I tried to assign them P_All profile but with that they are unable to work for t-code PM01.Can u pls suggest any role/profile which I can assign them so that they get all HR authorizations.

Hi,
You can resolve this in two steps.
1. Copy the HR module from SAP Menu and create a respective role. (this wil become big role)
2. Create another role with proper SPRO authorizations related to HR module.
This will be enough for the consultant access. Again in production you should proovide only display access. That means you can create the display version of the above roles.
Regards,
Gowrinadh

No direct SPRO in managed system, only via SOLAR01 / 02

Hi,
Is it possible to prevent users from launching SPRO directly from the managed systems but allow customizing through transaction SOLAR01 / SOLAR02 via Solution Manager?
Thanks.

Hi Guys,
We accomplished your exacr requirment by the following:
We lleft the team's SPRO authorization in DEV but blocked them from using it via a BADI thus forcing them to login via SOLAR02, input the IMG object and customize from there.
Here are the 3 BADIS:
ZENI_BLOCK_SPRO_IN_DEV_200
Logical Position: \FU:STREE_EXTERNAL_DISPLAY\SE:BEGIN\EI
- Block Customization in Dev 200 Environment
if SY-MANDT = '200' and SY-SYSID = 'ECD'
and ( SY-TCODE(4) = 'SPRO' or SY-TCODE = 'SST0' ).
message E172(00) with SY-TCODE.
endif.
ZENI_BLOCK_SPRO_IN_DEV_200_A
Logical Position: \FU:SPROJECT_STRUCTURE_EDIT\SE:BEGIN\EI
- Block Customization in Dev 200 Environment
if SY-MANDT = '200' and SY-SYSID = 'ECD'
and ( SY-TCODE(4) = 'SPRO' or SY-TCODE = 'SST0' ).
message E172(00) with SY-TCODE.
endif.
ZENI_BLOCK_SPRO_IN_DEV_200_B
Logical Position: \PR:SAPLS_IMG_TOOL_5\FO:CHECK_FOR_CRM\S
- Block Customization in Dev 200 Environment
if SY-MANDT = '200' and SY-SYSID = 'ECD'
and ( SY-TCODE(4) = 'SPRO' or SY-TCODE = 'SST0' ).
message E172(00) with SY-TCODE.
endif.
Best Regards,
Oded Dagan
SAP Project Manager & Solution Manager expert

SPRO Access

Hi,
I had similar situation as in the below link:
SPRO Authorization in Project created under spro_admin
I have a requirement to assign only SAP Utilities->Intercompany Data Exchange to the user
I did as per Julia, but in my case, the user is able to access other nodes in SAP Utilities also, but not other than SAP Utilities(eg:Enterprise Structure, Real Estate etc)
I added only SAP Utilities->Intercompany Data Exchange in the new Project via SPRO_ADMIN & created role by adding that new Project, but still the user is able to access other nodes present in SAP Utilities (eg: Device Mgmt, Contract Billing etc)
Can anyone tell me, why this is happening?
Regards,
Sid

>
Siddhartha Varma wrote:
> Thanks. But then how would the user be able to access IMG?
> If we remove SPRO from the role, then the user need to know/remember all the T Codes related to the node for which the user needs access. The user wont be able to access IMG. This should not be the case
please check the below link to get more information on SPRO. It is not required to give access to SPRO to give access to some part of the IMG. You need to enhance / customize the IMG while defining the project. Let me know for any confusion.
Regards, Dipanjan

How check the Strategy, if no authorization for SPRO?

Hello Experts,
                       Can someone please help on how to check the Strategy for the Release codes, if we dont have the Authorizations for SPRO in the Production Server.
Please help
Thank in advance.
Regards,
Yawar Khan

Hello Yawar,
You can use the below DB tables to see the release strategy configurations.
T16FB     Release Indicator: Purchasing Document
T16FC     Release Codes
T16FD     Description of Release Codes
T16FE     Descriptions of Release Indicators: Purc
T16FG     Release Groups
T16FH      Descriptions of Release Groups
T16FK      Release Statuses
T16FL         Release Indicators: Service Entry Sheet
T16FM         Descriptions of Release Indicators for SES
T16FS         Release Strategies
T16FT        Descriptions of Release Strategies
T16FV        Release Prerequisites
Regards
Greg

Authorization to a transaction with spro locked

HI!
(I didn't found any answer for my question in the forum, I'm sorry if it's already answered)
I want to give access/authotization to a few users in transaction OB58 (spro) in production system . The thing is the access to spro is not allowed in production. I want it to keep that way, and only give access to OB58 transaction.
Or.. is that any other way they could change Financial statement versions ?
I can not understand how there is not a transaction on SAP easy access for that. Am I confused, or anytime the client creates new accounts (which happens frequently) they need to add them to financial statement.
Many thanks,
Manu

>I understand. I thought it was posbile, even though the cliente was closed & locked, to make modifications if some special authorization was given.
This is possible, but there is an order of preference.
Best is a view with "current settings" activated. Downside is that you cannot maintain it in dev if you need to, in which case you can use a table maintenance generator and have almost limitless possibilities to control the access.
Depending on the delivery class settings of the table, more or less authorizations will be required.
Most notable is SE16 vs. SM30 and their parameter transactions.
The solution to your problem might be the choice of transaction. I am sure it is there in the SAP menu somewhere, so ask your functional contact in FI.
Cheers,
Julius

Authorization based on Module in SPRO

Hi,
we need to give module based authorization to the consultants,
I have created a project in SPRO_Admin in that i have created 3 view SD,HR, & MM. and assinged user also respectively.
after that i created a Role Called Z_SPRO under that Under Menu option i have selected the cust Auth,
and the project which i have created,
and in Change Authorizatiozation i made all green.
when i assigned this role to the user respectively, still MM user can go to IMG Activities and can work on other module nodes as well.
please advise.
Regards,
Irfan.

Hi,,
i have created a project using sapproject
I defined the scope by selecting second option
- by selecting application components and countries
under that i selected few nodes like fi, MM, SD, PP
and created project view based on project scope, and assinged the user as well.
after that i created a role called ZFI under Menu tab i selected Customing Auth. then generated the role.
when i assinged this to the user, user still have access all spro nodes, he can see as well as execute.
kindly let me know how to control this.
Regards,
Irfan.

Create Display Authorization Profile for SAP Transaction SPRO (IMG).

Dear All,
In my current implementation project there is an requirement to create display authorization profile for SPRO. I have tried a lot but was not able to do so.
Any one is having an experience in creating display profile for SPRO (IMG) ? If any one has worked on this issue then please guide me.
Thanks,
Avinash

Hi
This is security related question. I am not security expert.
But you can check this, Include the following authorization objects in the profile and assign this profile to the target user.
S_IMG_ACTV
S_PROJECT
S_PROJ_AUT
S_PRO_AUTH
and assign activity = 03 (Display).
Hoipe it helps.
regards
Srinivas

Workbench Request for changing the Analysis Authorizations Switch in SPRO

Hi Gurus,
While changing the Analysis Authorizations Switch in DEV(SPRO), its asking to create a work bench request.
so it means after creating a work bench request should we transport that particular work bench request to QA.
Please help with some suggestion.
Regards
Padmaja.

Just to add to this... the same way you need to transport a role up the stack, you have to transport AA object up the stack.
Check out this Wiki
https://wiki.sdn.sap.com/wiki/display/BI/HowtotranportroleandAAtogetherinBI
Regards,
Zaheer

Removing authorization for SPRO transaction

Hi experts,
I am working on ECC 6.0 and MSSQL Server. How to get the authorization object for Tcode SPRO. i have tried to find it out through SE80 but could not get the authorization object. I have mistakenly added object related to SPRO tcode. and user got the authorization to log in to SPRO. Now i tried to find out in all roles assigned to him but could not get SPRO tcode in his menu but still he is able to perform SPRO. Please suggest as i have made temporary adjustment by locking the SPRO tcode.

Hi Vaibhav,
Not sure if you already resolve the issue , but you can give only SPRO display authorization as follows .
There is an SAP Note 46546 please follow that note
You can go to the Role for which you want to give only SPRO Display
click on Manually tab and give this authorization object S_TABU_DIS and give only display
This should solve your problem.
Regards,
Ershad Ahmed

Authorization in IDES SPRO

My company purchased SAP.SAP Implementation is running on.
IDES is installed here but there is no authorization for configuration in SPRO.
I just want to know that whether authorization is given by my company to me
or for Authorization we (our Company) have to pay extra to the Implementation Organization.
Please give relevant data also.

Hi,
No extra money for Spro.
Tell your Basis person. Provide acces in authorzation.
In sur system execute Tcode : su01 enter the username in edit mode goto the Role tab. enclosed the below said role & save.
or
This user have all acees.
username : idadmin
password : ides
Sap_all
sap_new.
Regards
Senthil

Spro full authorization without sap_all and sap_new

Hi Friends,
Can u suggest me how to give spro full authorization without sap_all and sap_new profile.
Thanks & Regards,
Tarun

Hi Gowrinadh,
This is an interesting discussion. I don't mean to take shots at your concept, but I have some concerns about it as a solution.
> I have prepared a role 8 months back, we passed 2 patch upgrade cycles and I can confirm that this role will work even after the next version of ECC upgrade.
Sometimes the symptoms only make themselves visible later, and we don't know what is coming in the next version of ECC. Of course it should be largely compatable, but there will be new stuff. You can be sure of that.
> If there are any modules or new functionalities required, then customer has to request for it in addition.
My understand is that the customer requests a full and working SPRO role for each release. They will not find the tcodes for you and do not want to play ping-pong via support tickets either with it.
So each time you bill your customer for the 20 or 40 hours work for maintaining these tcodes manually in ranges? Appart from being error-prone, this solution is not scalable for when SAP might introduce another 20000 tcodes into the SPRO. Or someone convinces SAP to introduce an S_TCODE check for every line of code the whole system... (this is something which some people seem to believe in...), which would introduce several billion new tcodes for you...
> For which we can build separate role.
That is different. The question here (and certainly your solution) is to have them in the same role without duplicates but still including all SPRO access.
If you build them as seperate roles, then you can merge them as projects into one composite and live with the duplicates while checking for any known objects which should not be included.
I would agree with you. That is in my opinion a better solution, but it is not what you have been describing earlier.
> We can plan for authorizations and build roles based on the inputs for today and tomorrow received from customer.
That is the whole point in having maintainable roles and scalable processes. Manually maintaining 20k tcodes is incompatable with such requirements.
> By the way, the max no of consultants and business process owners having this role is not more than 40.
I don't think that assigning the role to less people will make it more usefull, nor that assigning it to more people will bring down it's per user cost of maintenance.
There is some old code posted here already which does what you have described in less than 1 minute. You can find it via the tables I have mentioned above, and will recognize it (and it's age) by the header lines it uses for internal tables. But it still works, since about release 3 point something...
Cheers,
Julius

SPRO display authorization

Hi Gurus,
I need to give display authorization of SPRO(including all the nodes)
How should i do this ?
Thanks and regards
Tushar Pathak

You might want to try a search for "SPRO Display" first...
I vaguely remember about 100 threads about the same topic...
Cheers,
Julius
ps: Feel free to delete this thread if you find the answer via the search.

SPRO authorization

Similar Messages

Maybe you are looking for