BI 7.0 Security: Replace SAP_ALL with alternative solution

[Former Member]

Hello,

In an effort to remove SAP_ALL from user accounts in BI 7.0, I need to find an alternative solution for allowing users to create, execute, and delete BEx queries. Initially, I was thinking of creating two roles, derived from the SAP_ALL template. One role would allow users to create, execute, and delete queries; the other role would allow users to only execute BEx queries. Since I'm new to BI 7.0, I'm not quite sure if this is the best approach. If someone has experience with this scenario, please advise.

Thank you in advance.

[Former Member]

Hi,

The below blog might be helpful for you.

/people/kamaljeet.kharbanda/blog/2009/02/26/step-by-step-sap-bi-security

Thanks,

Gowrinadh

[Former Member]

Hi Cedric,

You definitely need to move away from SAP_ALL in BI 7.0. The blog mentioned explains how the new features of BI 7.0 work, but I feel your issue is a bit more fundamental. Do you have a security strategy / design for your BI reports that you are trying to deploy?

You need to consider who can access what data in BI as well as which sets of queries. Once you have an idea for that if you look at how the S_RS_COMP authorisation object works, implementing roles with restrictions on that object will achieve restrictions on which users can access which queries.

There are SAP delivered templates for query execution roles, that you can look at to get you a starting point - but you'll still need to having a good naming convention for queries as well as an understanding of where your BI data is stored, to be able to restrict access.

Once you've considered the data and reports, you may need to further restrict information by the use of analysis authorisations on specific characteristics, which is where the blog will help you.