Change all activity to Display in a role

[Former Member]

Hi all,

I wanted to know if we can change all the 'ACTIVITY' in a role to display. I donot want to do it one by one for all authorization objects but in one go. Is this possible, if yes then how can we achieve it?

Thank you

[jurjen_heeck]

There's no way to mass change authorization values.

Besides that, only changing ACTVT fields will probabely not be enough to make a role 'display only'. There are a lot of other fields and objects to consider. In some activity related fields 3 or 03 do not mean display......

[Former Member]

Juergen,

Thank you for the answer. I have a sap_all_display role created on the ECC system, can I export this and use it (import) on my BI system.

Thank you

[jurjen_heeck]

I doubt that. If you compare table TOBJ from both systems you'll probabely see quite some difference. So your display role will contain a lot of objects which do not exist on the BI system and miss some important stuff because that didn't exist on your ECC box. Importing the role onto BI will cause some mess in your AGR_\* tables.

[Former Member]

Hi Zaheer,

Such question has already been asked before lot many times. Just search with the key words " SAP_ALL Display". Try it you will get lot of related threads.

Also there is no absolute way of controlling the access to just a display by ACTVT fields as many Tcodes do not check the objects having this field. You need to sit with your functional and Basis team to check each Tcode and the level of access which has to be restricted. Putting a trace and analyzing it might help as well.

[Former Member]

Hi Zaheer,

As there is exact no way to restrict all activity to display in single action like Organization value in role. To make a display role you need to also check the other objects not having the field ACTVT for ex: in HR object (P_ORGINCON) restriction based on authorization level Values in this fields are R, W etc.

Better to check table AGR_1251 for particular role. This will provide you the all field along with values exist in role, and based on that u can decide what need to be restrict to make a role display. For this u also needed the inputs from functional team alongwith testing.

[Former Member]

This message was moderated.