How disable SPRO from Sap_new and Sap_All profile

[Former Member]

Hello,

One of my training ID have SAP_NEW AND SAP_ALL. From the particular user how can I disable SPRO transaction.

Please help

Regards

Kariyath

[Former Member · Accepted solution]

Hello Kariyath,

My understanding is that you want the user to just not have access to SPRO though rest all is okie. You should try changing SAP_ALL and SAP_NEW as these are standard SAP. I would suggest that you remove SAP_ALL and SAP_NEW from user profile and instead assign him a role which will be same as SAP_ALL and SAP_NEW and then you can remove SPRO access from it. This would actually help you in monitoring authorizations in a better manner. Please use the following steps for it.

Create a new role in PFCG.

Don't assign any transactions in role menu. Go to Authorizations tab and open it in expert mode for profile generation.

Now go to edit->Insert Authorizations->Full authorizations.

This would give SAP_ALL and SAP_NEW to the role. next go to authorization object S_TCODE.

Here you will find the value as *. You need to change it. Make it:

A* to SPRN*

SPRP* to Z*.

Now remove SAP_ALL from the user and assign him this role.

But while the user won't be able to execute SPRO it doesnot mean that he won't be able to execute other transactions that are within SPRO for example OB52,SALE etc. If you requirement is just SPRO specific then this issue is solved but in case you need it for other ransactions then you need to define the values in s_tcode accordingly.

I hope this should be able to solve the issue. Please award points accordingly.

Regards.

Ruchit.

[Former Member · Accepted solution]

Dear Mr. Ruchit,

Lots of thanks,

It solved my problem. We are implementing SAP in my office.

Can you give some Tips & Tricks for user authorizations?

And please give some precautions about authorizations requried when any company is going for LIVE.

I am new in SAP.

Thanks & Regards

Kariyath

[Former Member · Accepted solution]

Hi Ruchit,

I am new in BASIS, your tips helped me to set Rolls for my users.

Thanks and regards,

Maruti Tathe

[Former Member]

Dear Kariyath,

Did you assign the transaction codes VA01,MIR0 etc in the authorization object S_tcode for the new role you have created in place of SAP_ALL. If so then did you logout and relogin after making the changes to the role.After making changes to user profile whether it is changing a role assigned to user or assigning him/her a new role

Further please explain what error message are you getting. Are you getting message that VA01 is locked(in transaction SM01) or is it an authorization error? In case you have authorization error execute transaction /nsu53 the moment you get authorization erorr. Then you will come to know what authorization you are missing.

I hope it solves the issue. Please let me know if this got solved . If issue persists will try to give another solution.

With Regards.

Ruchit.

[Former Member]

Dear Mr. Ruchit,

Thanks for your reply,

I missed to give the full authorization on Organizational Level. Seems now it is working fine. I asked the Func. Cosultants to check.

Thanks

Kariyath

[Former Member]

Hello Kariyath,

Some of tips I would suggest are:

1. Assign roles instead of profiles to users.

2. The roles that you are using can either be standard SAP roles or custom roles though I would personally recommend custom roles becasue you will have change roles from time to time. However you can model or infact even copy in certain cases custom roles from standard SAP roles.

3. For role creation take help of your functional team people. They will be able to help you in filling out various organizational unit values like company codes,plants,sales organizations in the role.

4. Further you need to understand what authorizations/roles have to be assigned to which set of users. For example for Finance module users you will have to assign Finance roles generally and not SD roles however this depends on the organizational structure of your company. May be you can create you own matrix for this purpose.

5. Regarding basis specific authorizations make sure that only basis team (this includes you) have access to these roles.

6. Avoid assigning SAP_ALL and SAP_NEW t normal dialog users. Ideally system users and super users like DDIC only should have SAP_ALL.

7. You can find more details in SAP Help for this.

Please let me know if you have any more questions. I would be glad to assist you.

Regards.

Ruchit.

[Former Member]

Dear Mr. Ruchit,

Thanks for your reply.

I already put one query regarding BW3.5 please help me for that.

Regards

Lal

[Former Member]

Dear Mr. Ruchit,

after blocking the SPRO my VA01, MIRO and some other transactions are blocked?

I give this TC on T_CODE Table. but still it is not working

What could I do for that ?

Pleaes help

Regards

Kariyath

[Former Member]

Use sm01 and lock spro

Raman