Restrict Company code access of users with SAP_ALL and SAP_NEW profiles

[Former Member]

Hi All,

How can we restrict Company code access of users with SAP_ALL and SAP_NEW profiles...?

We can restrict from Organizational level.

But is it possible to restrict the company code access of users with sap_all and sap_new profiles?

Need your suggestions.

Thanks and Regards,

Mathan A

[Former Member · Accepted solution]

Hi Mathan,

As you know, SAP_ALL contains access to pretty much everything...  Therefore you need to create new authorisations profiles for your users.  Good practice says that no users should have SAP_ALL in production systems anyhow.  I suggest that you talk to your SAP security team and get them to write the appropriate profiles.

Thanks,

Graham

[Former Member]

Hello Mathan,

You can not restrict company code access of users with SAP_ALL and SAP_NEW profile.

Please create new roles according to requirement and generate their profiles and add them to required users.

Please revert me in case any query.

Regards,

Shashanka

[JPReyes]

As mentioned by Graham you simply can't, you should create proper roles for those users.

Regards, Juan