Roles to be removed from multiple users in BI

[Former Member]

How can we delete all roles for nearly 700 users when I do it with SU10 it is not working, it gives "NO changes made to user XXXX" I checked remove and Change box

[Colleen]

You need to match validity dates from table agr_users. If removing same role from all then paste your use in su10 and go to change/roles/remove. Copy the role, valid from and to dates from the table. You may have multiple roles but different dates.

also make sure you aren't attempting to remove a single role that belongs to a composite

[Former Member]

Thanks Colleen,

Yes I m removing composite role. However I tried above steps but still its not working. Now I am removing roles using SU01 700 times for 700 users.

Still waiting for short cut.

[Colleen]

Hi Tufail

There is not straight standard function to do what you are trying to do. I've just explained why SU10 didn't remove the roles for you

As Julius has mentioned there are BAPIs but you would need to do development. I've written an ECATT before to loop through SU10 to remove (1 user and 1 role for each iteration).

If this activity is more regular, you might want to consider getting something developed. Maintaining 700 users to looks for a specific role to remove doesn't look like fun.

Regards

Colleen

[Former Member]

This option does not exist in the standard as the role names will differ in 700 different combinations.

However there are BAPIs for the user admin, so it is quite safe to model it and loop through the selected users.

Another alternative is to nuke the roles themselves and then sync the user tables to remove the assignments - but then no one has the roles anymore.

Cheers,

Julius

[shivraj_singh2]

Tufail,

Two questions and then some thoughts:

1) Are you using CUA ?

2) ""NO changes made to user XXXX" - is it saying for all 700 users ?

Thoughts:

Trying to remove multiple roles from 700 users (700 x n ~ several 1000 assignments) using SU10 may not work. Please break down your users set into some smaller sets and then try it. Also make sure you are entering the dates correctly (as mentioned by Colleen Lee). Also make sure no role is locked in change mode while you are running SU10.

More reliable solution will be using the BAPI (as mentioned by JVD), you can use BAPI_USER_ACTGROUPS_DELETE (I think) to delete all role assignments. Or use BAPI_USER_ACTGROUPS_ASSIGN but pass an empty table of roles.

Easy way out: Take a dump of AGR_USERS (be aware of the composite/single roles i.e. remove the single roles that assigned through composite roles) and give it to you QTP person, write a simple SU10 script for removing 1 role for 1 user at time (should not take him more than 20 min) and let it run in small batches of 50~100 users at time. Meantime you can keep looking at AGR_USERS to ensure assignments are getting removed.

Regards,

Shivraj Singh

[Former Member]

This message was moderated.

[Former Member]

Hi Tufail,

You can remove all roles using SU10 by following below steps.

01. Insert all 700 users in SU10 User tab

02. In roles tab, enter all roles assigned to users which you wish to delete.

03. Enter 01.01.1900 Start Date & 31.12.9999 End Date.

     Start date should be the earliest Role assignment start date amongst all users  - 1, so that all roles assigned are captured in the date criteria and removed completely.

03. Select Remove from Roles and Profile's Tab and Save.

04. If you are performign this activity in CUA, please check SCUL for unprocessed IDOCs.

Regards,

Atul