Authorization to limited Master data to Users

[Former Member]

Dear Experts,

We have a requirement from our client with regards to Authorization of Master data

Example:Indian users can only able to access Indian company code data (Vendor,material or customer data) means they cannot be able to see foreign vendors or customers,is there any way in Sap we can meet this requirement.

Thanks

Vijaya Rebala

[former_member183424]

Can you tell us what is the different between your Indian Master data and Foreign Master data ?

How you will find the differences in SAP system ?

[Former Member]

Hi Dev,

Thanks for the response ,the requirement is the company is spread over 24 countries the client does not want the data of the foreign company codes to be seen by any Indian business users in sap system.

Thanks

Vijay

[former_member183424]

I am able to understand your requirement.

I am asking for the differences between Indian Master data and Foreign Master data in your SAP system.

How can you find that the vendor X if for India and vendor Y is for Foreign ?

[Former Member]

Hi Vijay,

It is possible through master data setup and through authorizations by building roles based on different org values which would be separator for your indian master data and foreign master data.

For example.

If you have company code 2040 for indian setup and 3040 any foreign setup, you can do this in SAP.

You need to have separate definition of master data items to control them through authorization object.

BR,

Mangesh

[pmuschick]

Mangesh is right. The procedure would be the following:

1. Identify all master data objects which should be restricted

2. Analyse if there is a number range used for each seperate part of the data (indian and non-indian in your case). Create a master data overview to know which customizing object ranges or IDs belong to which country.

3. This step depends on your role concept: identify the dedicated roles and change them - example: if you have central definitions of workplaces for users in your roles, then you could create derived roles from them and differentiate via org-levels. If an org level is missing, then you can still change this to an org level. Every role change is then "rolled out" via one click in all derived roles.

[Former Member]

Hi

Thank you all for your prompt reply.