Access Rights in Development system

[Former Member]

Hi,

I would like to understand whether as a practice, access rights in development system also follow the same principle of need to know and need to do basis,

or generally all the users having access to development system are given the same access rights?

As only SAP support personnel or developers have the access to the system, Can the access to configuration (SPRO) be restricted to the respective relevant modules like MM consultants will have access only to the MM module and SD will have SD module etc.

I am also interested in understanding how the access can be restricted to the respective modules? i.e. what are the authorization objects relevant for this purpose?

Thanks in advance for any help.

Krishna

[Bernhard_SAP]

Hi Krishna,

also for Dev-systems it is strongly recommendable to be as restrictive as possible when granting authorizations.....

Developers should only be able to work on their particular projects....

b.rgds, Bernhard

[Former Member]

Hi,

Thanks for your help.

Still, as an example can SD consultants have the access rights to change MM configuration in development system? what is the general industry practice in this regard? I was told that SD consultants will have change access rights for only SD module configuration and display access rights for other modules, is this correct?

[Former Member]

Most implementations have wide access functional config roles letting people configure all modules. It's not great practice, but it is most common practice in the industry.

If you can, restrict config per function or process to give a bit of extra control

[Former Member]

In development system in almost all cases authorizations are not restricted in the way they are in a quality system or production system. A development system is used by consultants to do there customizing, programming, some tests. In most of the cases a programmer needs more than just the tools to program, a programmer also must do some tests, a SD consultant also must see some other transactions outside SD. Try to work with roles that are more than just 1 module. This will bring benefit to the speed of work, because nothing more frustating than working and every 5 minutes being blocked because of some missing authorizations. Also restriction isn't needed that tight in development because most of the times, there is not much data in.

[Former Member]

Hi Krishna,

Developers (ABAP programmers) should be only allowed to work in the development systems.

In case of your query, for MM, SD, the functional guys should be strictly restricted with very limited auth. in development systems.

Regards,

Sameer

[fredrik_borlie]

>

> I am also interested in understanding how the access can be restricted to the respective modules? i.e. what are the authorization objects relevant for this purpose?
> Krishna

The activities within the implementation mainly consists of one thing. Transaction codes. The tricky thing is to find out which transaction code to use, but... SAP have developed a smart tool where you define a project in SPRO_ADMIN and there you assign activities by selecting nodes from the IMG. This can then be inserted into a role via PFCG.

You will find many hits that give you tips on how to work with it if you search in the forum!

Regards

Fredrik