Off-limits: Blocking User Access to a Storage Location in SAP Below is a snippet from one of hundreds of articles available to ERPtips subscribers. If you would like a complimentary copy of the full article, please email
[email protected] (include the title of the article in your email) To subscribe to ERPtips, go to www.ERPtips.com/Subscribe.asp. ERPtips Journal is published by Klee Associates, Inc. ERPtips University provides both public and onsite training for SAP clients. For more about ERPtips University, including the current schedule, click here: www.ERPtips.com/WorkshopSchedule.asp
Off-limits: Blocking User Access to a Storage Location in SAP Editor`s Note: In the business world, we often have to set boundaries and restrictions for staff. At first blush that may sound like we don`t trust our staff. However, these decisions are not ours, and perhaps not even those of management. Many of these result from government compliance or auditor requirements. And while they may appear to question the integrity of staff, they`re actually there to protect them. One such requirement that you may face is that of blocking user access to storage locations. This can be a little tricky if you've never done it before, but with Maria Nikolova as your guide, you`ll have it done in no time.
Click here to read this Snippet
June/ July 2008 Volume VI Issue 3
Transaction
Code
Description
MB01
Post Goods Receipt for Purchase Order
MB02
Change Material Document
MB03
Display Material Document
MB11
Goods Movement
MB1A
Goods Withdrawal
MB1B
Transfer Posting
MB1C
Other Goods Receipts
MB31
Goods Receipt for Production Order
MB51
Material Doc. List
MBST
Cancel Material Document
MI10
Create List of Differences without Document
MIGO
Goods movement
MSC2N
Change Batch
Figure 3: Some MM Transaction Codes for Which Object M_MSEG_LGO Is Checked
Let the Customization Begin
Customizing the authorization check setting happens in two ways: perform customization in the development system and then transport it via the standard transport system.
SAPtipsJournal
Page
SAPtips4On Logistics/MM
Customization Method 1 – via IMG Path The authorization check for storage location can be defined via IMG path: Materials Management ‡Inventory Management and Physical Inventory ‡ Authorization Management ‡Authorization Check for Storage Location.
Figure 4: IMG Path /Transaction Code SPRO (Customization Method 1)
See where you can define the authorization control via flagging on the “Authorization” option for individual storage locations in Figure 4. By setting this, you can maintain the authorization object M_MSEG_LGO to restrict the entry of goods movement in the storage location for a particular movement type. Via this authorization object, you protect the goods stored in a particular storage location.
Customization Method 2 –via Transaction Code SM30 To do the same customization directly (without following the IMG menu path), start transaction code SM30 and enter view V_001L_B in the Table/view field (see Figure 5). On this screen, click on the Maintain button; this leads you to the screen for customizing the activa-
SAPtips.com
SAPtips © 2008 Klee Associates, Inc.
June/ July 2008 Volume VI Issue 3
tion of the authorization check for storage locations. Keep in mind that the view V_001L_B is not cross-client (not a global customization). That means you must transport the customization in every client for which you want to have the setting. The screen for customizing the activation of the authorization check for storage locations is shown in Figure 6. In the last column of the view V_001L_B, the MM consultant has to set the authorization check for a storage location, and we are Figure 5: Maintain Table Views Screen /Transaction Code SM30 (Customization Method 2) going to set access restrictions for it. Determine the field LGORT, the user access is not restricted to storage users who need to access a storage location. Specify who location 0088. The restriction is only valid for storage is going to access each storage location. location 0001. So we see that M_MSEG_LGO does not stop you from posting to a storage location if table view This screen is valid for both methods – CustomizaV_001L_B has no authorization check set. You do not tion Method 1 and Customization Method 2. have to set anything if you do not need an authorization check per storage location.
Determine the users who need to access a storage location.
SAPtipsJournal
Page
SAPtips4On Logistics/MM
Note: The Profile Generator tool is central to generating authorizations and authorization profiles. It lets you configure job roles for users throughout the company.
Pass It On
After you customize table view V_001L_B, you must transport it from the development system to the production system of your enterprise. In the main screen of transaction code SM30 (Figure 5), click on the Transport button. The system asks you to enter a Change Request (Figure 7).
The customizations shown in Figure 6 dictate an authorization check for storage location 0001, but not for storage location 0088. So, if the authorization consultant working with the Profile Generator tool (transaction code PFCG) enters the values 0001 and 0088 in the field of authoriFigure 6: Screen for Activating the Storage Location Authorization Check for Authorization Object M_MSEG_LGO zation object M_MSEG_LGO, /Transaction Code SM30/
SAPtips.com
SAPtips © 2008 Klee Associates, Inc.
