https://community.sap.com/t5/technology-q-a/difference-between-iam-restriction-fields-and-restricting-users-with-iam/qaa-p/12750048#M4785674 <P>Hello Ruchir,</P><P>the difference is how the access to the business service is provided:</P><UL> <LI>Authorizations defined as part of IAM app are based on activities: <A href="https://help.sap.com/docs/btp/sap-business-technology-platform/providing-access-based-on-activities-for-business-users?version=Cloud">Providing Access Based on Activities for Business Users</A></LI><LI>Authorizations defined as part of restriction types are based on (restriction) field values: <A href="https://help.sap.com/docs/btp/sap-business-technology-platform/providing-access-based-on-field-values-for-business-users?version=Cloud">Providing Access Based on Field Values for Business Users</A></LI></UL><P>Hope this clarifies what is the difference.</P><P>Best regards<BR />Peter</P> Tue, 22 Aug 2023 14:32:39 GMT peterpersiel 2023-08-22T14:32:39Z https://community.sap.com/t5/technology-q-a/difference-between-iam-restriction-fields-and-restricting-users-with-iam/qaq-p/12750047 <P>Hi,</P> <P>Based on the documentation online, it is apparent that in order to restrict the application usage, the Authorization Object comes into picture at 2 places:</P> <OL> <LI>Values maintained within the IAM App, to filter on the values retrieved based on the user’s authorization ( or * for all authorization)</LI> <LI>AUTHORITY-CHECK statement within the Behavior Definition Class, which checks against the values maintained in the IAM App.</LI> </OL> <P>Keeping the above 2 in mind, how do the Restriction Types, available in the Business Roles under Maintain Restrictions, which also use the Authorization Objects, differ in their use from the above 2 points. Is there a difference in use case for the 2, or how can they be used together?</P> <P> </P> <P>I went through the following 2 blogs:</P> <P><A href="https://developers.sap.com/tutorials/abap-environment-access-mgmt.html">https://developers.sap.com/tutorials/abap-environment-access-mgmt.html</A></P> <P><A href="https://blogs.sap.com/2021/07/15/custom-roles-and-authorizations-in-sap-btp-abap-stack/">https://blogs.sap.com/2021/07/15/custom-roles-and-authorizations-in-sap-btp-abap-stack/</A></P> <P>However, these 2 links are insufficient to help explain the difference in the use-case between the 2.</P> <P>Thanks in Advance.</P> Tue, 22 Aug 2023 14:12:50 GMT https://community.sap.com/t5/technology-q-a/difference-between-iam-restriction-fields-and-restricting-users-with-iam/qaq-p/12750047 ruchirsaxena 2023-08-22T14:12:50Z https://community.sap.com/t5/technology-q-a/difference-between-iam-restriction-fields-and-restricting-users-with-iam/qaa-p/12750048#M4785674 <P>Hello Ruchir,</P><P>the difference is how the access to the business service is provided:</P><UL> <LI>Authorizations defined as part of IAM app are based on activities: <A href="https://help.sap.com/docs/btp/sap-business-technology-platform/providing-access-based-on-activities-for-business-users?version=Cloud">Providing Access Based on Activities for Business Users</A></LI><LI>Authorizations defined as part of restriction types are based on (restriction) field values: <A href="https://help.sap.com/docs/btp/sap-business-technology-platform/providing-access-based-on-field-values-for-business-users?version=Cloud">Providing Access Based on Field Values for Business Users</A></LI></UL><P>Hope this clarifies what is the difference.</P><P>Best regards<BR />Peter</P> Tue, 22 Aug 2023 14:32:39 GMT https://community.sap.com/t5/technology-q-a/difference-between-iam-restriction-fields-and-restricting-users-with-iam/qaa-p/12750048#M4785674 peterpersiel 2023-08-22T14:32:39Z