Limitting payroll t-code access

[snursalim]

Hi expert,

I have a problem for restricting authorization for user for payroll t-code.

Apparently, some user is only allowed to ru offcycle payroll. So for example, for t-code "PC00_M34_CALC", user should only be able to run offcycle payroll so on the field declaring payroll type, they should only be able to enter 'A' -> offycle payroll.

I couldn't find a way to solve this through authorization object, so far my only found option is to manipulate the transaction selection screen.

I tried to use transaction SHD0 to manipulate the screen for the t-code, but apparently, transaction variant for t-code "PC00_M34_CALC" can not be made. Therefore I tried to play with variant by:

1. making the payroll type field is not inputable and automatically set 'A'

2. Protect the variant so it couldn't be changed by people except me

3.and then save the variant as customer variant "CUS" so that it could be transported.

After that I created a new T-code let's say Z'' where the default variant "CUS" is used for the t-code.

Problem arises as user has access to variant, they could create another variant, save it and then use it to open all access. Is there any way to limit either:

1. User has no access to variant creation

2. T-code couldn't be run except by a certain variant

Is there a way to solve my problem?

I'm open to any other possible solution to solve this problem.

Thanks in advance

[snursalim]

Use authorization object S_PROGRAM.

For the field P_ACTION do not include 'VARIANT'