Separete user in same client to different company codes.

[former_member1133672]

Hello Gurus,

My company was divide in two new compoanies, and the logical separation is complete.

Now I need to separet the users in the same client to see only masterdata from your related company.

Ex. User from company 1 only see master data from Company1
User from company 2 can't see data from Company 1.

I do some configurations in the roles, including the field BURKS in our Plant roles(separedted by WERKS) but in major cases the transaction can't search the BURKS in other role.

I can segragate this users by other way ?

*PS. I don't find other topic for this question.

[TammyPowlas]

I recommend starting by looking at transaction SUIM, and then you can look at the roles you assigned, by authorization object *buk* - each of those roles will need to be updated/separated by company code.

I think this would be a good start to the security analysis

[former_member1133672]

Nice, all the roles with *BUK objects need to be duplicated to both companies ? Or I can define the BURKS field in one place to using like a key to access?

[kaus19d]

Hi Leonardo Lorençoni,

It is obvious that at some point both will have some common Master data. if there is a change in functional location occurs, you need to open and save all functional location to get the same update, so this will be huge process

For example,

Warehouse is assigned to plant / storage location combination in:

SPRO > Enterprise Structure > Assignment > Logistics Execution > Assign warehouse number to plant/storage location (V_T320)

In case you have done some identification, then there would be necessity of creating seperate Roles. My suggestion would be since you have decided to use in the same client, same system, then you need to segregate/identify the Users that would use the new Company code. Well the role assignment can be checked via SUIM, considering that the new Company Code you have yet not started defining

For you knowledge, You can check the table T001 for Company codes. Please also check the below,

https://answers.sap.com/questions/2927610/which-table-contains-both-company-code-and-plant.html

https://answers.sap.com/questions/1013514/werks-bukrs-link.html?childToView=1013768#comment-1013768

https://answers.sap.com/questions/10366759/list-of-users-assigned-to-company-code.html

For SAP User-Id & Company Code relation, you can check Table USRM1, USRMM

Thanks,

Kaushik

[mayankbabujain]

If i understand right, you question is about the t-codes that are not related to organization levels like company code, plant etc...

if yes, role change may not help without some other customizing. for example you can maintain a table for to identify the company of user and then allow him/her to access certain t-codes.

but that may not be good for long term. after separation completed, both company should have different systems and database and then above customization will need to be revert.