- SAP Managed Tags:
Introduction
In my previous blog Your Sherlock Holmes - Why a Fiori App Cannot be Found in the SAP S/4HANA Cloud Public Edition?, I discussed the tight binding of business catalogs and business roles and its direct impact to user’s access to the system. While writing a new blog From A to Z: Setup a Starter System of the SAP S/4HANA Cloud Public Edition [2024 Edition], I experienced another challenge in this regard: I was denied doing business process configuration. Here is the story to share with you.
Scenario
Recently I set up two SAP S/4HANA Cloud Public Edition systems, one is the Starter System and another one is the 3 System Landscape (3SL) system. It went smoothly for all scope activation, organization structure setup, and the final milestone confirmation. However, when I start doing the Product-Specific Configuration, the system takes me to the Customizing Tenant 100 without any problem, but I got the below error message. By the way, I do have the BPC_EXPERT user role assigned.
Error: No authorization to start the UI for transaction S_ER1_83000079
This not just happened to a few business processes, but all of them. What went wrong?
Configure Your Business Processes in the Central Business Configuration Tenant
Investigation
Naturally, I investigated the user authorization in the Customizing Tenant 100. The ZBR_BPC_EXPERT user role was copied from SAP business role template SAP_BR_BPC_EXPERT, and it was assigned to me.
Business Role ZBR_BPC_EXPERT
There is one area caught my attention: there are only 109 Business Catalogs in this business role. In comparison, other systems have 220+ business catalogs for this BPC_EXPERT role. Why do I have only a half of business catalogs? I can manually do a comparison and add them in. But it is tedious.
One of my colleagues asked me a critical question at the time: when did you create your ZBR_BPC_EXPERT business role? From my vague memory, I remembered I did the business role creation after the CBC milestone was confirmed. Is my memory correct?
The business role ZBR_BPC_EXPERT change log (by click on Display Changes button in the above figure) shows the role was created on October 22, 2024 at 18:20:04.
Change Log of the Business Role ZBR_BPC_EXPERT
To find out when the business catalogs became available, I need to check the CBC Staging transport. By opening the Fiori app Export Customizing Transport, it lists three transports. The oldest one G6IK900007 is for initial configuration. That is the one I am looking for.
Fiori app Export Customizing Transport
Opening the transport G6IK900007, then click on Display CBC Staging button, we can see exactly when this transport content was created.
Note: on this screen, it shows Changed on 11/05/2204, because I did a Check on this transport. So, this time stamp can no longer provide the creation date information I am looking for. That prompts me to go deeper to find out the original transport creation date and time by clicking the Display CBC Staging button.
Details of Transport G6IK900007
The CBC Staging screen displays the detailed time information I am looking for. This staging transport was created on 10/23/2024 at 15:30:25, and completed (another Changed) on 10/23/2024, at 20:56:14.
Note: In my blog From A to Z: Setup a Starter System of the SAP S/4HANA Cloud Public Edition [2024 Edition], I mentioned it took more than six hours for the milestone confirmation to complete. The above timestamp indicates the transport creation took 5 hours 26 minutes.
BC Staging Information
Now I found the cause of the problem: I created the business role ZBR_BPC_EXPERT one day earlier than the CBC Staging transport was created. In other words, not all the needed business catalogs were available at that time. That’s why ZBR_BPC_EXPERT only contains 109 available business catalogs, not 200+.
Here is a quick explanation on what Milestone Confirmation (activity Confirm Scope and Organizational Structure Phase is Completed) does on the CBC tenant. After you activate the scopes, set up the organization structure, you confirm the milestone. At this step, it transfers all the necessary information based on your configuration from the CBC to the S/4 Customizing Tenant 100, all needed business catalogs and business role templates become visible. Subsequently, the Customizing Tenant 100 puts all this configuration information, including business catalogs and business role templates into the BP staging transport so that they can be transported to the Test Tenant and Production Tenant subsequently. On a new Customizing Tenant 100 before this BC staging transport is created due to milestone confirmation, there are only a limited number of business catalogs and business role templates.
In our case, the business role template SAP_BR_BPC_EXPERT was available but only contains 109 business catalogs. The number of business catalogs is increased after the milestone is confirmed. When I created a user role ZBR_BPC_EXPERT ahead of time, it only contains the available 109 business catalogs. This is the root cause of my authorization error when doing work process configurations.
Solution
Now we need to update the business role ZBR_BPC_EXPERT. We do this by using the Fiori App Business Role Templates. Within this app, we select Different From Business Roles in the filter Show Business Role Templates. Then hit Go button. Now we see there are three role templates different from roles copied from them, including template SAP_BR_PBC_EXPERT.
Find Out Business Role Templates different from Business Roles
By clicking on the arrow at the end of row SAP_BR_BPC_EXPERT, we find there are 223 business catalogs. Hooray!
To fix the problem, click on the Business Roles tab. Here you can see I have three business roles all copied from the same template SAP_BR_PBC_EXPERT, but only one role ZBR_BPC_EXPERT is different from the template. Note: the other two roles were created later after CBC milestone was confirmed.
After selecting the role ZBR_BPC_EXPERT and click on the Compare -> Business Catalogs button, a comparison screen shows up. Most probably you need to scroll down the list to expose those business catalogs not included in the role yet.
Compare Business Role ZBR_BPC_EXPERT with Its Template
After finding those missing business catalogs, you can individually select those business catalogs you need and then hit the Save button, or just hit the Apply All button to include all available business catalogs. In my case, I need all of them.
Add More Business Catalogs to a Business Role
Conclusion
From above investigation we learned that not only assigning a business role to a user is important, but “when” the business role was created is also important. If we create a business role too early before all business catalogs are available, we might not get sufficient authorizations. However, this problem can be resolved by synchronizing your business roles with their relevant templates.
It also worth pointing out that after a major upgrade, the business catalogs within a business role template might be changed. You need to update the business roles with the latest templates accordingly.
