Disable or restrict access to an App in S4HC

[briggsalan]

Hi, I am getting to know S4HC well as an administrator of the solution for our business, but I will be the first to admit I am well out of my depth when it comes to restrictions. If I want to block access to an application/tile, at the moment I tend to look for the app in the applications reference library, take a look at the catalogs or roles that the app belongs to, and see if I can take the catalog off the user(s) by way of customising the role or removing the role. It's not straight forward for me to get my head around to be honest.

I have now become really stuck though with the "Release Blocked Invoices" app/tile. It is not seemingly an application in a role/catalog? It's also an old SAP GUI application it seems.

Question is, where do I start with regards to trying to remove this from a set of users? Thanks in advance

[JulianoRomanato]

Hello alan.thompson3.

How are you? I have excluded the Tag "SAP S/4HANA Cloud for Central Procurement" and included the Tag "SAP S/4HANA Cloud for Finance" for this question, as Invoices are Objects of Finance Line of Business.

Regards.

Juliano Romanato.

[adrien_delanoe]

Hello,

Wwe are having a similar issue with our customer.

For instance, for specific sales profiles, they want to enable access to Product Master Data's Distribution Chain, but want to diable access to General fields (including 'Cross-Plant Product Status' for instance).

We've tried to achieve this by creating a different, dedicated, app but they still have access to the original Manage Product Master Data app. In that case, it's not a matter of Business Catalog since it is not specific enough.

Any idea on how to achieve this?

Many thanks,

Adrien

[Enda · Accepted solution]

Hi @briggsalan

I checked in an internal system and the app Release Blocked Invoices is included in the standard roleSAP_BR_AP_ACCOUNTANT which includes the business catalog SAP_MM_BC_INV_RELEASE_PC

In the app Business Catalog -for this catalog SAP_MM_BC_INV_RELEASE_PC you can see on your system where this catalog is used ( which roles )

Yes , the app is based on a SAP GUI transaction MRBR

https://fioriappslibrary.hana.ondemand.com/sap/fix/externalViewer/#/detail/Apps('MRBR')/S29

In the app Maintain Business Roles you can see to which users the role is assigned.

If you want to prevent access to the app you could use the app Maintain Business Roles for the role SAP_BR_AP_ACCOUNTANT and check the tab "Assigned Business User" and remove the role for the users who should not have access to it.

The alternative is to use the Maintain Business role app for role SAP_BR_AP_ACCOUNTANT and remove the catalog SAP_MM_BC_INV_RELEASE_PC from it .

Create a New custom role - ZAPPRELEASEBLOCKINVOICES for example and assign the catalog SAP_MM_BC_INV_RELEASE_PC to that instead.

For the users who should only access the app then you can assign them the custom role

Best Regards

Enda

[briggsalan · Accepted solution]

Many thanks Enda, how did you find out it was part of the catalog "SAP_MM_BC_INV_RELEASE_PC" - I could not get to that information using the app reference library? Not sure where I was / am going wrong?

EDIT! NEVER MIND, GONE BACK IN AND TRIED AGAIN I NOW SEE THE SAME. I DO NOT KNOW HOW I WENT WRONG!