How to restrict the access to truly display for some applications?

[SAPSupport]

Dear SAP,

We have a role containing tile 'My Purchase Requisitions' and other containing tile 'Display Purchase requisitions'.

When we assign both the roles to a user, user is able to edit all the purchase requisitions. Is there a way, we can restrict the access to truly display with both roles assigned to a single user?

Thanks.

------------------------------------------------------------------------------------------------------------------------------------------------
Learn more about the SAP Support user and program here.

[SAPSupport · Accepted solution]

Dear Customer,

In order to provide display access for both applications, you can restrict the Business Roles with "Write Access: No Access".

The authorization concept for business roles is based on the concept of granting authorizations (as opposed to denying them). By adding business catalogs to a business role and assigning the business role to a business user, you can control which applications the business user is authorized to carry out. As a next step, you define how the customer data can be accessed.

In the Maintain Restrictions UI, you can maintain restrictions for business roles. These restrictions are the basis of authorizations that are granted to the business users who are assigned to this business role. The business catalog defines which access categories are available for maintaining and for which fields restriction values can be maintained.

The following access categories are available:

• Write, Read, Value Help (write access)
• Read, Value Help (read access)
• Value Help (value help access)

If you set the "Write, read, value help" to "No access", this means that the role will be read only and therefore, the users will not be able to edit any data.

For more information, please check SAP Help Portal | How to Define Authorizations Based on Restrictions

Kind regards.