SAP IBP permission filter is not working for write access

[bkreddy]

Hi Folks,

We have a requirement to read global data but write to regional data, with permission filter, I can't control a user to restrict write regional data since it is allowing to read global data, also allowing him to make changes to other regions. If i restrict read and write regional only then its hiding other regional data so he can't make changes to it.

How can this be controlled with read-only global data but write to regional only?

Thanks,

[piyush_parekh · Accepted solution]

Hi,

Are you assigning permission filter to business users having "unrestricted" roles? Permission filters work in conjunction with business role restrictions. Make sure business roles that are assigned to these users should not have "Unrestricted" read/write access. Restrict the access at role level and then bring in data-level restriction using permission filter. Refer below note for more details:

https://launchpad.support.sap.com/#/notes/2446714

Hope this helps!!

Regards,

Piyush

[bkreddy]

Hi Piyush,

Thanks for your response. I created different business roles with regional restrictions with Write restricted and read unrestricted. Just got to know that, even with restricted write access, user will have full change access due to unrestricted read access.

"You have assigned a Permission Filter ID to the Write access of the role. And you set the Read access as Unrestricted or set the Permission Filter ID field of Read access as Unrestricted in the same role. In this case, there is an "Unrestricted" for Permission Filters - it means this role grants read/write access to everything."

in that case there is possibility with read global and write regional control.

[vincentverheyen]

Hi, where did you read about this bkreddy? Is this documented anywhere by SAP?