Data Locking Ownership in SAP Analytics Cloud: Lessons Learned and the Need for a Master Lock

[Igor_Kamenetsky]

Introduction

SAP Analytics Cloud (SAC) offers a wide range of tools for enterprise planning, including Data Locking Ownership (DLO), which provides powerful control over who can allow modification of specific parts of your data. As organizations scale and planning processes become more complex, the need to manage data across multiple hierarchical levels becomes essential for ensuring data integrity.

In one of our recent projects, we explored the DLO functionality in depth. We needed to secure data at multiple levels, ensuring that different stakeholders had appropriate control at the right time. While SAC provides robust capabilities in this area, we identified a particular requirement that would further enhance its utility in large, hierarchical organizations — allowing for a “master lock” that applies across all levels of an organization.

In this post, I will walk you through the problem we faced step-by-step, explaining how data locking works at different stages, from simple scenarios to more complex, hierarchical setups. Let’s begin by laying out the problem in more detail and explaining how it evolved across three different cases.

The Problem: Managing Data Locks Across a Hierarchical Organization

In our project, each Planner was assigned a specific Cost Center, and as the planning cycle progressed, Department Controllers were responsible for locking the data to prevent further changes. However, when the planning cycle reached its conclusion, a Group Controller needed to apply a final lock on all data, ensuring that even Department Controllers could no longer unlock or modify any data.

Below is a high-level diagram that represents how the hierarchical locking process works:

While SAC's current Data Locking Ownership (DLO) feature allows users to manage data locks at multiple levels, we discovered that once a Department Controller locked data, they still retained the ability to unlock it — even after the Group Controller had applied a final lock. In highly structured organizations, this limitation posed a challenge in ensuring that once the planning process was finalized, no further changes could be made.

Currently, there are no further data locking features on SAP’s roadmap, making it even more critical for organizations to adopt creative workarounds like the one described in this article.

Now, let’s break down this problem step by step across three cases.

Case 1: Simple Scenario with No Data Locking Ownership

In the simplest configuration, Planners are responsible for entering data for their assigned Cost Centers. Each Planner has full authorization to modify the data for their node, without any restrictions.

This setup works well in smaller-scale planning environments, where the number of users and the need for centralized data control is minimal. However, as organizations grow and the number of contributors increases, managing data changes becomes more complex. At this stage, there is no concept of data locking ownership or hierarchical data control.

Case 2: Introducing Data Locking Ownership at the Department Level

In more complex environments, organizations need to introduce oversight over multiple Cost Centers. In Case 2, we introduce a Department Controller who oversees the Planners for each Cost Center under their department. At this point, we leverage the Data Locking Ownership feature to provide additional control.

Here, the Department Controller becomes the data locking owner for their department, which gives them the ability to lock and unlock data for all Cost Centers under their control. According to SAP documentation on Configuring Data Locking​, when data locking is enabled, ownership is defined by dimension (in this case, the Department Controller) and the hierarchy determines the level of control.

Now, it’s important to introduce two key concepts from SAP’s Data Locking Ownership functionality:

• Data locking owner: A user assigned ownership over a specific dimension, allowing them to lock and restrict changes to data.
• Data locking manager: A user who can lock and unlock data at lower levels within the same hierarchy.

Both the data locking owner and data locking manager roles are determined by the same DLO permissions but depend on where the user is positioned within the hierarchy. Data locking owners can apply locks in one direction—from Open to Restricted or from Restricted to Locked — but cannot reverse the locks without being the data locking manager. The data locking manager can unlock the data when necessary.

This structure offers a higher level of control compared to Case 1. The Department Controller ensures that data entered by Planners cannot be changed once locked, safeguarding data during the planning process while still allowing for flexibility when last-minute adjustments are required.

The image below illustrates the results of tests conducted by me in SAP Analytics Cloud to better understand the behavior of Data Locking Ownership (DLO) in hierarchical Cost Center dimensions.

As you can see in test results, if a Department Controller is assigned Data Locking Ownership at a higher-level node (e.g., a department), they can lock and unlock all child nodes under their control. However, if they are assigned only to a leaf node (e.g., a single Cost Center), their control is limited, allowing only the locking of data without the ability to unlock.

Note: It's important to highlight that in a multi-tier landscape (e.g. Development, Test, and Production environments) DLO settings do not limit SAP developers in the Development environment, where their elevated rights override lock configurations. For the purposes of demonstrating real-world scenarios and limitations, all tests presented in this article were conducted in the Test environment, where DLO restrictions apply as they would for regular end-users.

For more on how SAP’s Data Locking Ownership works, refer to the detailed explanation in SAP's official documentation: https://help.sap.com/docs/SAP_ANALYTICS_CLOUD/00f68c2e08b941f081002fd3691d86a7/e07d46e950794d5a928a9...

Case 3: Applying a Master Lock at the Group Level

Finally, in Case 3 we introduce a Group Controller at the Total Group level, adding another layer of hierarchy to our data management process. The Group Controller's role is to apply a final, “master lock” over all data at the conclusion of the planning cycle, ensuring that no further changes can be made by the Department Controllers.

In this setup, Department Controllers can lock and unlock data within their scope, but the Group Controller needs to apply a lock that overrides all other permissions. This master lock would secure the data across the entire organization, preventing any changes once the planning phase is finalized.

While SAC provides strong delegation of locking permissions across dimensions, the current implementation of Data Locking Ownership doesn't allow for the Group Controller to enforce a lock that Department Controllers cannot override.

In our case, the Group Controller needs a way to ensure that once they apply the lock, it cannot be reversed by anyone at a lower level. However, SAC does not currently offer a configuration or parameter that can enforce this restriction at the Group Controller level.

In our case, the Group Controller needs a way to ensure that once they apply the lock, it cannot be reversed by anyone at a lower level. However, SAC does not currently offer a configuration or parameter that can enforce this restriction at the Group Controller level.

Our Solution: Managing Data Locking Ownership with Planning Versions

To meet the requirement of preventing Department Controllers from unlocking data after the final lock, we implemented a straightforward solution.

• Each planning cycle is tied to a unique Planning Version in SAP Analytics Cloud.
• At the start of the cycle, Department Controllers are assigned Data Locking Ownership (DLO) for their areas within that version, allowing them to lock and unlock data as needed.
• At the end of the cycle, the Group Controller raises a request to IT Support. IT then removes the DLO permissions from the Department Controllers for that specific version. Once the DLOs are removed, Department Controllers can no longer unlock the data. This final step ensures that the planning version is locked for good, preventing any further changes after the Group Controller’s approval.
  This final step ensures that the planning version is locked for good, preventing any further changes after the Group Controller’s approval.

This solution effectively provides the "Master Lock" functionality by combining SAC's DLO capabilities with IT support intervention at the end of the planning cycle.

Conclusion: The Value of Enhanced Hierarchical Control in SAC

SAP Analytics Cloud provides an impressive array of tools for managing data integrity, and its Data Locking Ownership feature is no exception. As shown in Case 2, the ability to delegate control of data locks to different users within an organization is a powerful feature that adds flexibility and security to the planning process. However, in large, hierarchical organizations with more complex planning requirements, the ability to apply a master lock that cannot be overridden by lower-level users would greatly enhance the system’s robustness.

Our project revealed the need for this additional functionality, and as a result, we found an SAP Customer Influence request addressing this need and supported it with our votes. If your organization faces similar requirements, I encourage you to review the Customer Influence request here https://influence.sap.com/sap/ino/#idea/264219 and consider voting for it. Your feedback can help drive the development of enhanced hierarchical control in future versions of SAC, making this already powerful tool even more effective.

References

SAP Help: https://help.sap.com/docs/SAP_ANALYTICS_CLOUD/00f68c2e08b941f081002fd3691d86a7/e07d46e950794d5a928a9...

SAP Learning: https://learning.sap.com/learning-journeys/leveraging-sap-analytics-cloud-functionality-for-enterpri...

Customer Influence request: https://influence.sap.com/sap/ino/#idea/264219

SAP Analytics Cloud SAP Analytics Cloud for planning 

[hgledhill]

Hi @Igor_Kamenetsky,

Thanks for this write-up and highlighting the customer influence request. It is a frustrating limitation in SAC, and unfortunately since I raised the request, no progress has been made. I hope it sees some attention from SAP soon.

Thanks,

Hugh