Securing Business Partner (BP) Master Data in SAP S/4HANA: A Guide to Field-Level Authorization

[MaheshSegyam]

Problem Statement

When we have MDG implemented for supplier and customer. All the master data changes for supplier and customer must go through the MDG workflow process and data must not be editable in S/4 system directly, however, there are a few exceptions where specific fields must be managed directly in S4. Due to this we must build our S4 role in such a way that all the MDG managed data / fields must be restricted only to display and only S4 managed fields should be editable.

Implementing The Solution:

Usually in S4 all the business partner data is managed through either transaction BP or the Fiori app F3163 - Manage Business Partner Master Data. The solution we are going to discuss here only works with transaction code BP but not with Fiori apps.

Preparing a requirement matrix:

We should start with identifying which fields / data is MDG managed vs S4 managed. To get this, we should work with the master data team. They can help us with identifying the field level requirements like below with reference to master data dictionary.

Technical Filed Name	Business Name	MDG/S4
KNA1.NAME4	Attention (aka Name 4)	S4
KNBK.BANKL	Bank Number	S4
ADRC.STREET	Address Line 1	MDG
KNA1.KDKG1	Customer condition group 1 (Line discount)	S4
KNA1.KDKG2	Customer condition group 2 (Multi line discount)	S4
KNBK.BANKN	Bank Account Number	MDG
KNBK.BANKS	Bank Country Key	MDG

Preparing role matrix:

Now we should prepare a role matrix in line with identified S4 managed fields / data

Technical Filed Name	Business Name	Role1	Role2
KNA1.NAME4	Attention (aka Name 4)	X
KNBK.BANKL	Bank Number	X
KNA1.KDKG1	Customer condition group 1 (Line discount)		X
KNA1.KDKG2	Customer condition group 2 (Multi line discount)		X

 Identifying the field group ID:

Next step is to Identify the field group IDs, which will be used in authorization object (B_BUPA_FDG) to restrict the access to fields.

 Steps: 

• Go to SE16 transaction
• Enter table name “TBZ3R” and execute
• Filter out using technical filed name

Marking fields as authorization relevant:

In system not all BP fields are authorizations relevant by default. Hence, first we must make all identified fields (Both MDG and S4 managed fields) as authorization relevant.  

Steps:

• Go to BUCN transaction
• Click on “New Entries”
• Enter the field group IDs identified in earlier
• Click on save
• Once you click on save system to prompt to create a transport to capture these changes. We need

to move this transport (along with the role changes) across the landscape to reflect the changes

Adjusting Role Authorizations:

The first line of security when working with transaction code BP is at BP role type using B_BUPA_RLT authorization object (example: Customer, Supplier etc.). Then comes the field level security restrictions using authorization object B_BUPA_FDG. This is where you will enter the field groups which should be editable for this role.

Conclusion:

All these configurations and restrictions only work with transaction code BP but not with the Fiori Apps. Hence, only assign transaction code BP to the role and adjust the B_BUPA_RLT object as needed to provide access to required BP role type (example: Customer, Supplier). Then using authorization object B_BUPA_FDG we can restrict the role with display/change access to required fields. We must restrict all the MDG managed fields in S4 roles to display access only otherwise, the role gives access to fields which would bypass any MDG workflows. 

Security   SAP HANA   SAP Master Data Governance   SAP S/4HANA business partner