Restrict users from editing a parked invoice

[ornecogli]

Hello everyone,

I am working on SAP S/4HANA Cloud Public Edition, and my client needs to restrict the possibility of editing parked invoices for some users. They don't use an approval workflow and don't want to, so I need to know if it's possible to add a restriction in a role to achieve that. If yes, what would be that role and that restriction? Or do you now another way to do it?

Thank you in advance and best regards,

Ornella

[Chuma]

Hello @ornecogli,

The recommended approach is to control app access (read versus write) through business roles and/or utilise Flexible Workflow for posting approvals.

SAP KBA 2598733 explains setting restrictions in roles, covering Read/Write/Value Help and restriction types. It is the main reference for role restrictions, noting no 'Invoice Status” restriction for supplier invoices. SAP Support Portal-KBA-2598733 - Maintain Restrictions in Business Role

SAP Help – Supplier Invoices (Fiori app). Describes that parked invoices are saved without posting and remain editable—hence why you must control write-capable apps or use workflow, rather than a status-only restriction.

SAP Help: Flexible Workflow for Supplier Invoices outlines the process for requiring approval prior to posting (including parked-as-complete status), which is SAP’s recommended control method when allowing users to park or view invoices without granting posting permissions.https://help.sap.com/docs/SAP_S4HANA_CLOUD/0e602d466b99490187fcbb30d1dc897c/ff92035b3da94a14a3d2d0fa...

KBA 2598733 Maintain Restrictions in Business Role explains which elements can be restricted within roles, such as Read/Write/Value Help and restriction fields. There is no default restriction for "Invoice Status is equal Parked"; instead, access should be managed through app or catalogue assignment and write permissions. SAP KBA-2598733 - Maintain Restrictions in Business Role

If your client refuses to use workflow, an alternative is role design: assign “park-only” users the park/display apps, set Write = No Access on Manage Supplier Invoices to prevent editing or posting, and keep Read access as necessary. This approach is detailed in the role restrictions documentation above. SAP Learning-Maintaining Business Role Restrictions

With kind regards

Chuma

[ornecogli]

Thank you Chuma, for your great explanation.

[Chuma]

Hello @ornecogli ,

You are always welcome😊 

[Lakshmipathi]

To achieve this, you’ll need to modify the business role assigned to the users by adjusting the access category and restriction types in the Maintain Business Roles app.

Open the “Maintain Business Roles” app in SAP S/4HANA Cloud Public Edition. Identify the role assigned to users who should not edit parked invoices. Navigate to the “Maintain Restrictions” tab for that role. Locate the business catalog related to supplier invoice processing (e.g., SAP_FIN_BC_AP_INV_PROC_PC). Under Access Categories, set Write Access → No Access or Restricted (depending on whether you want full block or conditional access). Read Access → Unrestricted (so they can still view parked invoices).

In Restriction Types, look for fields like Invoice Status, Company Code, Document Type, Posting Status. Set these to restrict editing based on parked status or other relevant criteria.

[ornecogli]

Hi Lakshmipathi, unfortunately, that business catalog does not exist in SAP Public Cloud. I have searched the applicable business catalog related to supplier processing, but it does not have the "Invoice status" field to add as a restriction type.

[Lakshmipathi]

Since:

• You’re not using workflow,
• You want to restrict editing parked invoices,
• And the catalog SAP_FIN_BC_AP_INV_MGMT_PC is unavailable,

Here’s what you can do:

Look for catalogs like:

These catalogs may vary by tenant and release version. Use the “Maintain Business Roles” app to search for catalogs containing “AP_INV” or “INVOICE”.

In the Maintain Business Roles app, select the role assigned to restricted users. Go to Maintain Restrictions.

For relevant catalogs:

• Set Write Access → No Access or Restricted
• Set Read Access → Unrestricted

Use available Restriction Types like:

• Document Type
• Company Code
• Posting Status (if available)

Since Invoice Status is not available, Posting Status may help distinguish parked vs. posted invoices.

If standard role restrictions are insufficient, consider custom Business logic via In-App extensibility, BAdI Implementation (if allowed in public cloud), Field Control or UI Adaptation to disable edit buttons based on status. These options depend on your edition and extensibility scope.

[BobShen]

Hi ornecogli,

Have you tried the feature below?

https://help.sap.com/docs/SAP_S4HANA_CLOUD/53e36b5493804bcdb3f6f14de8b487dd/61f5a1ac89e04b68aaf755c8...

If you find my response helpful, kindly accept the answer and award a Kudo. This motivates me to serve you better.

Br,Bob