Confidential Project Access Control In S/4HANA Public Cloud Professional Services

Many professional services organizations, such as consulting firms, engineering companies, legal service providers, and IT service providers, manage a large number of customer projects in SAP S/4HANA Public Cloud Project System (PS). While most projects can be accessed by authorized project participants, some projects involve highly sensitive information and require additional confidentiality controls.

Examples of confidential projects include strategic transformation initiatives, merger and acquisition (M&A) engagements, executive consulting assignments, government-related programs, and projects involving sensitive customer data. In these scenarios, project information should only be accessible to a limited group of users who are directly involved in project execution.

The use case in this blog is to prevent User A from viewing confidential projects that have not been assigned to them.

Business Role template: SAP_BR_PROJECT_MANAGER_PROF

Q0001 is Public Project

Q0002 is Confidential Project

Q0003 is Public Project

Y= Confidential project

N= Public project

Project Manager Project Manager (YP_RL_0001) created 3 Projects while our testing user Project Controller (0SAP_RL_005) is within the responsible role for Q0001 and it is our main test user.

Here is what we see when testing using Project Controller (0SAP_RL_005) with unrestricted access. Our scenario is Project Controller (0SAP_RL_005) is not suppoed to see confidential project Q0002.

If unrestricted access:

Result as below. It see all project both confidential and public projects.

One fundamental rule is that once a user is assigned a responsibility role on a project, the user will always be able to view that project, regardless of whether it is confidential or not. This behavior is not affected by the role restriction.

Under this premise, Project Controller (0SAP_RL_005) will always see Q0001, so we will focus on the behaviour of Q0002 (Confidential) and Q0003 with different configuration combinations.

Scenario 1:

Result correct. This user can only display public project Q0003.

Scenario 2:

Result correct. This user can only display public project Q0002

Scenario 3:

Result shows if leave empty, it does not see any projects other than its own project.

Scenario 4:

Result shows the test user can see all projects.

Others tries:

Try 1:

Result incorrect

Try 2:

Result incorrect:

Try 3:

Results incorrect:

Try 4:

Result wrong:

So make sure the restriction category Read, Value help is restricted with value consistent with Write, Read, Value help instead of leave it unrestricted.

This pattern will extend to Value help, apply the same configuration.