IAM In SAP S/4HANA Cloud Public Edition : Business Role Authorization And IAM Apps

Identity and Access Management in SAP S/4HANA Cloud Public Edition : Business Role Authorization and IAM Apps

Background

Starting with SAP S/4HANA Cloud Public Edition 2502, the smallest unit of authorization assignment has shifted to the IAM app level. You can now fine-tune access at a more granular level, controlling which specific apps within a business catalog a user can or cannot access.

This post explains how to manage business roles and access control in your system under this new model.

Authorization Control

Let’s start with an overview from the IAM app perspective:

In the screenshot, you can see that a business role contains launchpad spaces, business catalogs, and restrictions. (IAM app can also be added directly to Business Role now)

For this discussion on authorization control, we’ll focus on business catalogs and restrictions.

There are currently two types of business catalogs:

1.Business catalogs which support IAM apps

When you add this type of catalog to a business role, the IAM apps included in the catalog appear under the IAM Apps tab.

You can think of a business catalog as a bundle of IAM apps, and each IAM app as a bundle of authorizations for specific transactions or application capabilities.

Because of this structure, you can activate or deactivate individual IAM apps to control access.

You can also add or remove IAM apps individually from the role for fine-grained control.

2.Business catalogs that do not yet support IAM apps

For these catalogs, you cannot manage access at the IAM app level within the catalog.

Access is controlled at the catalog level: adding the catalog to a role grants access to all IAM apps in that catalog.

The following diagram illustrates the IAM app concept:

图片2.Png

The Maintain Business Users app has the Fiori ID F1303 and, for example, the following app authorization variants:

an app authorization variant called Display Business Users (IAM app ID: F1303_03_TRAN) with read authorization
an app authorization variant called Assign Business Users to Business Roles (IAM app ID: F1303_22_TRAN) with write authorization
an app authorization variant called Maintain Business Users (IAM app ID: F1303_TRAN) with write authorization

All three app authorization variants belong to the transaction code F1303. They grant access to the same tiles and target mappings in SAP Fiori launchpad but have separate IAM app IDs with the prefix F1303.

Because each IAM app is tied to specific authorization values, you can activate or deactivate IAM apps to implement access control.

For example, if you want to grant read-only access to business users assigned to a given business role, activate the authorization variant Display Business Users (F1303_03_TRAN).

This approach also allows you to add individual IAM apps to your business roles for fine-grained control.

图片3.Png

We recommend adding dependent IAM apps together, as they may be required for in-app navigation from the initial app.

图片4.Png

Next, let’s talk about the restriction settings to the role.

图片5.Png

The Access Categories part is the overall access control of the business role.

The following access categories are available:

Write, Read, Value Help (write access)
Read, Value Help (read access)
Value Help (value help access)

Each access category can be set to one of the three values:

Unrestricted: Full access to this access category
Restricted: Specific authorizations can be defined for this access category
No Access: No authorizations to this access category

For detailed access control within a business role, use the Maintain Restrictions UI.

In this area, you can view and edit all available restriction types and fields.

These restriction objects are derived from the IAM apps or business catalogs assigned to the role.

Enter values in the relevant fields to grant the corresponding authorizations.

图片7.Png

Note the color indicators shown on the left for each restriction type:

As per Maintain Restrictions, the colors which appear to the user are described as below:

Green: all restrictions of this type have been processed (either maintained with values or set to Not Maintained intentionally)
Orange: at least one field is still empty

As a best practice, aim to have all restriction types in green. This indicates you have reviewed each restriction, made explicit decisions, and your authorization design is under control.

The values you can enter in the restriction fields are sourced from your related business configuration.

Useful Tools:

1. To find out which restrictions apply to a specific IAM app, use the “Display IAM App” (F7500) app.

图片8.Png

2. To view relationships among business users, business roles, business catalogs, IAM apps, and restrictions, use the IAM Information System (F2450) app.

Adjust the Main Entity and switch between the tabs to navigate and explore the specific relationships you want to inspect:

图片9.Png