Please note this blog post is featured in SAP S/4HANA Cloud Identity Access Management – Your Knowledge Base
1 Background
In SAP S/4HANA Cloud Public Edition, new apps are now delivered as inactive – and therefore not visible to business users – starting with release 2602. This is due to the underlying IAM apps are no longer activated automatically per default (see What's New entry Business Role Design with IAM Apps). You as customer therefore need to incorporate the required app activation step into your processes and tasks.
This blog describes the recommended procedure to get an overview of new inactive apps and how to activate them.
2 Identifying and Activating New Apps
We strongly recommend activating and assigning successor apps to end users as early as possible. This allows users to work with the new app in real business scenarios, verify that required functionality is covered, provide feedback if a feature is missing, and become familiar with the new experience without time pressure. Early activation helps avoid business disruptions and ensures a seamless user experience.
We advise customers to deactivate the predecessor app in the business roles once the successor app is active and has been successfully validated by your business users. Timely activation of the successor app is critical because, after deprecation, navigation from the SAP Fiori launchpad may automatically launch the successor app. If the successor app is not yet activated, this can cause broken processes and a disrupted user experience. Deactivating the old app while ensuring the successor is active ensures a smooth, uninterrupted transition.
2.1 Identifying Apps with Successor App
You can identify apps with successors in several different ways (both within and outside of your SAP S/4HANA Cloud Public Edition system):
- Access the central SAP Note 2975653 information that provides access to all available SAP Notes that contain release-specific IAM change information. Go to the relevant release-specific SAP Note. Open one of the attached spreadsheets and select the tab TransactionsWithSuccessors and TransactionsDeprecated
- Use the IAM Information System to analyse successor relationships between different IAM apps (you can also export the list of IAM apps with successors for a detailed analysis outside of the SAP S/4HANA Cloud system)
- Use the Display IAM Apps app to identify apps where the successor app is introduced or the app is deprecated
- Phase-In (Successor app introduced but app not yet deprecated): In the Status search filter, select Not Deprecated. In the Amount Successor search filter, enter >=1.
- Phase-Out (App deprecated): Adapt the filter settings to search for deprecated IAM apps that are used in a business role. In the Status search filter, select Deprecated. In the Used in Business Roles search filter, enter >=1.
2.2 Identifying the Affected Business Roles
Identify the affected business roles by analysing which roles currently contain the predecessor app and therefore need to be updated with the corresponding successor app. You can do this using:
- the IAM Information System app (check which IAM App is used in which Business Roles)
- the Display IAM Apps app (check Used in Business Roles):
2.3 Modifying the Affected Business Roles
2.3.1 Activating the Successor app in the Phase-In Phase
To make the successor app available to users, activate the corresponding IAM app and assign it to the relevant business roles. You can do this by:
Maintaining the business role in the Maintain Business Role app manually. The steps involved are:
- Edit the business role
- If the successor IAM app is delivered in the same business catalog, activate the successor IAM app
- If the successor IAM app is delivered in another business catalog, add the business catalog / add the IAM app individually
- Maintain necessary new restriction types in the business role
Maintaining the business role in the Maintain Business Role app using the Mass Change option. The steps involved are:
- Select the business roles which are affected and need to include the successor app and select Mass Change
- Select the Area IAM App Activation and activate the IAM apps (this will not add missing apps in case the app is not assigned to the business role!)
- Enter the IAM app ID of the successor app and review and confirm your changes
2.3.2 Deactivating the Predecessor app in the Business Roles in the Phase-Out Phase
Once you have validated the successor app and confirmed that it meets all your business requirements, we strongly recommend deactivating the predecessor app for the relevant business roles. This step finalizes the transition, maintains process continuity, and ensures that users can only access the successor app.
- Use the Adopt Changes button in the Display IAM Apps app to remove the predecessor app from the assigned business roles
- Use the Mass Changes wizard to deactivate the apps in the business roles (similar to the activation of apps)
2.4 Finalizing the Transition
After completing the activation of the successor app in the business roles, additional follow-up activities are required to ensure consistency and usability. Here is a list of activities you need to consider:
- Test all changes together with key users or authorization coordinators before rolling out the changes to your business stakeholders
- Business catalog extensions need to be reapplied
- Business role restrictions should be reapplied where necessary
- Update the documentation of your authorization concept
- Update the Launchpad Pages associated to the affected business roles
- Transport your changes to the business roles to the Test and Production system
- Clearly communicate the transition to end users, including any cutover activities, and to provide appropriate training and enablement materials for the successor apps
- Advise business stakeholders to migrate their filters to the new app and update their My Home page
3 Conclusion
For more details, check out the following resources:
