Providing Sales org * access only for 1 transaction code

[Former Member]

User has 6 Roles assigned to him providing him wide range of Create, Change and display access restricted to sales organisation. (EX01)

We need to allow user creating billing document (Transaction code: VF01) for all Sales org (Sales org = *) , Billiing type (ZX18)

I got to know there is a possiblity to create a new roles for transaction code VF01, Sales org = * and Billing type = ZF18.

Do we run in to risk of having sales org * in new role for VF01 Transaction, impact/open up existing roles with transactions to give limited access to sales org (EX01) ?

I am told this SAP derives the highest value for sales org, that is * and will be used for all transactions! It will provide the existing transaction code (other than VF01) also with sales org * access. Only way to mitigate this is to create a custom transaction ZVF01 with a different authorization object.

This seems to be a simple requirement, I am sure SAP can handle this with out creating ZVF01.

Please suggest. Thanks in advance.

[ankurch]

Hi Raja,

You can also use transaction variant(SHD0) without making changes in roles.

Thanks,

[Former Member]

Thanks Ankur. Good alternative.

I would prefer not creating Z transaction and managing with existing transaction VF01 and role changes to restrict it.

Do we run in to risk of having sales org * in new role for VF01 Transaction, impact/open up existing roles with transactions to give limited access to sales org (EX01) ?

[ankurch]

I don't think is there any impact on open roles with limited access to sales organization, better processed with testing before deploying it in PRD.

thanks,

[jurjen_heeck]

Hi,

Maybe you can create your transaction ZVF01 as a copy of VF01 and then in SU24 disable the sales org related objects *VKO* for this specific transaction?

Jurjen

[Former Member]

Thanks Jurjen,

Do we run in to risk of having sales org * in new role for VF01 Transaction, impact/open up existing roles with transactions to give limited access to sales org (EX01) ?

[jurjen_heeck]

If you disable the check for a transaction this means you do not need the * value in any role. Best search for some instructions about the use of tr. SU24.