How many data access profiles can I create?

[Former Member]

Hi All,

Is there a limit on number of data access profiles that can be created? The current project they have around 900 cost centres and is it okay to create those many Data Access Profiles. You may think why dont I do it at cost centre groups, Unfortunately this is the requirement. I am just trying to understand the best practice or it there is any limit on how many data access profiles can be created?

Thanks in advance.

Regards,

Surya tamada.

[Former Member · Accepted solution]

Hi Surya,

Technically, there is no limitation in the number.

Suggested approach is to create profiles for each group of users (users who should have similar access). However, personally, I feel that it is easier to maintain if we separate profiles for each of the users. If some user leaves the organization, we can easily remove that profile. If someone joins, we can create a separate profile for that user.

Hope this helps.

[Former Member · Accepted solution]

Hi Nilanjan,

Thanks for such a prompt reply.

Thanks for clarifying that there is no technical limitation.

Is it good practice to create 900 Data Access Profiles. Have you seen such situation in your experience?

We initially thought of creating DAP based on user roles, but there will be maintainence if people leave or join the organization. Hence i would like to propose a solution that has individual DAPs for each cost centre and assign them to Teams. If people leave company or cost centre assignment changes in future, then, it is just a matter of assigning or rearranging DAPs rather than creating or deleting.

My primary question is still to understand if 900 DAPs is a good practice or something that SAP will belt me for .

Regards,

Surya tamada.

[former_member210696 · Accepted solution]

Hi Surya,

Creating 900 d.a.p. is certainly not a good idea. The suggested approach to security configuration can go in this order ->

Assign users to environments

Create the task profiles

Create the data access profile

Create teams

Assign task profiles to teams

Assign data access profile to the teams

Assign users to teams

This way you can ensure that any change done to any task profile/d.a.p. gets translated to the team to which those profiles are assigned and in effect those get translated to the users who belong to a particular team.

Also, whenever there is a new user, all you got to do is to add that user to the team which he fits in and you don't have to bother about the task profile or d.a.p. for that user.

Creating d.a.p. for individual users is not a good practice where no of users is high. You could very well create d.a.p. for individual users if they are in order of 30-40 or so but not advisable in your case.

Hope it helps!!

[Former Member · Accepted solution]

Hi,

Creating 900 profiles wont be a good idea. The suggestion I gave would have been useful for less number of people.

I know that most of the people wont agree with my perception of data access profile. But, I have found this one to be the easiest way for the maintenance. For us, it is ok, because we come from BPC background. So, if we have to maintain it is ok to assign profiles to groups. But think from the customer's point of view. They are new to BPC. It will be difficult for them to understand the things. It is easier for them if we have separate data access profiles for individual users.

Hope this helps.

[Former Member · Accepted solution]

Hi Ashish,

I am not really talking about creating profiles for individual users... rather for individual cost centres.

Regards,

Surya

[Former Member · Accepted solution]

I am impressed with the suggestion Nilanjan,

I will have a word with these guys here and try to strike a balance between profiles based on user roles and cost centre grouping and propose something that is fool proof for the future administrators.

Thanks for your prompt replies......

Regards,

Surya Tamada.