Standard Authorisations in SAP HCM offer quite a few options with ‘normal’ authorisation objects, as well as structural, and context sensitive authorisations. However, with SAP HCM ever more widely used across the organisation covering ever more processes, most customers get to a point, where they feel they need to add some custom coding to make the system fit their requirements. In many cases, custom coding can also reduce the number of roles and profiles required considerably by making them more dynamic. This reduces the workload for administrators as well as the risk of errors.
If you get to this point, it is important you are aware of all options available, so you can make the best choice in your particular context. As a brief overview this is what you can go for:
- Developing custom function modules for T77PR to decide upon the root object of your evaluation path
- Using the custom authorisation object “P_NNNNN”
- Using the various BAdIs available for ‘normal’, structural and context sensitive authorisations
- Programming bespoke checks within any custom developments
- …and then of course there are always implicit enhancements and modifications – to be used with even more care than the options laid out above.
“With so many options”, you may think, “there’s no need to try to make processes fit, what SAP authorisations can do out of the box. Just bring in the programmers.” Well, think again: authorisations is not the field you should add too much complex custom development or even modifications easily. To begin with, you may have a lot of questions to answer from your auditors, when they become aware of it. And then you don’t want to compromise security by accumulating too high a level of complexity over time. So, it’s always a good idea to stem the tide of programming requirements and try to find a different solution first. At the end of the day, you didn’t pay all those licence fees only to re-program the whole system…
For a more comprehensive discussion of custom development in SAP HR authorisations, you should attend Sven Ringling’s session at the SAP Insider conference SAP HR2013 Europe in Amsterdam. The director of iProCon UK will speak about “When and how to use custom development to optimise SAP ERP HCM authorisations” on Wednesday, 12. June, 14:30.
