Trace after missing permissions
Security Automation for SAP Security Checks
For accesses by verifier users (from the table TPCUSERN), the selection parameters of the invoked transaction are logged in the application log and can be evaluated with the report CA_TAXLOG. In the example, the single ledger entry for the vendor account 100000 was invoked.
Structural authorizations work with SAP HCM Organizational Management and define who can be seen, but not what can be seen. This is done based on evaluation paths in the org tree. Structural authorizations should therefore only be used together with general authorizations. Just like the general authorizations in SAP ECC HR, they enable regulated access to data in time-dependent structures. An authorization profile is used to determine the authorization. In addition, it is defined how the search is carried out on the org tree.
Authorization concepts - advantages and architecture
The AL08 transaction displays all logged-in users and their application servers. In the Server Name column, you can see which application server the user is logged on to, and which has the permission issue. Switch to this application server by calling the SM51 transaction and double-clicking the application server you are looking for. On the application server that is now active, run the permission trace as usual and review the evaluation.
It is important for consolidated financial statements to have the same number range in the G/L account masters in different company codes. This is ensured by the tools in the FI module. In addition, the master records can be adjusted so that it is possible to work with the different currencies of the company codes across countries.
Authorizations can also be assigned via "Shortcut for SAP systems".
For more information, see SAP Notes 20534, 28175, and 28186.
You can manage access to projects in the IMG via customising permissions and thus limit the user circle.