The requirement to create config roles (IMG Authorization) based on various SAP Functional modules often keeps coming. Here, we will create a config role which provides SAP function module specific IMG Authorization using tcode SPRO_ADMIN.
For creating function module specific IMG Authorization, we will create a config role which gives access to Sales and Distribution Basic Functions Pricing tcodes.
The first step to create a module specific config role is to create an IMG Project. IMG Project can be created using tcode SPRO_ADMIN.
Execute tcode SPRO_ADMIN and click on create as shown below. Since we are creating IMG Project for SD role, lets give the Project Name SD. The following screenshot shows how this can be done.
Give the project title as SD Project and click on save:
Now go to the Scope tab and specify project scope.
System will prompt with “Select IMG Nodes” popup. Go to Sales and Distribution; expand it and select the node for which role needs to be created. In this example we have selected the SD node Basic Functions -> Pricing
Generate the Project.
Now go to PFCG tcode. Give a new role name and navigate to Menu Tab. We should go for a new role because the menu tab should not have any tcode assigned to the role for config role creation.
Select menu option Utilities->Customizing auth
Select IMG Project – SD
Go to the PFCG Role authorization tab and maintain authorization objects. Take care to see that the object S_TABU_DIS gives display access to those tables which you would not want the user to change. Also take care of S_USER* authorization objects. These objects give critical accesses which are generally restricted to Basis and Security teams only.