## 13.5.3.3.1  Authorizations
## Authorizations
In Project Management and Portfolio Management, authorizations are controlled in the following ways:
- ABAP authorization objects and roles This is the standard method for controlling access to transactions and programs in an SAP ABAP system.
Authorizations are combined in an authorization profile that is associated with a role. User administrators can then assign the corresponding roles via the user master record, so that the user can access the appropriate transactions for his or her tasks.
- Access control lists
These allow you to add another level of security by controlling authorization at object level. For example, you can control who has authorization to change a particular project definition.
- You can define the menu options in the navigation area using portal content adjustments or PFCG role Customizing.
- To use SAP Fiori Apps, users must be assigned to roles. These roles define which apps are displayed to the
- Roles for SAP Fiori apps user.
In Project Management only , you can use the following additional authorization mechanisms:
- System administrators can grant access to objects by choosing Portfolio and Project Administration Project Authorization Administration in the application. This is an exception to the normal process and is only used if the administrator of the object is not available due to illness, for example. The system sends the 'new' and 'old' administrators an e-mail to inform them of the new authorization holder. For more information, see the Granting Administration Authorization for an Object section of the Configuration Guide for SAP Portfolio and Project Management.
- System administrators can assign PFCG roles in Customizing for SAP Portfolio and Project Management under Common Functions Define Superuser Authorizations . This ensures that the maintained PFCG roles with the selected authorization will be automatically assigned to the corresponding project definition.
## Authorizations regarding BAPIs, reports, and (RFC-enabled) function modules:
In SAP Portfolio and Project Management, multiple BAPIs, reports and (RFC-enabled) function modules are available to create, read, change, edit, update, and delete the data of SAP Portfolio and Project Management.
Additionally, via (RFC-enabled) function modules and reports data is read from the SAP S/4HANA system. Therefore, using these BAPIs, reports, and function modules access to and manipulation of Portfolio and Project Management data as well as read access to SAP S/4HANA data is possible. Thus, the authorization for using these BAPIs, reports, and function modules (via transactions, for example), should be restricted to users who are intended to have these authorizations and the corresponding access to data.
## Authorizations regarding search results
You can use the BAdI BADI\_DPR\_SEARCH to modify search results. You can filter the result set implementing this BAdI depending on the specified search helps which exist for each Portfolio and Project Management object. Thus, you can, for example, hide all results for which the user does not have read authorization from the result list. In the standard, these results are displayed in the result list, but the user cannot open or display these objects.
## Use
SAP Portfolio and Project Management uses the authorization concept provided by ABAP Platform. Therefore, the recommendations and guidelines for authorizations as described in the Security Guide for ABAP Platform also apply to SAP Portfolio and Project Management.
The ABAP Platform authorization concept is based on assigning authorizations to users based on roles. For role maintenance, use the profile generator (transaction PFCG ) on the AS ABAP.
You can maintain the following role authorizations in Project Management and Portfolio Management using the SAP Profile Generator.
The following PFCG roles of SAP Portfolio and Project Management include authorizations to start the Web Dynpro ABAP applications (authorization check S\_START ) for Project Management and Portfolio Management:
- SAP\_CPR\_USER
- SAP\_XRPM\_USER
For details see the particular roles in transaction PFCG and choose Authorizations Display Authorization Data Cross-application Authorization Objects Start Authorization Check for TADIR Objects .
SAP recommends to adapt custom-specific roles accordingly.
## Project Management Roles
The following single roles are delivered with Project Management:
## Role
## Authorization
| SAP_CPR_PROJECT_ADMINISTRATOR   | Create projects (project definitions).                                |
|---------------------------------|-----------------------------------------------------------------------|
| SAP_CPR_TEMPLATE_ADMINISTRATOR  | Create, change, read, and delete all templates in Project Management. |
| Role             | Authorization                                                                                                                                                                                                                                                                                                            |
|------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| SAP_CPR_USER     | Use Project Management, but no authorization to perform any activities in a particular project. To do this users need project-specific authorizations, which can be distributed ei- ther directly via ACLs or through their assignment to a role. This role must be included in every Project Management composite role. |
| SAP_CPR_BCV_USER | Project-Management-specific authorization for using BCV content in resource management.                                                                                                                                                                                                                                  |
| SAP_BPR_PPM      | SAP Portfolio and Project Management PFCG role forNWBC                                                                                                                                                                                                                                                                   |
The following composite roles are delivered with Project Management:
| Role                         | Authorization                                                                                                                            |
|------------------------------|------------------------------------------------------------------------------------------------------------------------------------------|
| SAP_CPR_DECISON_MAKER        | Decision maker in Project Management. Contains the role SAP_CPR_USER .                                                                   |
| SAP_CPR_INTERESTED           | Interested party in Project Management. Contains the role SAP_CPR_USER .                                                                 |
| SAP_CPR_MEMBER               | Team member in Project Management. Contains the role SAP_CPR_USER .                                                                      |
| SAP_CPR_PROJECT_LEAD         | Project manager in Project Management. Contains the role SAP_CPR_PROJECT_ADMINISTRATOR and SAP_CPR_USER                                  |
| SAP_CPR_BCV_USER_COMP        | Composite role containing the general role for using BCV ( SAP_BCV_USER ) and the Project Management specific role ( SAP_CPR_BCV_USER ). |
| SAP_CPR_TEMPLATE_RESPONSIBLE | Project Management template responsible. Contains the roles SAP_CPR_TEMPLATE_ADMINISTRATOR and SAP_CPR_USER                              |
| SAP_CPR_RESOURCE_MANAGER     | Resource manage in Project Management. Contains the role SAP_CPR_USER .                                                                  |
You can use these SAP standard roles or create your own. For more information, see the Activating Single Roles for Project Management section and the Creating Roles for the Project-Specific Authorization Checks section of the Configuration Guide for SAP Portfolio and Project Management.
## Portfolio Management Roles
For Portfolio Management, the following roles are available:
| Roles                  | Authorization                                                                                                                                                                                                             |
|------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| SAP_XRPM_ADMINISTRATOR | Super user authorization in Portfolio Management. Used to create new portfolios. This role also provides the assigned user full access to all Portfolio Management business ob- jects in the system.                      |
| SAP_XRPM_USER          | General user in Portfolio Management. All users should be assigned this role. Has general authorizations to use Portfo- lio Management, but no specific object access. This access must be assigned to the user via ACLs. |
| SAP_RPM_BCV_USER       | Portfolio Management specific authorization for BCV con- tent in Portfolio Management                                                                                                                                     |
| SAP_RPM_BCV_USER_COMP  | Composite role containing the general role for using BCV ( SAP_BCV_USER ) and the Portfolio Management specific role ( SAP_RPM_BCV_USER ).                                                                                |
| SAP_BPR_PPM            | PFCG role for NWBCin SAP Portfolio and Project Manage- ment                                                                                                                                                               |
You can use these SAP standard roles or create your own. For more information about roles in Portfolio Management, see the Activating Single Roles for Portfolio Management (PFCG) section and the Creating Roles for the Portfolio-Specific Authorization Checks section of the Configuration Guide for SAP Portfolio and Project Management.
## SAP Fiori Roles
SAP Fiori roles ( SAP\_BR\_* ) need to be assigned on the front-end server on which the UIS4HOP1 software component is installed. You can find the roles in the implementation information for each application.
For more information and further implementation tasks on the front-end server,
In the back-end, you have to create roles in transaction PFCG and assign business catalogs to the roles. For more information, go to https:/ /help.sap.com/s4hana\_op\_2021, enter SAP Fiori Overview into the search bar, press Enter , and open the search result with that title. In addition, manual actions are required.