## 13.7.12  Subscription Order Management
## Why Is Security Necessary?
Security is necessary because Subscription Order Management handles business partner and contract account data during subscription order, solution quotation, and subscription contract processing. This could include sensitive personal data and must be protected.
## Role Administration
## Business Roles for WebClient UI
The following business roles are used for the WebClient UI related features and functionality. You must assign these roles in the backend system to the users.
| Business Role   | PFCG Role            | Purpose                                                                     |
|-----------------|----------------------|-----------------------------------------------------------------------------|
| S4C_SOM_REP     | SAP_S4C_UIU_SOM_REP  | For the sales representative working with subscription orders and contracts |
| S4C_SOM_PROD    | SAP_S4C_UIU_SOM_PROD | For the product modeler who models subscription products                    |
## PFCG Roles for SAP Fiori Apps
The following PFCG roles are used for the SAP Fiori apps that are used to maintain the subscription-specific product data:
| PFCG Role                   | System            | Purpose                                                                                                |
|-----------------------------|-------------------|--------------------------------------------------------------------------------------------------------|
| SAP_SOMPRODMANS1_APP        | Backend           | Manage Subscription Product-Specific app                                                               |
| SAP_ALLWNCDEF_MANS1_APP     | Backend           | Manage Allowance Definition Group app                                                                  |
| SAP_SHRNGGRP_MANS1_APP      | Backend           | Manage Sharing Group app                                                                               |
| SAP_BR_PROD_CONF_MODELR_SOM | SAP Fiori Frontnd | Controls launchpad for Manage Subscription Product-Specific and Manage Allowance Definition Group apps |
| PFCG Role                   | System             | Purpose                                                                                                                                                                    |
|-----------------------------|--------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| SAP_BR_INTRNAL_SALESREP_SOM | SAP Fiori Frontend | Controls launchpad for order and contract apps, including the Manage Sharing Group app. Also allows Fiori Launchpad display and navigation for the Display Allowances app. |
## Authorization Objects: Specifics for Mass Runs
If you are using the mass run functionality, ensure that you maintain the following authorization objects:
- CRM\_ORD\_PR controls permissions for the business transaction types, that is, which transaction types the user can view or create.
For example, business transaction type PRVO is the transaction type for Subscription Order
- CRMS4\_SOM\_MR controls the mass run permissions, that is, the mass run types that the user is allowed to view or create.
For example, BULK\_CALL\_OFF\_MA ( Call-Off Master Agreement ) or BULK\_CREATE ( Creation Subscription Orders )
If you maintain restrictions for a transaction type, keep it consistent with the mass run types.
<!-- image -->
##  Example
If you restrict user access to master agreements, you must also ensure that userscannot access the mass run types that deal with master agreement data. Since certain master agreement data (such as Business Partner ID and Master Agreement Transaction ID) is replicated into the mass run data, without the proper restrictions, users may be able to see this data when accessing the mass run.
## SOAP Web Services
If you use SOAP Web Services to create subscription orders ( SubscriptionOrderRequest\_In ) or to change subscription contracts ( SubscriptionContractChangeProcessRequest\_In ), you require service-specific permissions for the following authorization objects:
- S\_SERVICE
- /AIF/PROC
##  Note
The permissions are required in addition to the functional PFCG roles (your custom role based on SAP\_S4C\_UIU\_SOM\_REP ).
For more information about the Web Services, refer to the product assistance on SAP Help Portal at SAP S/ 4HANA under Enterprise Business Applications Service Subscription Order Management Subscription Orders and Subscription Contracts API for Subscription Orders and Contracts .
## Data Storage Security
Data is stored in database tables of SAP NetWeaver AS. Depending on the user, no special data storage security measures are required. Subscription Order Management is a dependent application, so the storage security for the leading application applies to survey read or edit rights.