We are thrilled to announce that the functional area restriction type, introduced in SAP S/4HANA Cloud Public Edition, release 2302, is set to be activated in the productive systems with SAP S/4HANA Cloud Public Edition, release 2402, in February 2024. This enhancement provides you with an excellent opportunity to tailor functional area access to your specific business needs.

For customers yet to adapt their business roles to this new feature, it’s an opportune moment to do so. By correctly setting up business roles using this restriction type, you ensure seamless operation of your business apps once SAP S/4HANA Cloud Public Edition, release 2402, is live in your productive environment.

The countdown to February 2024 is on, and it’s a great time to fine-tune your functional area authorization in the affected business roles. Remember, Unrestricted Access is the recommended setting, ensuring system behavior remains unchanged. However, should you have specific needs, such as using functional areas as organizational units, the FKBER restriction type is at your disposal for access restriction.

And here is how to setup your business roles for the new restriction type:

• The restriction type is available in already delivered business catalogs which are assigned to at least one business role in your SAP S/HANA Cloud Public Edition system.
• In SAP S/4HANA Cloud Public Edition, release 2308, the functional area restriction type has the following status in the relevant business catalogs: Phase-In (Read), Phase-In (Write), or Phase-In (F4).
• All affected business roles can be identified via the IAM Information System app:
  1. Open the app.
  2. Select Business Role as Main Entity.
  3. Click on the Business Role – Restriction
  4. Filter for Restriction Field ID
  5. Check if there are entries for which the value field is empty.
  6. For each of those entries, restriction type settings need to be maintained. To do so, you can access the Maintain Business Roles app directly by clicking on the respective business role.
• If for a business role the access categories are set to unrestricted before the upgrade to release 2402, you do not need to adapt this business role as the access categories are not changed by the upgrade. You must maintain the restrictions for the new restriction type only in those business roles, where you had restricted the access (before the upgrade).
• There is no “automatic” or “single” switch available. For each of your affected business roles, you must maintain the functional area authorization – either manually for single business roles or by mass change for multiple roles.
• Edit the restriction type settings as follows:

1. 1. Open the Maintain Business Roles app and select your business role.
   2. Click Edit and Maintain Restrictions.
   3. Under Write, Read, Value Help, choose Restricted to display all restriction types. Select functional area and click the pen symbol (Edit).
   4. To grant users access to all functional areas, choose Unrestricted Access (asterisk *). This setting should cover most cases. However, if you want to grant access to individual functional areas, select them from the list on the Values If you want to restrict the access to functional area, please note that also for an empty functional area the authorization must be explicitly granted by entering two quotation marks ‘’ (ASCII code alt + 39) in the restriction type. It doesn’t matter whether there is a space between the characters (‘ ‘) or not (”). For more information see: IAM: Restriction Type “functional area” (What´s New – must know – in SAP S/4HANA Cloud Public Edition, release 2308).

Please refer to the following links for more details:

• IAM: Restriction Type “functional area” (What´s New – must know – in SAP S/4HANA Cloud 2308)
• SAP S/4HANA Cloud: Restriction Type “functional area” (SAP Note 3220972)
• SAP S/4HANA Cloud Identity and Access Management (IAM) Release Activities – 2SL
• SAP S/4HANA Cloud Identity and Access Management (IAM) Release Activities – 3SL
• How to Manage Changed Restriction Types After an Upgrade
• How to Make Mass Changes to Business Roles
• How to Maintain Restrictions Using the Mass Change Wizard
• IAM Information System | SAP Help Portal.