This is the 3rd blog post in our series on Understanding Business Roles.
In the previous blog post How SAP Business Roles simplify deploying SAP User Experience, you learned you can use SAP Business Roles to:
- Scope relevant SAP Fiori apps and classic UIs to be deployed based on your current GUI transaction usage
- Map your business processes to your business roles based on your desired SAP Best Practices
- Rapidly activate SAP Fiori apps and classic UIs to experience SAP S/4HANA sooner
- Explore and fit-gap the new business value of SAP Fiori apps
At this point of your project for the SAP Business Roles in scope, you understand what is delivered out-of-the-box for your SAP S/4HANA release, and you have decided what you want to change. The tools and accelerators that are available to help you make those changes is the subject of this blog post on refining the user experience, and the next on adding custom content to business roles.
TL;DR version: If you want to just try this out, you can try this step-by-step guide on how to combine existing launchpad content into custom business roles. You can come back to this blog post to understand at a deeper level what you did.
In a typical SAP S/4HANA project, the point at which you are ready to make start making changes to the UX is roughly the end of the Explore phase of SAP Activate methodology. Your SAP S/4HANA project could be:
- A new implementation of or system conversion to SAP S/4HANA
- An upgrade from your current SAP S/4HANA release to a higher release, e.g. from SAP S/4HANA 1610 to SAP S/4HANA 1909 FPS02
- A Continuous Improvement project to introduce new business value in your current SAP S/4HANA release.
In a typical SAP S/4HANA project you will, most likely, need to:
- Create custom business roles
- Recombine delivered launchpad content in new ways into your custom business roles
- Add custom launchpad content to your custom business roles
- Verify and/or adjust launchpad content e.g. to check all content in your custom business roles is active, to adjust texts or parameters
- Derive & refine security authorizations for your custom business roles
- Organize launchpad content to optimize the day-to-day experience for your business users
- Test your business roles
In this blog post you will learn how the out-of-the-box SAP Business Roles simplify building and refining your own custom business roles by recombining delivered launchpad content in new ways. You will learn the terms and tools needed to do this. This is the starting point of understanding how apps are assigned to business users.
To create your own business roles you will need to understand the relationships between business roles, security roles, and business catalogs. So the focus of this blog post is explaining the relationship between business roles and business catalogs.
Creating your custom business roles is an activity of the Realize phase, and you should expect it to be a somewhat iterative process, as your process design is refined, and as custom content is built.
You use custom business roles and/or SAP Business Roles primarily to authorize users to access launchpad content. The business roles also provide users with a default layout of the assigned launchpad content, which users can further refine through personalization.
In the next blog post you will learn how to add your own custom content with a deeper dive on the underlying terms and tools. To create your own custom content you will need to understand even more terms – tiles, target mappings, and technical catalogs.
Tip: Some of these terms will change in upcoming releases aligned to the new tools being released.
In this blog series you will learn step-by-step the terms, recommended tools and processes you need to refine the SAP Fiori user experience of SAP S/4HANA. If you are looking for a quick introduction and the main points, then you should refer to Best Practices for Managing Launchpad Content.
All of these activities are typically done in your development environment and are transported through to your production landscape.
Quick Summary of the main tools and flow
This diagram gives a quick explanation of the overall flow for creating any custom business role
- Identify launchpad content that you want to assign to your business role
- Verify the content – is it active and therefore ready for use? does it need any adjustments?
- Adjust content, where needed – which will be discussed in the next blog post of the series
- Create your custom business role
- Assign business catalogs to your custom business role – you can mix and match SAP and custom business catalogs
- Adjust authorizations
- Assign business users to business roles
Process flow for creating a custom business role
The main mass maintenance tool for refining launchpad content at scale is the SAP Fiori launchpad content manager.
However, there are several other tools that are provided with your SAP S/4HANA solution that are helpful in specific situations and you will learn where these are useful in this blog and the next. These tools include:
- Launchpad Designer – a tool inherited from SAP Business Suite for fine-tuning launchpad content
- Mass Maintenance App Descriptor – a tool for adding classic UIs to launchpad content
- Frontend and backend role generation programs – that generate security authorization roles based on launchpad content
- SAP Fiori apps, e.g. F2814 Manage KPIs and Reports, F4512 Manage Launchpad Pages
- UI Theme Designer– a tool for applying your corporate branding
Important: Some of these tools will be replaced with new tools in upcoming releases, as you can see in the SAP Fiori Roadmap June 2020 edition, slide 60, the Launchpad Designer is planned to be replaced by new tools such as SAP Fiori Launchpad App Manager
For some aspects you can also use classic SAP GUI administration tools such as GUI transactions PFCG, SU22, SU25, SUPC, etc.
SAP Business Roles simplify creating custom business roles
As explained in blog post Understanding Business Roles, SAP Business Roles are templates that hold the launchpad content – which includes SAP Fiori apps, classic UIs (User Interfaces) – and the navigations between them. Classic User Interfaces include:
- SAP GUI transactions
- ABAP Web Dynpro applications
- Web Client UIs
When you create your own custom business roles, you can adjust this content, using these templates as a starting point.
You can add your own content – your own custom-built SAP Fiori apps, or your own classic UIs – and you can override or restrict the delivered content to suit your needs.
Because SAP Fiori launchpad runs in a web browser, you can also add URLs to your launchpad content. For example, links to 3rd party apps, SAP Cloud Solutions, and intranet policy sites.
When you activate SAP Business Roles using rapid content activation you can select the option to copy the SAP Business Role into the customer namespace as a starting point to refining the role to your needs.
However, there are many other ways you can use SAP Business Roles as templates for creating your own custom business roles that suit your specific needs. You can do this using the Business Role as a whole, or more typically, using a subset of a role, called a business catalog. For example:
- You can assign multiple SAP Business Roles to a user who performs multiple roles
- You can recombine content from one or more SAP business catalogs into a custom business role
- You can copy a SAP business catalog and:
- remove unwanted classic UIs and/or SAP Fiori apps
- add more SAP Fiori apps, classic UIs, and/or URLs
- You can combine SAP Fiori apps, classic UIs, and/or URLs into a custom business catalog
- You can combine SAP business catalogs and custom business catalogs into custom business roles
- You can assign custom business roles and/or SAP Business Roles to a user
- You can use custom business roles and/or SAP Business Roles to verify all launchpad content assigned to the role is active in your system
Understanding business catalogs
In Understanding Business Roles you learned that each business role is a security role, but the reverse is not true, i.e. not every security authorizations role is a business role.
By convention a security authorizations role that represents the business role has a role id with the prefix SAP_BR_. The business role name and the associated security authorizations role id are listed in the SAP Fiori apps reference library. For example: the security authorizations role for Maintenance Technician is SAP_BR_MAINTENANCE_TECHNICIAN.
You can look up the role id in transaction PFCG and if you look at the menu tab you will see a business role is assigned to one or more business catalogs. By convention, business catalogs have the prefix SAP_BC_.
Note: The recommended prefix was not always applied historically, so you will also see catalogs with the naming pattern SAP_<xxx_> BC_<yyyy>.
Important: A business role may also be assigned to one or more business groups. SAP Business Groups by convention have the naming convention SAP_BCG_ (historically the naming pattern SAP_<xxx_>BCG_<yyyyy> is common). Business groups are used to determine the default layout of the home page. Business groups do NOT have any impact on authorizations and are being superseded by a new concept called Spaces and Pages. If you want to find out more about Launchpad layout and how it is changing, refer to Leading Practices for Home Page Design and Manage Spaces and Pages for SAP Fiori launchpad.
A business catalog contains a collection of related SAP Fiori apps and classic UIs, and the navigations between them. In other words, a business catalog is a subset of a business role.
One to many relationship between business roles and business catalogs
Conceptually a business role consists of a number of business catalogs. For delivered SAP Business Roles, these will always be SAP business catalogs. When you create a custom business role you can assign a mix of SAP business catalogs and/or custom business catalogs.
As a business user assigned to a business role, you can see all your assigned business catalogs in your App Finder, as shown in this example for a demo user (S4H_MM_DEM) in a SAP S/4HANA trial system for SAP S/4HANA 1909 FPS02. In the Catalog view all of the user’s assigned business catalogs are listed in the left hand pane. When you select a business catalog in the left hand pne,you can see all the related SAP Fiori apps and classic UIs in the business catalog shown in the right hand pane. You can also search for apps across all your catalogs in the App Finder using the Search in catalog field.
Business catalogs in the App Finder
It is business catalogs that control what launchpad content is assigned to the business role, i.e. SAP Fiori apps, classic UIs, URLs, and SAP Fiori launchpad features. When you assign the business catalog to the role, the system derives the authorizations needed to access the launchpad content as well.
Provided you can see a SAP Fiori apps or catalog in your App Finder you have access to the SAP Fiori app and can reach it in a variety of ways:
- From the App Finder
- From the Home/App Title button
- From the Fiori Search, i.e. using the Enterprise Search for Apps
- From a tile or link on your launchpad
- From the navigation between apps & UIs, e.g. via a list of links dialog, via a Related apps button, via an Overview Page card, via Open In… button in a Smart Business KPI report, etc.
A single app or UI can be assigned to one or more business catalogs. The same business catalog can be reused in multiple business roles, although often there are sufficient differences in navigation parameters or tile/link texts to make it worthwhile to keep the catalogs separate.
For example, the business roles Maintenance Technician and Maintenance Planner, share certain tasks related to Technical Objects. So the business catalog EAM – Asset Information System MW (technical id SAP_EAM_BC_AIS_MW) holds the apps related to Technical Objects and is assigned to the Maintenance Technician. While the similar business catalog EAM – Asset Information System (technical id SAP_EAM_BC_AIS) is assigned to the Maintenance Planner.
You can find the business catalog and the business roles of any app in the SAP Fiori apps reference library. You will find it listed in the app’s details, in the Implementation Information tab.
The Implementation Information tab in the SAP Fiori apps reference library
Within the Implementation Information tab, expand the Configuration section to find the related Business Catalogs. You will notice that an app can belong to one or more Business Catalogs. So this also means that the same app can be used by more than one Business Role, e.g. where 2 closely related roles perform the same task.
Business Catalogs listed in the Configuration section in the SAP Fiori apps reference library
To see which SAP Fiori apps and classic UIs are assigned to a business catalog, select the catalog and use the Extend Apps Selection button in the header of the Business Catalogs table.
Extend Apps Selection button for a selected Business Catalog in SAP Fiori apps reference library
You can then see the list of assigned apps.
List of apps (SAP Fiori apps + classic UIs) in a SAP Business Catalog as shown in the SAP Fiori apps reference library
Now that you understand the relationship between business roles and business catalogs, you are ready to start creating your own custom roles.
Tools for creating custom business roles
The simplest way to create a custom business role is to recombine delivered launchpad content by assigning delivered SAP business catalogs to your new custom business role. This process involves the fewest tools and also introduces the main tools needed for creating any custom business role:
- Manual maintenance using SAP GUI transaction PFCG
- Mass maintenance using SAP Fiori launchpad content manager
The end result is the same with both tools. However, based on customer experiences, you will find that using transaction PFCG quickly becomes very technical and not overly helpful for the process of creating a custom business role. Plus, if you have a large number of business roles and apps to deploy, using PFCG does not scale well.
The SAP Fiori launchpad content manager provides an easier way to manage your launchpad content.
For starters you can better understand the relationship between the business role and the catalogs, by using the SAP Fiori launchpad content manager tool. i.e. GUI transaction /UI2/FLPCM_CONF (cross-client) and GUI transaction /UI2/FLPCM_CUST (client-dependent).
Tip: SAP Fiori launchpad content manager is available for SAP S/4HANA releases 1709 and higher. Read the blog post SAP Fiori launchpad content manager tool available for SAP S/4HANA for more details.
You use the client-independent GUI transaction /UI2/FLPCM_CONF if you need to create a business role that is the same in all clients of your SAP S/4HANA system. Use the client-dependent GUI transaction /UI2/FLPCM_CUST if you need to create different business roles in different clients, e.g. if you are using one client for for user acceptance testing and another client for training purposes.
In the SAP Fiori launchpad content manager you can easily see which business catalogs are assigned to which business roles. Go to the Roles tab, search for your role by id or name, press Go to see the related business roles. You can even use the Open in PFCG button to check the role in transaction PFCG.
Select the business role you are interested in to see the related business catalogs.
SAP Fiori launchpad content manager, Roles tab showing the related business catalogs of a selected role
You can select and open a business catalog using the Catalog View button.
SAP Fiori launchpad content manager, selecting a catalog and the Catalog View button
This brings you into the Catalogs tab displaying the selected business catalog.
In the Catalogs tab you can see which SAP Fiori apps and classic UIs are assigned to the catalog. Here you can see there are the 2 SAP Fiori apps – the same list that you saw in the SAP Fiori apps reference library. You can also use the Usage in Roles button to swap from the Catalog Content view to the Usage in Roles view.
SAP Fiori launchpad content manager, Catalogs tab, showing assigned apps/UIs, and the Usage in Roles button
The Usage in Roles view confirms which roles are using the specific business catalog. You can see that the selected business catalog is only used in the role Maintenance Technician.
SAP Fiori launchpad content manager, Catalogs tab, showing Usage in Roles view for a selected catalog
The SAP Fiori launchpad content manager tool makes it much simpler to understand what has been delivered. Everything you need to start identifying launchpad content to create your own custom business roles.
Even better, as you start to create your own custom business roles and custom business catalogs, the same SAP Fiori launchpad content manager tool will show your custom business roles and custom business catalogs in the same way. So you will have a holistic understanding of which roles are assigned to which catalogs across delivered SAP content and your own custom content.
Starting with a simple example
The simplest way to create a custom business role is to recombine delivered launchpad content by assigning delivered SAP business catalogs to your new custom business role.
You can see a step-by-step example of how to do this in Combining business catalogs into custom business roles, where you can see the difference between using traditional tools such as SAP GUI transaction PFCG vs. SAP Fiori launchpad content manager and the Frontend and backend role generation programs.
Becoming a SAP Fiori for SAP S/4HANA guru
You’ll find much more on our SAP Fiori for SAP S/4HANA wiki
Brought to you by the S/4HANA RIG
