In this blog post I want to show you how you can use data authorizations in SAP Data Warehouse Cloud. First, we have to log on to our SAP DWC and select the space we want to use for this.

After we have selected our space, we open the Data Builder of SAP Data Warehouse Cloud. Here we have to import a new table with our authorizations. In my case we want to filter the Product ID, so the table looks like this:

You have to define the user with the logged on email address and the column for the data you want to restrict. Now we upload and deploy this table to our space and give it the name Authorization_Example.

Now after we have deployed this table to the space, we switch to the Data Access Control, which we select in the menu bar. Here we can create a new Data Access Control we need to restrict our data access later. When we create a new Data Access Control we have to select the table we want to use for the Authorizations. In this case the table has the name Authorization_Example with the columns User and ProductID.

After we have selected the table, we have to make some adjustments for the Data Access Control. First, we have to define a Business Name, a Technical Name and define the Principal Name Column as well as the Output column. We can also enter a responsible person for this Data Access Control. After we have done this, we can save and deploy our Data Access Control to use it.

Now I describe as first way how to use it in a view and after how to use it in a SAP Data Warehouse Dimension as well as Consumption Model. So, let's start with the view. Select the Data Builder and create a new Graphical View.

We use the table Products and connect it to the output of the view. Now we select the properties of the view and select there the + icon under Data Access Control to add a new Data Access Control. 

In the new dialog we can select one of our defined Data Access Controls and use it. In this case we have one for the Product ID.

After we have selected it, we see the properties of the view again and see a point called join. Here we have to join our view with the Data Access Control.  Now after we have joined our view with the Data Access Control, we look into the data preview of our original table and then of the view.

As you see in the original table, we can see all entries of the table and when we now look into the view, we see that the Data Access Control is working because we only see the Product we defined above. This was the first way. Now I show you the way how to use the Data Access Control in Dimensions and Consumption Models.

So, let's select the Business Builder and here we create a new Authorization Scenario we need to use later. We have to select a Data Access Control and create out of it our new Authorization Scenario.

In the Authorization Scenario we can define our Data Restriction. In my case it is the Target Business Entity Products with the Target Key Product ID. After we saved our Authorization Scenario, we switch to the dimension Products and select the tab Authorization Scenarios. Here we click on the + sign to add an Authorization Scenario. We select the Authorization Scenario we just created. We can do the same on the Analytical Data Set.

In the Consumption Model we have to add our Authorization Scenario under the General tab. When we now open the data preview of our Consumption Model, we see under the settings the Authorization Scenario we can select. As you can see, we have here our Product ID Scenario. When we select it, the data will be restricted, and we only see the data we are allowed to.

The last step is to use this Consumption Model in the embedded SAP Analytics Cloud. Therefore, we switch to the Analytics Application and create a new story in this workspace. Now we select our Consumption Model, here Products with Data Access Control and use the table template. When we now add the Product ID to the rows, you see the data will be restricted.

At first, I was little confused about this solution but after implementing it, it makes really sense. Because I don't have only BW/4HANA sources, so I could not use the Authorization from BW/4HANA. And I am very flexible with this authorization table and can also expand it for more columns. The only thing is I don't figure out yet is an authorization on a hierarchy which is very common in BW/4HANA. Maybe someone has an idea?

These posts might also be interesting:

• Create a time hierarchy in SAP Data Warehouse Cloud

• In my newsletter you get informed about new topics
• You learn how to use Analysis Office
• You get tips and tricks about SAP BI topics
• You get the first 3 chapters of my e-book Analysis Office - The Comprehensive Guide for free