3768327 - Unexpected Create/Update Permission for App F1602 (Manage Product Master Data)

In app Manage Product Master Data (F1602), users assigned with the business role (SAP_BR_PRODN_PLNR) or a custom copy (for example ZS_BR_PRODN_PLNR) can unexpectedly create or update products even without a role that explicitly grants access to app F1602.

The unexpected write ability disappears after setting the role’s Access Categories (Write, Read, Value Help) to Restricted or setting Write to No Access, indicating the behavior is tied to default Unrestricted permissions.

The question arises whether it is normal to have to restrict a business role that should not have access to this app.

"Image / Data in this KBA is from SAP internal systems, sample data, or demo systems. Any resemblance to real data is purely coincidental"

SAP S/4HANA Cloud Public Edition

1. Assign only a production planner-type business role to a user.
2. Open the app Manage Product Master Data (F1602).
3. Attempt to create or update a product and observe that the action is allowed.
4. In the same business role, set Access Categories “Write, Read, Value Help” to “Restricted.”
5. Re-test in F1602 and observe that create/modify actions are no longer possible.

• Take Business Role ZS_BR_PRODN_PLNR as an example, it contains the catalog SAP_CMD_BC_PRODUCT_DSP_PC (Master Data - Product Display). Although named "Display", its underlying authorization objects technically cover Create, Change, and Display activities — the same objects that App F1602 checks against. Since no Access Category restriction was configured, the system defaulted all three categories (Read, Write, Value Help) to Unrestricted, granting unintended write access.
  
• This is by design in SAP S/4HANA Cloud Public Edition. Unlike on-premise systems, the Public Cloud IAM model defaults to maximum permission unless explicitly restricted. The catalog name reflects intended use only — it does not technically limit the underlying authorization objects. Administrators must actively set Write to No Access on roles where write access is not intended.

It is recommended to refer to the content of the following best practices:

• For the SAP_BR_PRODN_PLNR role and all other display-only roles, explicitly set the Write Access Category to No Access for all *_DSP_PC catalogs (Product, Customer, Supplier, etc.).
• As a fundamental design principle: Always configure Access Categories explicitly when creating Business Roles — never rely on system defaults simply.
• Implement periodic targeted audits to identify any roles with Write set to Unrestricted on display-type catalogs, to proactively prevent unintended write access.

F1602, manage product master data, unexpected authorization, unintended write access, create update without role, business role restrictions, access categories, No Access, SAP_CMD_BC_PRODUCT_DSP_PC, display catalog, IAM, public cloud, authorization variants, restrict write, product master permissions , KBA , LO-MD-MM-2CL , Product Master for Public Cloud , Problem