3783756 - PO document type restriction not effective due to other role app authorizations

Need to restrict PO document type access in custom roles.

SAP S/4HANA Cloud Public Edition

1. Configure a business role with app access to Create Purchase Order – Advanced (ME21N_TRAN) and restrict purchase order document types in that role.
2. Assign additional roles that include IAM apps which permit creating or changing purchase orders but have no document type restriction (for example: ME38_TRAN, ME58_TRAN, MSR_INSPWH_TRAN, MSR_VRM_GR_TRAN, MSR_VRM_LFU_TRAN, ME32L_TRAN, ME38_TRAN).
3. Start Create Purchase Order – Advanced and observe that the user can still create or change purchase orders using document types that should be restricted.

Other assigned roles contain IAM apps with unrestricted authorization to create or change purchase orders. In this setup, authorization to start an app is checked separately from authorization to change business objects (such as PO document type), so unrestricted apps in other roles bypass the intended document type restrictions.

1. Identify all assigned roles that include IAM apps capable of creating or changing purchase orders.
2. In roles that should not allow PO creation or changes, deactivate or remove these IAM apps (for example: ME38_TRAN, ME58_TRAN, MSR_INSPWH_TRAN, MSR_VRM_GR_TRAN, MSR_VRM_LFU_TRAN, ME32L_TRAN, ME38_TRAN).
3. If those apps are required by some users, move them into roles where PO document type restrictions are explicitly maintained.
4. Review approval or change-related apps used in PO processes and ensure they are also restricted by document type if they allow changing purchase orders.
5. After updating the business roles, regenerate and assign the roles, then verify that Purchase Order creation and change are restricted as expected.

restrict purchase order document type, business role restriction, IAM app assignment, ME21N_TRAN, Create Purchase Order - Advanced, document type authorization, purchase order approval apps, change authorization, catalog assignment, procurement authorization, ME58_TRAN, ME38_TRAN, MSR_INSPWH_TRAN, MSR_VRM_GR_TRAN, MSR_VRM_LFU_TRAN, S4HC, S4_1C, X4BC , KBA , MM-PUR-IAM-2CL , Identity Management for Procurement (Public Cloud) , Problem