3807617 - Maintain Business Users app: User could add/remove business roles from the user with no business user group maintained, even maintain restrictions to user group in the business role - SAP S/4HANA Cloud Public Edition

• Maintain Business Users app:  User could add/remove business roles from the user with no business user group maintained, even maintain restrictions to user group in the business role.

• SAP S/4HANA Cloud Public Edition
• Identity and Access Management

1. Create a custom business role that grants access to the Maintain Business Users app (IAM app F1303_22_TRAN).
2. In the role, configure a restriction to allow maintaining only a specific business user group (for example, restrict the User Group field).
3. Assign this role to a test user.
4. With the test user, open Maintain Business Users and attempt to edit or add roles to users with no business user group maintained.
5. Observe that the user can still add/remove roles for users with no business user group maintained; the restriction is not enforced.

=

it is expected that Business Roles can be assigned to Users with no Business User Group (Technically object field SAP_CUST_BUS).

Only Users with a Business User Group assigned which is not within the authorization are not editable. 

maintain business users, business role restrictions, user group restriction, sap_core_bc_iam_ra, f1303_22_tran, f1492_22_tran, s_brl_asg, add remove roles, restriction not enforced, iam, s/4hana cloud, business user group, catalog restriction, authorization, access control , KBA , BC-SRV-APS-IAM , Identity and Access Management , Problem