Creating and Assigning Business Roles in SAP CRM

Every user in CRM is assigned a business role depending upon the responsibilities and
activities he/she undertakes to perform in the organization from time to time.
Example Sales Personal will be assigned with Sales Professional Business Role, which
includes all the activities that he/she performs in the sales process from SAP CRM
perspective.
In the same way Marketing Personal will be assigned with Marketing Professional Business
Role which consists of all marketing related activities.
At times we change or add activities/functionalities to different Business Roles depending
upon the requirement.
We also create new Business Roles depending upon the requirement and add to the users
account so that they can access the functionalities added into that business role.
We will discuss on creation of Business Role and the process of assigning to the user.
Creating/ Copying Business Roles:
Path: IMG->CRM->UI Framework->Business Roles->Define Business Role

Business Role SALES PROFESSIONAL is highlighted.

COPY the selected PFCG roles and go to T code: PFCG

A business role is associated with a PFCG role. One PFCG role can be assigned to only one
Business Role. If you want to create/copy a business role similarly you need to create/copy
the PFCG roles.
Note: There is a restriction on PFCG role assignment in CRM 6.0 that one PFCG role can
be assigned to one business role only, but in CRM 7.0 this restriction has been removed.
Now
copy
Role
Id
SAP_CRM_UIU_SLS_PROFESSIONAL
SAP_CRM_UIU_SLS_PROFESSIONAL

Now we are ready with our PFCG Role Z SAP_CRM_UIU_SLS_PROFESSIONAL

to

Now come to Define Business Role Screen and COPY SALESPRO to ZSALESPRO
Business Role and assign our created PFCG Role ID and Hit Enter to copy all the
characteristics of the Business Role.

Now

Now Save and Exit the screen.

Assigning Business Role: Assignment at Organization Management Level.
You can assign a business role either at the org unit level or to a position.
1. Go to TCode PPOMA_CRM
2. Select the organization Unit - EG: IDES CRM Training.
3. Double click on a position, in the go to menu choose Detail object--> enhanced object
description.

4.
5.

Choose the info type Business Role.

Go back, right click on the position and assign the user.

Assigning Business Role at TCode SU3 (test user):

Maintain the parameter CRM_UI_PROFILE the business role EG: ZSALESPRO

Now you will be logged in with the Business Role that which is assigned to you.

Create a new Business Role

Create a new Business Role

As I have explained earlier, SAP delivers Standard Business Roles for CRM WebCient UI and depending on the
nature os them, the look and feel and the functionality may very well be different. In this chapter we will create a
new Business Role which will be a copy of the existing SALESPRO (Sales Professional). We will use CRM 7.0
EhP 1 system for this example.

PFCG Role
In CRM the autorizations for any Business Role is controlled by their corresponding PFCG role. For example
when you login to WebClient UI and choose Business Role SALESPRO, the corresponding PFCG Role ID is
SAP_CRM_UIU_SLS_PROFESSIONAL. In other words, . PFCG Roles contains authorizations which are

required for a specific Business Role to do its task. SAP highly recommends that you maintain your own PFCG
Role IDs (you can always copy one) rather then making changes to the standard.

Creating a New PFCG Role ID

Before we create a new PFCG Role ID, let us verify the currect ID that corresponds with the standard
SALESPRO role
1. Execute transaction SPRO

2.

Create a new Business Role

Click on SAP Reference IMG
1.

Expand Customer Relationship Management

2.

Expand UI Framework -> Business Roles -> and click on Defines Business Roles

3.

Click on Position and in the popup type SALESPRO and click on the green check mark to continue

4.

Select SALESPRO and click on the details (magnifying glass) button

5.

You will see that the PFCG Role ID for Business Role SALESPRO is
SAP_CRM_UIU_SLS_PROFESSIONAL

6.

Now that we know what the PFCG Role ID is, we will make a copy of it. Execute transaction PFCG

7.

Type SAP_CRM_UIU_SLS_PROFESSIONAL in the Role field and click on the copy icon
10. In the popup that follows, provide a meaningful Z target role. ZHZ_SAP_CRM_UIU_SLS_PROF in our
example, and click on Copy All icon (you can be selective, but that is beyond the concepts covered in this book).

Create a new Business Role

1.

Now that we have successfully created a new PFCG Role ID, let us proceed to creating our new
Business Role (copy of standard SALESPRO)

2.

3.
4.

5.

Execute transaction SPRO and follow path SAP Reference IMG -> Customer Relationship Management
-> UI Framework -> Business Roles -> Define Business Role (see steps 1-4). Or you can simply execute
transaction CRMC_UI_PROFILE.
Click on Position and enter SALESPRO (see step 5) and click on Continue
Select Business Role SALESPRO and click on the copy icon

Change the Business Role name from SALESPRO to a meaningful Z name and change the PFCG Role
ID from SAP_CRM_UIU_SLS_PROFESSIONAL to the one we created earlier; change the Description. You can
also change the Logo Text if you like. Hit the enter key

6.

You will get a popup stating the number of entries that were copied. Click on continue and then click on
save

7.
8.
9.

Our new Business Role ZHZ_SALESPRO is now created

We can take it a step further and assign the newly created Business Role to an Organizational Model,
but them we would be deveiating from FrameWork and touching Master Data which is not covered in this book.
Now lets test the newly created Business Role ZHZ_SALESPRO in WebClient UI.
10. Execute transaction CRM_UI and CRM WebClient UI will open in a browser window.
11. Select the newly created Business Role (ZHZ_SALESPRO Sales Professional)

Creating Roles in SAP CRM and Assigning Rights

Use
Each portal role has a matching single role in SAP CRM. However,
there is no "technical" link between the portal role and the CRM
role. This link is established by the user, to whom roles are
assigned in Enterprise Portal 5.0 and in SAP CRM. A unique CRM
user is assigned to each portal user. For more information,
see Portal Roles.
Create a new role in SAP CRM using the Role Maintenance (PFCG)
transaction. To do this, copy the CRM role that most resembles
your new role.

Add to your new role all the authorizations that are required for
role content that comes from SAP CRM and is executed in the
portal.

Remove unnecessary authorizations when you remove role

content. For more information, see: Adapting Existing Portal Roles.

Creating a Role
...
...

1.
2.
3.

Log on to the CRM server

Choose transaction Role Maintenance (PFCG)
Select the desired role, for example, Sales Manager in the Portal
(SAP_PCC_SALES_MANAGER).
4. Choose Copy Role and enter a new name for the role in your namespace

To make changes at a later date, select the role and choose Change Role
5.
6.

Choose Copy All

Save your entries

Creating a Profile
...
...

1.
2.
3.
4.

Choose the Authorizations tab page.

Choose Suggest Profile Name
Create the authorization profile
Save your entries

Adding Authorization for a BSP

You have added a BSP (Business Server Page) to your new portal
role, for which there is a corresponding transaction in SAP CRM. To
give your CRM role rights for the BSP (Business Server Page), first
assign the corresponding transaction to the role and then the
start authorization for the BSP (Business Server Page).
Assigning Transactions
1.

Navigate to the Menu tab page and choose Transaction

The dialog box Assigning Transactions appears

2.

Enter the appropriate transaction code in the Transaction

Code field

3.

To assign the transaction code to the desired role,

choose Assign Transactions

4.

Save your entries

Assigning Authorizations
According to which authorization objects are already available,
follow one of the following three scenarios:
...

1.
2.

Choose the Authorizations tab page.

Choose Change Authorization Data.
The dialog box Change Role: Authorizations appears

3.

Choose Manual
The dialog box Manual Selection: Authorizations appears

Scenario 1: the CRM Component object class already exists

Check whether the authorization object Authorization for BSP

Applications (BSP_APPL) has already been defined. If this is the
case, extend it by adding a new BSP.
...

1.

Choose CRM Component Authorization for BSP Applications Application Scenario

2.

Choose Change
The dialog box Maintain Field Values appears.

3.

Select the new BSP from the field help

The values displayed in the field help correspond to the mandatory parameter APPL, which you
also use when defining your BSP (Business Server Page) in the portal in the Additional Query
String (Optional Property) field. For more information, see the section Configuring Additional
Application Parameters under Creating and Including a BSP for Business Object Data Views.

4.

Save your entries

Configure the views of the BSP contained in your role:

...

1.

Choose CRM Component Authorization for BSP Applications View for UI Display

2.

Choose Change
The dialog box Maintain Field Values appears

3.
4.

Choose the desired value from the field help

Enter a star (*) in the Of Value field if you want to allow all views.

The values displayed in the selection list correspond to the mandatory parameter BLVIEW,
which you also use when defining your BSP (Business Server Page) in the portal in
the Additional Query String (Optional Property)field. For more information, see the
section Configuring Additional Application Parameters under Creating and Including a BSP for
Business Object Data Views.
5. Save your entries

Scenario 2: the CRM Component object class does not exist

Add the Authorization for BSP Applications as described below:

...

1.

Choose Manual
The dialog box Manual Selection: Authorizations appears

2.
3.
4.

Choose the parameter BSP_APPL from the field help

Continue as described in Scenario 1
Save your entries

Scenario 3: the authorization for BSP applications is not yet defined in

the CRM component
Proceed as described in Scenario 2

Generating an Authorization Profile

1.
2.

Save your entries when you leave the Authorizations tab page
Generate the authorization profile

Adding Authorization for RFC Calls

You have added a Java iView to you new role, which generates
RFC calls to the CRM server. To add the authorization check during
RFC access, proceed as follows:
Assigning Authorizations
Add the authorization for the new iView manually. To do so,
determine the function groups of the iViews that contain the

function modules that are called via RFC. See: iViews and Their
Function Groups.
...

1.
2.

Choose the Authorizations tab page.

Choose Change Authorization Data.
The dialog box Change Role: Authorizations appears

3.

Choose Manual
The dialog box Manual Selection: Authorizations appears

4.
5.

Choose the parameter S_RFC from the field help

Save your entries

6.

Choose Cross-Application Authorization Objects Authorizations During RFC

Access Name of Protected RFC Object

7.

Choose Change
The dialog box Define Values appears

8.
9.

Choose the Function Group indicator

Save your entries

10.

Choose Cross-Application Authorization Objects Authorizations During RFC

Access Activity

11.

Choose Change
The dialog box Define Values appears

12.
13.
14.

Choose the Execute indicator

Save your entries
Generate the authorization profile