S/4HANA Public Cloud does not expose PFCG roles and authorization objects. Access is modelled as business roles containing IAM apps, restricted by restriction types and fields. This data source reads that model directly, so a Public Cloud tenant is analyzed on its own terms rather than being forced into an on-premise shape.
Setup
- Click Add → SAP files - public cloud
- Select the folder holding the six exported workbooks
- Click Save
Required exports
All six are mandatory. Each is an .xlsx export from the tenant, and the reader expects the data on the sheet named SAPUI5 Export, which is how the standard Fiori export names it.
| Export | Provides | Key columns |
|---|---|---|
| Business Users | The user list | User Name, E-Mail, First Name, Last Name, Business User Group, Locked, Valid, Valid From, Valid To |
| Business User Role Assignments | User to business role assignments | User Name, E-Mail, Business Role ID |
| IAM Apps - Business Roles | Role identity, description, and the apps each role activates | IAM App ID, Business Role ID, Transaction Code, IAM App Active |
| Restrictions - IAM Apps | Which restriction types and fields each app exposes | IAM App ID, Restriction Type ID or Restriction Type, Restriction Field ID or Authorization Field |
| Business Roles - Restrictions | Every restriction a role exposes, Restricted and Unrestricted alike | Business Role ID, Access Category, Access Restriction, Restriction Type, Restriction Field ID, Value Count |
| Business Roles - Restrictions Values | The explicit values behind Restricted entries | Business Role ID, Access Category, Restriction Type ID, Restriction Field ID, Restriction Value |
The last two are a pair and both are needed. The Restrictions export tells you a restriction exists and whether it is restricted; the Restriction Values export carries the actual values for the restricted ones. Supplying only the first leaves every restriction looking unbounded, which overstates access. Supplying only the second loses the unrestricted entries, which understates it.
Restrictions - IAM Apps is the fallback path: where a restriction type is not present in the Restriction Values export, the app-level definition is used to resolve it.
Rulesets for Public Cloud
A Public Cloud ruleset is written against IAM App IDs and restriction fields, not transaction codes and authorization objects. An on-premise ruleset will not fire against this data source, and vice versa. Keep them as separate rulesets and select the matching one when you run the analysis.
The System column of the ruleset must match this data source's name, as with any other source. See Creating Custom Rulesets.
Analyzing alongside on-premise systems
A Public Cloud tenant and an on-premise system can be loaded at the same time and analyzed together, which is the usual reason to do this: a conflict split across a cloud tenant and an ECC system is invisible in either one alone. That requires identity mapping, because the same person has different account names in each. See Cross-System Analysis.