Hi Nancy
It's already been said that there is no switch/parameter to do this
It comes back to clearly defining a decommission plan that goes through each process area to determine what is required. At a starting point you could look at:
- Identity the group of users who really need the access (your business might identify a central team instead of everyone having access - much easier to stop users forgetting they are on a new system and simplify data access and training).
- Less people with access is also easier to remind them not to press save or post (if for some reason they still have update permissions).
- Work the the process areas to identify what needs to be access and how frequently (what didn't get migrated, what is required for historical checks and what needs to be accessible if auditors/other areas ask for evidence). This break down will also determine who actually needs the access.
- Display/reporting role for each process area (and if you need to cut down to specific enterprise areas)
- Build a support role type level that provides table access (if you need to)
- Consider if there is a need to export data to a business warehouse or similar if historical reports are necessary
- Some access can be limited through config/data settings - for example close all posting periods to prevent someone from accidentally posting a transaction. Talk with your functional experts for these options.
- Talk with the tech team (Basis, etc) to see what periodic jobs needs to be scheduled and even system/setup performance/hardware reductions to save a bit on cost.... though this might already be covered in your project.
Depending on your system requirements, access to the legacy data shouldn't need to be. Therefore, if you have an authorisation error on the display access (better to be too restrictive) then you should have the time to fix the role
Do not attempt to build a SAP_ALL display role or you will risks inadvertently providing change access.
A large part of this is around the change management and figuring out what actual legacy data access is required as part of day-to-day versus occasionally checking or compliance (must retain data for x number of years type deal).
On a positive - you have a few months to sort this out. Many places get a few weeks/days out from go live before they have this realisation.
Regards
Colleen