SAPFree worksheetPDF, Excel, Word exportSAP Business OneAll SAP Business One tools

SAP B1 User Permission Matrix Worksheet: Roles, Modules and Access Levels

SAP Business One authorizations are easy to set in a hurry and hard to review later. This matrix lets you decide roles on paper first, then set them in B1, and gives auditors a clean record of who can do what.

Free, optional. Reopen it on any device.

Download:

Role	User	Sales A/R	Purchasing A/P	Inventory	Production	Financials	Business partner master	Administration and setup	Full access count	Last reviewed

Total Full-access grants

Highest Full count in one role

Roles listed

Average Full grants per role

A high average suggests roles are too broad.

Segregation of duties rule of thumb: the same person should not both create business partners and post payments, or both raise and approve purchase orders. Check rows with a high Full count first. This matrix is a planning aid for the General Authorizations screen in Administration, System Initialization, Authorizations, not a replacement for it.

Want B1 access reviews automated?

We can scope a read-only report of users, authorizations and conflicts for your auditors.

Optional. The tool and every export work without this. No spam.

Was this tool useful?

How to use the matrix

List each job role as a row, with the user who holds it. For each module choose Full, Read only or None. Start from the least access each job needs, and add only when a user can show why. Keep the review date current. The totals show how many Full grants you have given and which role has the most. A role with Full across every module should be rare and attached to a named person, with the reason recorded. Export to Excel for your internal audit file or an ISO 27001 style access review.

How B1 authorizations work

In B1, Administration, System Initialization, Authorizations has General Authorizations and Authorization Groups. General Authorizations are set per user, in a tree by module, with Full Authorization, Read Only or No Authorization at each node. Child nodes inherit from parents unless changed. There are also data ownership authorizations, which limit what a user sees by owner or branch, and authorization groups for item or customer data. Superusers bypass these checks, so keep the number of superusers very small.

Segregation of duties

Segregation of duties means no single person controls a whole transaction path. The classic pairs are creating a vendor and paying it, raising a purchase order and approving it, and adjusting inventory and counting it. B1 supports this through authorizations and approval procedures together. Use the matrix to spot conflicts: if a row has Full on both Purchasing and Business partner master, ask whether approvals or a second reviewer cover the risk. Small teams cannot always separate everything, so document compensating controls.

Vendor create versus payment run
PO creation versus PO approval
Inventory adjustment versus stock count sign-off
Journal entry posting versus period close

Common mistakes

Most access problems come from shortcuts taken at go-live that never get reversed. Review these every six months.

Copying the administrator profile for a new hire
Leaving leavers active in the user list
Sharing a login between shift workers
Giving Read only to everything without checking that sensitive prices or cost fields are visible
No record of who approved the access

Frequently Asked Questions

Where do I set user permissions in SAP Business One?

Go to Administration, System Initialization, Authorizations, General Authorizations, choose a user and set each node to Full, Read Only or No Authorization. Data ownership and authorization groups are nearby. Menu labels vary a little between versions.

What is a superuser in B1?

A superuser has all authorizations and bypasses the permission checks, so keep the number small and tied to named administrators. Day-to-day staff should never be superusers, even for convenience.

Can I copy permissions from one user to another?

Yes, B1 lets you copy authorizations from another user. That is efficient but risky if the source user has extra access. Copy from a clean template user per role, which this matrix helps you define.

How often should access be reviewed?

At least twice a year, and at every role change or departure. Auditors usually expect a dated review with an approver. Export this matrix after each review and keep it with your IT controls evidence.

If you want an automated access review that reads B1 users and authorizations and flags conflicts, we can scope it as a read-only report. Contact us with your user count.

Talk to an Expert Explore More Free Tools