Goods Movement Authorization Extension
Push authorization beyond movement type and storage — control inbound and outbound separately.
What problem does it solve?
Standard SAP authorization works at movement-type and storage-location level but doesn't distinguish movement direction (inbound/outbound); the same user can do both, opening unwanted authorization gaps.
How does the solution work?
Conforcus's authorization extension adds a movement-direction layer on top of the standard movement-type and storage authorization. Users can only post movements in the direction they're authorized for.
What changes in practice?
The additional check comes into play when a goods movement is posted. On top of the standard authorization check for movement type and storage location, the system evaluates the direction of the movement, inbound or outbound, and verifies whether the user is authorized for that direction. A user who tries to post in a direction they are not authorized for cannot complete the posting; even with full movement-type and storage-location authorization, the movement cannot be posted without authorization for its direction. Because the direction check is integrated with the MM authorization objects, direction authorization is granted to users through roles like any other authorization.
The warehouse manager can anchor the division of duties in a rule the system enforces: the team receiving goods can be authorized for inbound only, and the team issuing materials for outbound only. One person being able to post both receipts and issues stops being something that happens by default and becomes an authorization granted deliberately. An authorization gap can be seen, and closed, by looking at the role definition. In a segregation of duties (SoD) review, internal audit and the SAP authorization team can assess stock movements by who is authorized in which direction.
Benefits
- Authorization gaps closed — inbound and outbound controlled separately
- Users can only move stock in their authorized direction
- Stronger segregation of duties (SoD) over stock movements
Where it sits in SAP
Integrated with MM authorization objects; adds a movement-direction-based authorization check on top of standard movement-type/storage control.
Who it is for: Logistics & Warehouse Manager, Internal Audit, SAP Security & Authorizations
Frequently asked questions
Why is standard SAP authorization not enough, and what exactly does this solution add?
Standard authorization works at movement-type and storage-location level and does not distinguish whether a movement is inbound or outbound. The solution adds an authorization layer based on movement direction on top of that check. Existing movement-type and storage-location authorizations remain valid; the direction check does not replace them, it is added to them.
What does a user see when trying to post a movement in a direction they are not authorized for?
The posting is not completed, and the user receives an authorization message stating that they are not authorized to post in that direction. If the movement genuinely needs to be made, the answer is to add the direction authorization to the relevant role. That goes through the company's existing authorization request and approval procedure.
How is direction authorization defined, and what does it contribute to segregation of duties (SoD)?
Because the direction check is integrated with the MM authorization objects, direction authorization is granted through roles by the SAP authorization team. Which role is authorized for which direction is decided during implementation together with warehouse management and internal audit. As inbound and outbound are controlled separately, segregation of duties over stock movements becomes stronger.