Configuring Data Locking

Use data locking in SAP Analytics Cloud to prevent changes to specific data at different stages of the planning process. As a planning modeler, you can set up data locking and specify areas of model data to lock, restrict, and unlock, and you can also delegate ownership of data locks to other planners.

Prerequisites

  • Data Locking must be enabled in the model preferences before you can start configuring it. For details, see Set Up Model Preferences.

  • You must have the appropriate permissions to work with data locking. See Data Locking Permissions for details.

Context

When to Use Data Locking

There are several ways to secure data in your model. Use data locking on model data that needs to be unlocked at certain stages of the planning process and then locked again, and when you want to delegate data security to other users who aren’t admins. For an overview of other data security features like validation rules and data access control, see Learn About Data Security in Your Model.

If you're looking for information about value locks, see About Value Lock Management instead. This is a separate feature that lets users control how data entry in a table is disaggregated.

How Data Locking Works

You configure data locks in a grid layout, by choosing driving dimensions and setting combinations of their members as locked, open, or restricted.

In a story or analytic application, locked and restricted cells for public versions appear as read-only, and cannot be changed by data entry or other planning operations. (You can plan on these cells by selecting Ignore Data Locks () from the table context menu, but data locks will still be enforced when you publish the version.)

Delegating Ownership of Data Locks

You can also delegate ownership of the data locks on members of a dimension. For example, you might do this to let managers for specific products or regions handle these data locks. Data locking owners gain a few privileges for the data that they own:

  • They can make changes to restricted data.

  • They can set locks to a more restrictive state, for example, Open to Restricted, or Restricted to Locked.

  • For members that are children or descendants of the member that they own, they become data locking managers. They can open restricted or locked data that they manage. For example, as the data locking owner for Footwear in EMEA, you become the data locking manager for Sneakers in Germany. You can't change the overall value for Footwear in EMEA once it's locked, but you can unlock different products and countries to change the distribution of that value.

Users with the appropriate permissions can also change the state of data locks from a story or analytic application. To do so, right-click the table or select (More Actions), then choose Manage Data Locks... ( ).

For example, if your organization is carrying out a forecast across different regions for 2018 Q4, this feature lets you lock all the model data for regular users, and grant permission only to regional managers to update their own region’s data for the Forecast version in 2018 Q4. For a detailed workflow based on this example, see Example: Applying Data Locks to a Regional Forecast.

Scheduling Data Locks

If you're using data locking frequently in your planning processes, you can create manual data locking task in the calendar to establish a schedule and coordinate with data locking owners. You can also schedule data locking tasks that lock the data automatically at a certain time. See Schedule Data Locks in the Calendar for details.

Data Locking Permissions

A few different permissions are required to set up and work with data locking. In general, users with the Planning Modeler or Planning Admin role will configure data locking, and users with the Planner Reporter role may be able to change the state of data locks.

The following table shows the permissions for data locking, the roles that include them, and the required license types. For background information, see Permissions.

Permission Description Standard roles License requirement
Create Lets you turn on data locking for a model. Admin, Modeler SAP Analytics Cloud for planning, professional edition
Update Lets you set up data locking for a model, including turning it off. Admin, Modeler SAP Analytics Cloud for planning, professional edition
Delete Lets you turn off data locking for a model. Admin, Modeler SAP Analytics Cloud for planning, professional edition
Maintain Lets you change the state of data locks. Admin, Modeler, Planner Reporter SAP Analytics Cloud for planning, professional edition or standard edition
Read Lets you see the data locks in a table. Admin, Modeler, Planner Reporter, Viewer SAP Analytics Cloud for planning, professional edition or standard edition

Data locking tasks can also require permissions for the specific model and dimensions involved:

Detailed Permissions for Data Locking Tasks
  Data Locking Permission Model Permission Dimension Permission
Task Create Read Update Delete Maintain Read Update Read Update
Turn data locking on X X       X X    
Turn data locking off   X X   X X    
Change the default lock state   X X     X X    
Change the driving dimensions   X X     X   X  
Turn ownership on or off for a dimension   X       X   X X
Change responsible users for a dimension           X X X X
Change owners from the data locking dialog   X       X   X X
Change any lock state   X X   X X   X  
Change locks that you own or manage   X     X X   X  
View locks   X       X   X  

Data Disaggregation to Locked Child Members

Data disaggregation occurs when a value from a parent member is automatically spread to the child members that aggregate up to it. As a default, locked child members will still receive values from data disaggregation when data changes occur to the parent member.

You can change this behavior by enabling Data Disaggregation based on Data Locking in the model preferences if you want locked values to remain fixed. For more information, refer to Set Up Model Preferences.

Redeploy Data Locks

If you want to regenerate your data locks, you can use the Redeploy Model option in model preferences. In the rare case that the data locking configuration cannot be recovered, it must be reset manually. For more information, see the Redeploy Model section of Data and Performance.

Exceptions and Restrictions

Check the following points to make sure that data locking works for your use case:

  • Power users: Data locks do not apply to users with the admin role, or the user who created the model. These users can import data, delete data, and publish their changes to public versions, even if it affects locked data.

  • Models with measures: When measures are added as a driving dimension, a data lock on one measure will impact data management in the modeler for all other measure values that belong to the same set of dimension members. This issue affects importing and deleting fact data in the modeler. For details about this behavior in models with measures, see Treatment of Measures from the Same Set of Dimension Members.

  • Advanced filters: If you need to use data locking on tables with advanced filters, check Data Locking with Advanced Filters to make sure your filter is compatible.

  • Multiple hierarchies in the modeler: Data locks can only be set on the default hierarchy. If the default hierarchy of any driving dimension is changed in the modeler, some of the data locks might be lost and you will need to reapply them.

  • Multiple hierarchies in stories: If you are viewing data locks in a non-default hierarchy, the data locks will be based on the default hierarchy and may be different than they appear in the non-default hierarchy. If a non-leaf member in this hierarchy is a leaf member in the default hierarchy, changing the data locks in this hierarchy will not change the data locks in the default hierarchy.

  • Restricted measures and accounts: Data locks cannot be directly set on restricted measures or accounts. Their lock states come from the locked states of their source’s measures or accounts, based on existing restrictions. If you want to change the lock state of a restricted measure or account, you need to change the lock state of the source measure or account. This is also true for conversion measures.

  • Other calculated measures and accounts: Data locks cannot be directly set on calculated measures or accounts. These cells will not appear locked when displayed in a table. However, data locks will still be enforced when you try to publish the changes and any changes to locked values will not publish.

Procedure

  1. Select (Configure Data Locks).

    The Data Locking page is displayed, with the driving dimensions prefiltered based on the members of the ownership-enabled dimensions that are owned by the current user.

  2. Set the driving dimensions.

    If you are configuring data locking for the first time for this model, the driving dimensions are displayed. Otherwise, select (Edit Driving Dimensions) to show them.

    You apply data locks to sets of members from each driving dimension. For example, if you want to lock the 2018 Forecast for North America, you can use Version, Date, and Organization as your driving dimensions.

    Note
    • Version and date are mandatory driving dimensions.
    • Any data lock settings that are configured for the existing driving dimensions will be reset when you add a driving dimension.
    • For a model with measures, you can add measures as one of the driving dimensions.
    1. To add a new driving dimension, select +Add a new Driving Dimension and choose the dimension from the list. A maximum of four driving dimensions is allowed.
    2. To delegate ownership of the locks applied to specific members of the dimension, select the checkbox in the Enable Ownership column.
    3. If a Responsible Person column has been set up for the dimension to identify responsible users for each member, you can select Copy Responsible Users to set these users as data locking owners.

      These settings can be edited later, on the Data Locking page or in the Modeler.

    4. When you have finished configuring driving dimensions, select Finish Editing.
  3. Drill, filter, and hide the driving dimensions as necessary.
    • To filter the members of a driving dimension, select the dimension.
    • To set the drill level, select (Drill dimension) next to the dimension name.

    • To hide dimensions from the grid, select (Show / Hide Driving Dimensions) and deselect the dimension. Any changes to the lock states will apply to all members of the hidden dimensions.

  4. The (Apply the ownership-based filters) button can be used to apply and reset the filters.
    It behaves as follows:
    • If the button is selected, clicking it resets all existing filters (all filters will be removed from all dimensions).
    • If the button is not selected, clicking it applies the ownership-based filters. For driving dimensions without ownership enabled, empty filters are applied.
    • If the button is selected, and you manually change any filters, the button becomes deselected.
    • If there are no ownership-based driving dimensions, or if you don't own any members of the existing driving dimensions, the button is disabled.
  5. Select Show Grid to display a grid of the driving dimensions where you can set the lock state of each cell.
    Note
    When you're setting up data locking, the grid always shows the default hierarchy of each driving dimension. Use these default hierarchies when you're entering data in a story too, so that you can see the lock state of each cell. If you display a different hierarchy for a driving dimension, you might enter data to locked cells. In this case, you'll have to discard those changes to publish your data.
    Note
    The default setting is determined by the Default Lock State in the model preferences.
  6. To set the lock state for a cell, choose the cell that represents the appropriate combination of members, select and choose the state from the list:
    • Open: Values are unlocked for this combination of members in table, and can be changed by any users who have permissions to enter values for the model.
    • Restricted: Values can be changed only by a user who has effective ownership of locks on this combination of members.
    • Locked: Values cannot be changed for this combination of members in a table.

    When you change the state for a parent member in a dimension, the same state is applied to its child members as well. For example, if you lock North America, then the United States and Canada will also be locked.

  7. If necessary, set data locking owners.

    When you set a cell to Restricted, you can set owners for the member of each driving dimension with data locking ownership enabled.

    1. Select the restricted cell and choose (Select owners of the selected slice).
    2. Select Add Owner under a driving dimension and choose one or more owners for the selected member of that driving dimension.
      Note
      • When multiple driving dimensions have data locking ownership enabled, a user must own the appropriate member from each dimension to receive ownership privileges for a specific cell. These users are known as effective owners. The effective owners for a cell are listed in the Set Owners page.
      • If you chose a parent member, the selected users also receive ownership of its children.
      • Users with the appropriate data locking permissions, such as modelers and admins, can still update any lock state.
    3. Select OK.
    4. Continue setting owners for restricted cells as necessary.
  8. When you have finished setting locks in the grid, select Close to return to the model.

Results

The data locks that you configured are applied to the model data in stories.

For the dimensions that have data locking ownership enabled, the Data Locking Owner column is added in the Modeler. You can add data lock owners for each member by adding their IDs in this column.

Data Locking with Advanced Filters

Some types of advanced filters aren’t compatible with data locking. In this case, none of the cells in the filtered table will be locked. Data locks will still be enforced when you publish the version, so you might not be able to publish all of your changes. The table shows the following warning: Data lock visualization is disabled as some of the active filters are not supported: Advanced Filters

Compatible advanced filters need to follow these rules:

  • They can’t explicitly exclude members, either by the Exclude () option in the table context menu, by an exclude condition, or by a Does not equal operator.

  • They need to contain a certain combination of dimension members, known as a Cartesian product: Each dimension member included in the filter needs to be included for all of the other dimensions’ member combinations in the filter.

    To follow this rule, you’ll usually need to avoid picking members from different hierarchy levels in the filter conditions, too. For example, a condition that includes 2022 H1 isn’t considered equivalent to one that includes 2022 Q1 and Q2.

For these reasons, it’s usually easiest to create a compatible advanced filter by right-clicking a selection of table cells that meets the second condition and selecting Filter ().

For a detailed example of this rule, consider a table that has a Product Group dimension and a Geography dimension added to the rows:

  A B C D E F
1   Geography America Canada
2   Product Group Cell Phones Laptops Cell Phones Laptops
3 Account Units Sold – – – –
Valid advanced filters for data locking include:

  • Any individual cell

  • Cell Phones and Laptops for both Canada and America (cells C3-F3)

  • Cell Phones and Laptops for America (cells C3-D3) or Canada (cells E3-F3)

  • Cell Phones for America and Canada (cells C3 and E3) or Laptops for America and Canada (cells D3 and F3)