Even when two users belong to the same groups, differences in security settings, system parameters, or personal preferences can cause them to see different screens, functions, or data. Work through the sections below to identify and fix the cause.
Same groups but different screens or views
Work through the following checks in order. Each is a common cause of access inconsistency between users who appear to have identical group permissions.
Check their User Views. Go to Maintain User Views and compare each user's base level, company, and entity (region or office). A different view produces a different layout, even with identical group access.
Check their current desktop. Go to User Workbench, open each user's record, select the Preferences tab, and compare the Current Desktop field. A different desktop controls which tabs, sections, and fields appear on screen.
Check which company they're logged into. Ask both users to confirm the company name shown in the top header of their session. Access, menus, and visible data can differ by company.
Check their Job Security Groups. Go to User Workbench, open each user's record, and compare the Job Security tab. A user with no job security groups assigned will see different job-related data from a user with groups set — even if their function groups are identical. Setting the value to * gives access to all job security groups.
Check Service Order and Agreement Security. In User Workbench, compare the service security settings for each user. Differences here cause inconsistencies in Service Management screens.
Check their Column Sets. Confirm both users are using the same column set for the affected screen. Different column sets change which columns are visible.
Check Field Access Maintenance. Search for the specific function or field in Field Access Maintenance to confirm whether field-level security is restricting visibility for one user.
⚠️Important: Job Security Groups is the most commonly missed setting. If views, desktop, and company all match, check Job Security before escalating.
Functions appear allowed despite restricted group access
If your environment uses the SY/MENUSEC parameter set to Y, granting a user access to a parent menu function automatically allows all child functions under it. The Allowed tick shown in User Function Access is conditional — it only becomes active if the user already has access to the parent through their group. It does not override group-level restrictions.
To restrict specific child functions without changing the SY/MENUSEC parameter, use the Deny Functions field on the group record.
Go to System Setup, then Groups.
Open the relevant group record using the folder icon.
Locate the Deny Functions field.
Enter the function code you want to restrict (for example, %WPO101ABPOHL).
Save your changes.
📌Note: Only system administrators should modify group function access or deny settings. Incorrect changes can affect all members of the group.
A user can only see their own batches
Whether a user can see another user's batches is controlled by three rules working together.
Security Level: a user can only view and maintain batches created by users with an equal or lower security level.
Prime Group: the viewing user must be a member of the same Prime Group as the batch creator.
SY/EQACCESS parameter: if both users have the same security level, this parameter must be set to Y to allow cross-user batch visibility.
Enable equal access between same-level users
If both users are on the same security level and the same Prime Group but cannot see each other's batches, enable the SY/EQACCESS parameter.
Go to System, then System Setup, then SY Parameters.
Search for SY/EQACCESS.
If the parameter exists, set the value to Y and save.
If the parameter does not appear, select Add and create it with the value Y, then save.
⚠️Important: SY/EQACCESS is found under System > System Setup > SY Parameters — not Global Parameters. If the Add option is not available, you may not have System Administrator access.