EBSintermediate
Multi-Org Access Control (MOAC)
Explain how EBS R12 enables users to access multiple operating units without switching responsibilities
Multi-Org Access Control (MOAC), introduced in R12, allows a single responsibility to access data across multiple Operating Units (OUs) without requiring users to switch responsibilities for each OU. Prior to R12, in classic Multi-Org, users needed a separate responsibility per operating unit, which was cumbersome for shared-service organizations.
MOAC is like a hotel master keycard that opens multiple rooms (operating units) without needing a separate key for each — but the hotel's security system (VPD) still checks silently behind the scenes that the card is authorized for each room before letting you in.
Key Concepts
1
MOAC works through a Security Profile that defines the list of operating units a responsibility can access, assigned via HR Security Profiles or directly through the Multi-Org security profile. The MO: Security Profile profile option points to this security profile, and MO: Default Operating Unit sets the default OU shown when the user logs in.
Security ProfileMO: Security ProfileMO: Default Operating Unit
2
At runtime, EBS uses Virtual Private Database (VPD) policies applied to key transactional tables (like AP_INVOICES_ALL) that automatically filter rows based on the operating units in the user's security profile context, set via MO_GLOBAL.INIT. This means the same SQL query returns different rows for different users transparently, without application code needing explicit OU filters everywhere (though best practice still recommends including org_id in WHERE clauses for performance).
Virtual Private Database (VPD)MO_GLOBAL.INIT
3
Interviewers often ask how to debug 'no data found' issues that are actually MOAC filtering problems — a very common real-world scenario where a user simply doesn't have the right OU in their security profile context.