Prevent User to logon to SAP BW Backend via AO

Hi there,

we would like to use AO in combination with BO Server to connect to BW.

For this we would not want the users to be able to connect directly to BW by simply "skipping" the BO logon pad.

So does anyone know which authorization is responsible to allow the user to be able to logon at BW directly?

Thanks in advance,

Oliver