Solution with BAdI 

The customer can implement this BAdI:

BAdI: /DSCSAG/PLM_01
Method: check_logon_data_before

METHOD /dscsag/if_ex_plm_01~check_logon_data_before.
 
  DATA: ls_return TYPE bapiret2.
 
  IF sy-uname EQ 'AUSER'.
*   This person is not allowed to work with ECTR
    logon_forbidden = 'X'.
    ls_return-type = 'E'.
    ls_return-message =　'You　are　not　allowed　to　work　with　ECTR.'.
    APPEND ls_return TO return.
  ENDIF.
 
 
ENDMETHOD.

Now unauthorized users get the following message in the ECTR logon process:

Solution with configuration and PFCG checks

Control usage of ECTR

To control the usage of ECTR you have to add this configuration into your default.txt file:

SAP.PLM.LOGON.CHECKAUTH = TRUE

Additionally you have to assign the user the authorization with PFCG roles to use transaction (object S_TCODE) '/DSCSAG/ECTR' for ECTR standard unit 7522  and / or transaction (object S_TCODE) '/DSCSAG/ECTR_PRO' for ECTR professional unit 7523.

See How to Measure CAD Users - Audit trail for Licences