Updated 31 October 2026
SAP_ALL gives a user almost every authorization in the system. In production it should be limited to a tightly controlled emergency account, with every use logged and reviewed.
Why it comes up in audits
A user with SAP_ALL can do nearly anything, which makes every other control beside the point for that account. Common security guidance, such as that of the German-speaking SAP user group DSAG, is to keep it out of production and use it for emergency users only.
How to get rid of it
- Find who holds itUse SUIM or report RSUSR002, in every client. Don't forget background and interface users.
- Look for copiesThe profile S_A.SYSTEM, or roles full of wildcards, can give similar access under another name. Check what roles contain, not only what they're called.
- See what is really usedWorkload statistics show which transactions each user runs. Keep in mind that yearly tasks may not appear.
- Build a replacementGive each user a proper role for their actual work. System users need their own, narrower role.
- Test before you switchRun the replacement first in test, then in production. Use SU53 and the authorization trace when something fails.
- Remove it, with a way backAgree who to call if something stops, and keep firefighter access as the fallback.
- Keep checkingRun the same report periodically, so it doesn't creep back in.
While you're there
- Check standard users such as SAP*, DDIC and EARLYWATCH
- Delete SAP_NEW once new checks are in your role concept
- Make sure the Security Audit Log is on
- Look at debug-and-replace rights and direct table changes
See also: SAP firefighter access.
Questions about SAP_ALL
What is SAP_ALL?
SAP_ALL is a standard SAP profile that contains almost every authorization in the system. It is meant for very limited, controlled use.
How do I find who has SAP_ALL?
Use the user information system: transaction SUIM, or report RSUSR002, can list users by profile. Check all clients, and look for copies as well.
Is SAP_NEW a problem too?
It can be. SAP_NEW is meant for a short transition after an upgrade. Once new checks are in your role concept, it should go.
