How role sprawl starts
Nobody plans it. Someone needs access quickly, so a role gets copied and one transaction is added. A project ends and its roles stay. Five years later a user holds twenty roles, half of them unused, and the system still works, so nobody looks.
Copies of copies
Roles that differ by one transaction, and nobody knows which one is the real one.
No owner
Nobody in the business feels responsible, so nobody can approve a change.
Wildcards
A star in the wrong field, added once to stop an error message.
Technical names
Role names that mean nothing to the manager who has to approve them.
What a role concept should do
A good authorization concept is not the one with the fewest roles. It's the one where you can answer three questions without opening a spreadsheet from 2019.
- What does this role do? A naming convention and a description that a business owner understands.
- Who decides? A named role owner, and a request and approval route that is actually followed.
- Where does it apply? Master and derived roles for organisational levels, instead of one copy per company code.
Where we look first
| Question | Where the evidence sits |
|---|---|
| Who has what? | User and role reports in SUIM |
| Is the access used? | Workload statistics, such as ST03N |
| Why did a check fail or pass? | SU53 and the authorization trace in STAUTHTRACE |
| What should a role contain? | Proposals in SU24, and the role itself in PFCG |
Usage data helps, but it isn't the whole truth. Year-end and audit transactions may run once a year, and statistics are often kept for a limited time.
Questions about SAP authorizations
What does an SAP authorization consultant do?
An SAP authorization consultant designs, cleans up and reviews the roles that decide what people can do in SAP. That includes the role concept, naming, ownership and the process for requesting and approving access.
What is the difference between a role, a profile and an authorization object?
A role is what you manage and assign in PFCG. It generates a profile, which holds the actual authorizations. An authorization object is the check SAP runs, with field values such as a company code or an activity.
Should we clean up our roles or start again?
That depends on how far the concept has drifted. If the structure is sound and the roles are just too broad, cleaning up is usually enough. If nobody can explain the roles any more, a redesign can be cheaper in the long run.
