Authorizations in SAP administration

Authorizations

Authorizations are the granular permissions that control what a user can actually do in SAP, checked at runtime against authorization objects. They are the mechanism beneath roles and the heart of SAP access control.

Quick answer

Fine-grained authorizations enable least privilege and separation of duties, ensuring, for example, that no one can both create and pay a vendor.

Key takeaways

When a user attempts an action, SAP performs authorization checks against authorization objects, each with fields (for example…
An authorization object groups related fields, for example, an object might check activity (create/change/display) and…
When a user hits an authorization error, transaction SU53 shows the failed check (which object and values were missing), and…
Watch out: Granting wide-open values (*) instead of specific ones.

How authorization checks work

When a user attempts an action, SAP performs authorization checks against authorization objects, each with fields (for example, activity, company code, plant) that must match values the user holds. The user’s values come from the authorization profiles generated from their roles. If the check fails, access is denied.

Authorization objects and fields

An authorization object groups related fields, for example, an object might check activity (create/change/display) and organizational level (which company code). A role grants specific field values, so you can allow "display for company code 1000" but not "create for company code 2000".

Diagnosing authorization errors

When a user hits an authorization error, transaction SU53 shows the failed check (which object and values were missing), and ST01/STAUTHTRACE traces checks in detail. This is the everyday tool for figuring out what a role is missing.

Least privilege and SoD

Fine-grained authorizations enable least privilege and separation of duties, ensuring, for example, that no one can both create and pay a vendor. Getting authorization design right is what makes SAP auditable.

Common pitfalls

Granting wide-open values (*) instead of specific ones.
Not using SU53/traces to diagnose errors.
Ignoring SoD conflicts in authorization design.

Practice challenge

+0 XPStreak ×0

Question 1 of 3

Which statement is true of Authorizations?

Frequently asked questions

What does the term Authorizations refer to in SAP?

Which transaction codes come up with Authorizations?

When a user hits an authorization error, transaction SU53 shows the failed check (which object and values were missing), and ST01/STAUTHTRACE traces checks in detail.

What else is worth knowing about Authorizations?

Fine-grained authorizations enable least privilege and separation of duties, ensuring, for example, that no one can both create and pay a vendor.

What tends to go wrong with Authorizations?

Granting wide-open values (*) instead of specific ones. Not using SU53/traces to diagnose errors. Ignoring SoD conflicts in authorization design.