Authorizations
Quick answer
Fine-grained authorizations enable least privilege and separation of duties, ensuring, for example, that no one can both create and pay a vendor.
Key takeaways
- When a user attempts an action, SAP performs authorization checks against authorization objects, each with fields (for example…
- An authorization object groups related fields, for example, an object might check activity (create/change/display) and…
- When a user hits an authorization error, transaction SU53 shows the failed check (which object and values were missing), and…
- Watch out: Granting wide-open values (*) instead of specific ones.
How authorization checks work
When a user attempts an action, SAP performs authorization checks against authorization objects, each with fields (for example, activity, company code, plant) that must match values the user holds. The user’s values come from the authorization profiles generated from their roles. If the check fails, access is denied.
Authorization objects and fields
An authorization object groups related fields, for example, an object might check activity (create/change/display) and organizational level (which company code). A role grants specific field values, so you can allow "display for company code 1000" but not "create for company code 2000".
Diagnosing authorization errors
When a user hits an authorization error, transaction SU53 shows the failed check (which object and values were missing), and ST01/STAUTHTRACE traces checks in detail. This is the everyday tool for figuring out what a role is missing.
Least privilege and SoD
Fine-grained authorizations enable least privilege and separation of duties, ensuring, for example, that no one can both create and pay a vendor. Getting authorization design right is what makes SAP auditable.
Common pitfalls
- Granting wide-open values (*) instead of specific ones.
- Not using SU53/traces to diagnose errors.
- Ignoring SoD conflicts in authorization design.
Want to learn this properly?
Our live, instructor-led SAP Training covers this hands-on, with real projects and a certification path.
Check your understanding
Which statement is true of Authorizations?
- A. When a user attempts an action, SAP performs authorization checks against authorization objects, each with…
- B. The database layer is where all SAP data physically lives, every master record, transaction document and…
- C. IDoc errors interrupt document-based integration (orders, invoices, master data).
Show answer
A. When a user attempts an action, SAP performs authorization checks against authorization objects, each with…
Covered in the “How authorization checks work” section of this lesson.
Which of these also applies to Authorizations?
- A. The user’s values come from the authorization profiles generated from their roles.
- B. Reading tables directly instead of using CDS/reports where appropriate.
- C. Learning screens, not the end-to-end process.
Show answer
A. The user’s values come from the authorization profiles generated from their roles.
Covered in the “How authorization checks work” section of this lesson.
Which part of the Learn SAP curriculum covers Authorizations?
- A. SAP administration
- B. SAP HANA
- C. SAP interview questions
Show answer
A. SAP administration
This lesson sits in the SAP administration section of the Learn SAP course.