Profiles
Quick answer
A common pitfall: you change a role’s authorizations but forget to regenerate the profile, so the change never reaches users.
Key takeaways
- You design a role in PFCG (menu + authorization objects and values); when you generate it, SAP produces an authorization profile…
- Modern SAP uses generated profiles from PFCG (the Profile Generator).
- Understanding profiles clarifies how role design becomes real access.
- Watch out: Forgetting to regenerate the profile after role changes.
Profiles vs roles
You design a role in PFCG (menu + authorization objects and values); when you generate it, SAP produces an authorization profile containing those authorizations. The profile (not the role directly) is what is stored against the user and checked at runtime. In practice you always work through roles, and the profile is generated for you.
Generated vs manual profiles
Modern SAP uses generated profiles from PFCG (the Profile Generator). Older or special cases used manually-created profiles (SU02), but generated profiles from roles are the standard, they keep the menu, authorizations and profile in sync.
The importance of regeneration
A common pitfall: you change a role’s authorizations but forget to regenerate the profile, so the change never reaches users. After any authorization change, regenerate and confirm users are updated (a user-master comparison may be needed).
SAP_ALL and SAP_NEW
SAP_ALL is the all-powerful profile granting everything, appropriate only for tightly-controlled emergency/firefighter use, never for normal users. Recognising and controlling such powerful profiles is a key security responsibility.
Common pitfalls
- Forgetting to regenerate the profile after role changes.
- Assigning SAP_ALL to normal users.
- Mixing manual and generated profiles confusingly.
Want to learn this properly?
Our live, instructor-led SAP Training covers this hands-on, with real projects and a certification path.
Check your understanding
Which statement is true of Profiles?
- A. The profile (not the role directly) is what is stored against the user and checked at runtime.
- B. SAP BPC (Business Planning and Consolidation) supports financial planning, budgeting, forecasting and legal…
- C. This reference hub is the lookup layer of the SAP course, the authoritative detail on transaction codes…
Show answer
A. The profile (not the role directly) is what is stored against the user and checked at runtime.
Covered in the “Profiles vs roles” section of this lesson.
Which of these also applies to Profiles?
- A. Upgrading without reading the notes.
- B. In practice you always work through roles, and the profile is generated for you.
- C. Using the wrong variant (e.g. create vs change vs display).
Show answer
B. In practice you always work through roles, and the profile is generated for you.
Covered in the “Profiles vs roles” section of this lesson.
Which part of the Learn SAP curriculum covers Profiles?
- A. SAP certification
- B. SAP administration
- C. SAP glossary
Show answer
B. SAP administration
This lesson sits in the SAP administration section of the Learn SAP course.