Profiles
An authorization profile is the generated set of authorizations that actually gets assigned to a user, produced from a role in the Profile Generator (PFCG). Understanding profiles clarifies how role design becomes real access.
A common pitfall: you change a role’s authorizations but forget to regenerate the profile, so the change never reaches users.
- You design a role in PFCG (menu + authorization objects and values); when you generate it, SAP produces an authorization profile…
- Modern SAP uses generated profiles from PFCG (the Profile Generator).
- Understanding profiles clarifies how role design becomes real access.
- Watch out: Forgetting to regenerate the profile after role changes.
Profiles vs roles
You design a role in PFCG (menu + authorization objects and values); when you generate it, SAP produces an authorization profile containing those authorizations. The profile (not the role directly) is what is stored against the user and checked at runtime. In practice you always work through roles, and the profile is generated for you.
Generated vs manual profiles
Modern SAP uses generated profiles from PFCG (the Profile Generator). Older or special cases used manually-created profiles (SU02), but generated profiles from roles are the standard, they keep the menu, authorizations and profile in sync.
The importance of regeneration
A common pitfall: you change a role’s authorizations but forget to regenerate the profile, so the change never reaches users. After any authorization change, regenerate and confirm users are updated (a user-master comparison may be needed).
SAP_ALL and SAP_NEW
SAP_ALL is the all-powerful profile granting everything, appropriate only for tightly-controlled emergency/firefighter use, never for normal users. Recognising and controlling such powerful profiles is a key security responsibility.
Common pitfalls
- Forgetting to regenerate the profile after role changes.
- Assigning SAP_ALL to normal users.
- Mixing manual and generated profiles confusingly.