Roles
Roles are how access is granted in SAP: a role bundles the authorizations a job needs, and assigning the role to a user gives them that access. Roles are built and maintained with the Profile Generator, transaction PFCG.
Well-designed roles grant exactly what a job needs, no more.
- An SAP role is a container of authorizations (and often a menu) representing what a particular job function should be able to do…
- In PFCG you add transactions/apps to the role menu, then maintain the authorization objects (with their field values) that those…
- Single role: a set of authorizations plus a menu, generated into a profile.
- Watch out: Over-broad roles violating least privilege.
What a role is
An SAP role is a container of authorizations (and often a menu) representing what a particular job function should be able to do, for example an "AP Clerk" role granting the transactions and authorization objects needed to process vendor invoices. Users get access by being assigned roles, never by direct authorizations.
Single vs composite roles
- Single role: a set of authorizations plus a menu, generated into a profile.
- Composite role: a bundle of single roles, convenient for assigning a whole job’s worth of access at once.
How roles are built (PFCG)
In PFCG you add transactions/apps to the role menu, then maintain the authorization objects (with their field values) that those transactions check, and generate the authorization profile. Getting the authorization-object values right is the craft of SAP security.
Roles and least privilege
Well-designed roles grant exactly what a job needs, no more. Over-broad roles create audit findings and risk; a clean role design is foundational to SAP security and SoD control.
Common pitfalls
- Over-broad roles violating least privilege.
- Assigning authorizations directly instead of via roles.
- Not regenerating profiles after changing a role.