SAP administration · Lesson

Roles

Quick answer

Well-designed roles grant exactly what a job needs, no more.

Key takeaways

An SAP role is a container of authorizations (and often a menu) representing what a particular job function should be able to do…
In PFCG you add transactions/apps to the role menu, then maintain the authorization objects (with their field values) that those…
Single role: a set of authorizations plus a menu, generated into a profile.
Watch out: Over-broad roles violating least privilege.

What a role is

An SAP role is a container of authorizations (and often a menu) representing what a particular job function should be able to do, for example an "AP Clerk" role granting the transactions and authorization objects needed to process vendor invoices. Users get access by being assigned roles, never by direct authorizations.

Single vs composite roles

Single role: a set of authorizations plus a menu, generated into a profile.
Composite role: a bundle of single roles, convenient for assigning a whole job’s worth of access at once.

How roles are built (PFCG)

In PFCG you add transactions/apps to the role menu, then maintain the authorization objects (with their field values) that those transactions check, and generate the authorization profile. Getting the authorization-object values right is the craft of SAP security.

Roles and least privilege

Well-designed roles grant exactly what a job needs, no more. Over-broad roles create audit findings and risk; a clean role design is foundational to SAP security and SoD control.

Common pitfalls

Over-broad roles violating least privilege.
Assigning authorizations directly instead of via roles.
Not regenerating profiles after changing a role.

Want to learn this properly?

Our live, instructor-led SAP Training covers this hands-on, with real projects and a certification path.

See the course Ask a question

Check your understanding

Which statement is true of Roles?
- A. An SAP role is a container of authorizations (and often a menu) representing what a particular job function…
- B. A cost center is a controlling (CO) organizational unit that represents where costs are incurred, a…
- C. These Fiori examples show the modern SAP user experience in practice, using standard apps, and the building…
Show answer
A. An SAP role is a container of authorizations (and often a menu) representing what a particular job function…
Covered in the “What a role is” section of this lesson.
Which of these also applies to Roles?
- A. Expecting Fiori to replace all GUI, config and long-tail transactions remain in GUI.
- B. Building custom IDocs when a standard type exists.
- C. Users get access by being assigned roles, never by direct authorizations.
Show answer
C. Users get access by being assigned roles, never by direct authorizations.
Covered in the “What a role is” section of this lesson.
Which part of the Learn SAP curriculum covers Roles?
- A. SAP how-to guides
- B. SAP MM
- C. SAP administration
Show answer
C. SAP administration
This lesson sits in the SAP administration section of the Learn SAP course.

Frequently asked questions

What does the term Roles refer to in SAP?

Roles are how access is granted in SAP: a role bundles the authorizations a job needs, and assigning the role to a user gives them that access. Roles are built and maintained with the Profile Generator, transaction PFCG.

Which transaction codes come up with Roles?

In PFCG you add transactions/apps to the role menu, then maintain the authorization objects (with their field values) that those transactions check, and generate the authorization profile.

What is another point to note about Roles?

Well-designed roles grant exactly what a job needs, no more.

What tends to go wrong with Roles?

Over-broad roles violating least privilege. Assigning authorizations directly instead of via roles. Not regenerating profiles after changing a role.