SAP administration · Lesson

Users

Quick answer

For scale, SU10 handles mass changes and Central User Administration (CUA) or an IGA tool manages users across many systems.

Key takeaways

Every person (and technical process) needs a user master record to log in.
The user record identifies the person; the roles assigned to it (via PFCG) grant what they can do.
Dialog: normal interactive users.
Watch out: Not deactivating leavers promptly, orphaned accounts.

What user administration covers

Every person (and technical process) needs a user master record to log in. Administrators create these in SU01, set the user type, assign roles (which grant authorizations), manage passwords, and lock/unlock or delete accounts as people join, change roles or leave. This lifecycle is the SAP equivalent of joiner-mover-leaver.

User types

Dialog: normal interactive users.
System / Communication: for interfaces and RFC (no interactive logon).
Service and Reference: for shared or template purposes.

Roles grant access, not the user record

The user record identifies the person; the roles assigned to it (via PFCG) grant what they can do. Keeping this separation clear, and following least privilege, is central to good security.

Mass and central administration

For scale, SU10 handles mass changes and Central User Administration (CUA) or an IGA tool manages users across many systems. Prompt deactivation of leavers is a key control and audit point.

Common pitfalls

Not deactivating leavers promptly, orphaned accounts.
Over-assigning roles instead of least privilege.
Wrong user type (e.g. dialog for an interface account).

Want to learn this properly?

Our live, instructor-led SAP Training covers this hands-on, with real projects and a certification path.

See the course Ask a question

Check your understanding

Which statement is true of Users?
- A. Invoice Verification (Logistics Invoice Verification) checks and posts vendor invoices, matching them against…
- B. Administrators create these in SU01, set the user type, assign roles (which grant authorizations), manage…
- C. Performance problems, slow transactions, reports or jobs, frustrate users and delay the business.
Show answer
B. Administrators create these in SU01, set the user type, assign roles (which grant authorizations), manage…
Covered in the “What user administration covers” section of this lesson.
Which of these also applies to Users?
- A. This lifecycle is the SAP equivalent of joiner-mover-leaver.
- B. Misconfigured conditions, wrong docs caught or missed.
- C. Not understanding how your module posts to FI.
Show answer
A. This lifecycle is the SAP equivalent of joiner-mover-leaver.
Covered in the “What user administration covers” section of this lesson.
Which part of the Learn SAP curriculum covers Users?
- A. SAP glossary
- B. SAP administration
- C. SAP release notes
Show answer
B. SAP administration
This lesson sits in the SAP administration section of the Learn SAP course.

Frequently asked questions

What does the term Users refer to in SAP?

User administration is the foundation of SAP security and operations: creating, maintaining and deactivating the user accounts through which people access the system. It is managed primarily with transaction SU01 and governed by strict controls.

How is access to Users controlled?

Every person (and technical process) needs a user master record to log in.

What is connected to Users in an SAP landscape?

Dialog: normal interactive users. System / Communication: for interfaces and RFC (no interactive logon). Service and Reference: for shared or template purposes.

What tends to go wrong with Users?

Not deactivating leavers promptly, orphaned accounts. Over-assigning roles instead of least privilege. Wrong user type (e.g. dialog for an interface account).