Users
User administration is the foundation of SAP security and operations: creating, maintaining and deactivating the user accounts through which people access the system. It is managed primarily with transaction SU01 and governed by strict controls.
For scale, SU10 handles mass changes and Central User Administration (CUA) or an IGA tool manages users across many systems.
- Every person (and technical process) needs a user master record to log in.
- The user record identifies the person; the roles assigned to it (via PFCG) grant what they can do.
- Dialog: normal interactive users.
- Watch out: Not deactivating leavers promptly, orphaned accounts.
What user administration covers
Every person (and technical process) needs a user master record to log in. Administrators create these in SU01, set the user type, assign roles (which grant authorizations), manage passwords, and lock/unlock or delete accounts as people join, change roles or leave. This lifecycle is the SAP equivalent of joiner-mover-leaver.
User types
- Dialog: normal interactive users.
- System / Communication: for interfaces and RFC (no interactive logon).
- Service and Reference: for shared or template purposes.
Roles grant access, not the user record
The user record identifies the person; the roles assigned to it (via PFCG) grant what they can do. Keeping this separation clear, and following least privilege, is central to good security.
Mass and central administration
For scale, SU10 handles mass changes and Central User Administration (CUA) or an IGA tool manages users across many systems. Prompt deactivation of leavers is a key control and audit point.
Common pitfalls
- Not deactivating leavers promptly, orphaned accounts.
- Over-assigning roles instead of least privilege.
- Wrong user type (e.g. dialog for an interface account).