Roles
In Fiori, roles (PFCG business roles) tie everything together: they grant the backend authorizations and reference the catalogs and groups that determine which apps a user can launch and see. Role design is central to a working Fiori deployment.
A user needs the app on their launchpad (frontend) AND the authorization to run its backend service (backend).
- SAP delivers standard business roles for S/4HANA that bundle the right catalogs, groups and authorizations for common jobs (e.
- As always, design roles for least privilege, and keep frontend and backend authorizations consistent, so users get exactly the apps…
- Frontend content: references Fiori catalogs (available apps) and groups/spaces (arranged tiles).
- Watch out: Frontend app without backend authorization (or vice versa).
The dual job of a Fiori role
- Frontend content: references Fiori catalogs (available apps) and groups/spaces (arranged tiles).
- Backend authorization: grants the authorization objects the app’s OData service checks.
Why both halves matter
A user needs the app on their launchpad (frontend) AND the authorization to run its backend service (backend). If either is missing, they either do not see the tile or get an authorization error when opening it. In hub deployments, this often spans frontend and backend roles that must align.
SAP business roles
SAP delivers standard business roles for S/4HANA that bundle the right catalogs, groups and authorizations for common jobs (e.g. Accounts Payable Accountant). These are the recommended starting point, copy and adjust rather than building from scratch.
Design and least privilege
As always, design roles for least privilege, and keep frontend and backend authorizations consistent, so users get exactly the apps and data their job needs.
Common pitfalls
- Frontend app without backend authorization (or vice versa).
- Building roles from scratch instead of adapting SAP business roles.
- Misaligned frontend/backend roles in hub setups.