SAP Fiori · Lesson

Roles

Quick answer

A user needs the app on their launchpad (frontend) AND the authorization to run its backend service (backend).

Key takeaways

SAP delivers standard business roles for S/4HANA that bundle the right catalogs, groups and authorizations for common jobs (e.
As always, design roles for least privilege, and keep frontend and backend authorizations consistent, so users get exactly the apps…
Frontend content: references Fiori catalogs (available apps) and groups/spaces (arranged tiles).
Watch out: Frontend app without backend authorization (or vice versa).

The dual job of a Fiori role

Frontend content: references Fiori catalogs (available apps) and groups/spaces (arranged tiles).
Backend authorization: grants the authorization objects the app’s OData service checks.

Why both halves matter

A user needs the app on their launchpad (frontend) AND the authorization to run its backend service (backend). If either is missing, they either do not see the tile or get an authorization error when opening it. In hub deployments, this often spans frontend and backend roles that must align.

SAP business roles

SAP delivers standard business roles for S/4HANA that bundle the right catalogs, groups and authorizations for common jobs (e.g. Accounts Payable Accountant). These are the recommended starting point, copy and adjust rather than building from scratch.

Design and least privilege

As always, design roles for least privilege, and keep frontend and backend authorizations consistent, so users get exactly the apps and data their job needs.

Common pitfalls

Frontend app without backend authorization (or vice versa).
Building roles from scratch instead of adapting SAP business roles.
Misaligned frontend/backend roles in hub setups.

Want to learn this properly?

Our live, instructor-led SAP Training covers this hands-on, with real projects and a certification path.

See the course Ask a question

Check your understanding

Which statement is true of Roles?
- A. Good configuration practice keeps customizing aligned to standard, well-documented, and maintainable, so the…
- B. An instance is a unit of an SAP system, a set of work processes and shared memory running on an application…
- C. If either is missing, they either do not see the tile or get an authorization error when opening it.
Show answer
C. If either is missing, they either do not see the tile or get an authorization error when opening it.
Covered in the “Why both halves matter” section of this lesson.
Which of these also applies to Roles?
- A. Staying a generalist, depth is what the market pays for.
- B. In hub deployments, this often spans frontend and backend roles that must align.
- C. Querying raw tables instead of reusable views.
Show answer
B. In hub deployments, this often spans frontend and backend roles that must align.
Covered in the “Why both halves matter” section of this lesson.
Which part of the Learn SAP curriculum covers Roles?
- A. SAP Fiori
- B. SAP reference
- C. SAP integration
Show answer
A. SAP Fiori
This lesson sits in the SAP Fiori section of the Learn SAP course.

Frequently asked questions

What does Roles mean in SAP Fiori?

In Fiori, roles (PFCG business roles) tie everything together: they grant the backend authorizations and reference the catalogs and groups that determine which apps a user can launch and see. Role design is central to a working Fiori deployment.

Where does Roles sit in the Fiori stack?

A user needs the app on their launchpad (frontend) AND the authorization to run its backend service (backend).

What is the practical takeaway on Roles?

SAP delivers standard business roles for S/4HANA that bundle the right catalogs, groups and authorizations for common jobs (e.

What tends to go wrong with Roles in SAP Fiori?

Frontend app without backend authorization (or vice versa). Building roles from scratch instead of adapting SAP business roles. Misaligned frontend/backend roles in hub setups.