PFCG
Quick answer
PFCG maintains authorization roles, the menu and authorization objects, and generates the profiles assigned to users, the heart of SAP authorization design.
Key takeaways
- Role name (single/composite).
- Menu tab (transactions/apps in the role).
- Authorizations tab (objects and field values).
- Watch out: Using the wrong variant (create vs change vs display).
Purpose
It maintains authorization roles, the menu and authorization objects, and generates the profiles assigned to users, the heart of SAP authorization design.
Key fields and screen
- Role name (single/composite).
- Menu tab (transactions/apps in the role).
- Authorizations tab (objects and field values).
- Generate profile; user assignment tab.
Tips
- Add transactions to the menu, then maintain the pulled-in authorization objects.
- Regenerate the profile after any authorization change.
- Use SU24 defaults to reduce manual authorization work.
Common errors
- Forgetting to regenerate the profile (changes not effective).
- Over-broad authorizations (*) instead of least privilege.
- Missing objects causing SU53 authorization failures.
Common pitfalls
- Using the wrong variant (create vs change vs display).
- Missing prerequisite master data or authorization.
- Not checking the resulting document/log.
Want to learn this properly?
Our live, instructor-led SAP Training covers this hands-on, with real projects and a certification path.
Check your understanding
Which statement is true of PFCG?
- A. Restoring an SAP system, bringing it back from backup after data loss, corruption or a failed change, is the…
- B. Generate profile; user assignment tab.
- C. An authorization profile is the generated set of authorizations that actually gets assigned to a user…
Show answer
B. Generate profile; user assignment tab.
Covered in the “Key fields and screen” section of this lesson.
Which part of the Learn SAP curriculum covers PFCG?
- A. SAP TCodes
- B. SAP navigation
- C. SAP interview questions
Show answer
A. SAP TCodes
This lesson sits in the SAP TCodes section of the Learn SAP course.
Frequently asked questions
What does PFCG stand for in SAP?
PFCG is the SAP transaction code for Role Maintenance (Profile Generator) (Basis/Security). It maintains authorization roles, the menu and authorization objects, and generates the profiles assigned to users, the heart of SAP authorization design.
How is access to PFCG controlled?
Role name (single/composite). Menu tab (transactions/apps in the role). Authorizations tab (objects and field values).
Which related transactions work alongside PFCG?
Add transactions to the menu, then maintain the pulled-in authorization objects. Regenerate the profile after any authorization change. Use SU24 defaults to reduce manual authorization work.
What tends to go wrong with PFCG?
Using the wrong variant (create vs change vs display). Missing prerequisite master data or authorization. Not checking the resulting document/log.