SAP SU01

It maintains user master records, creating users, assigning roles, managing passwords, locking/unlocking, the core user-administration transaction.

• User ID and user type (dialog, system, etc.).
• Address and logon data (password, validity).
• Roles/profiles assigned (Roles tab).
• Parameters/defaults and licence data.

• Assign access via roles (PFCG), not direct authorizations.
• Lock (not delete) users who leave, then remove per policy.
• Use SU10 for mass changes.

• User cannot log on (locked, expired, or password issue).
• Missing role assignment, authorization errors downstream.
• Wrong user type for the purpose (e.g. dialog for an interface).

• Deleting a user who has left. Every document they ever posted references the ID. Lock it, set a validity end, and keep the history readable.
• Assigning roles with no validity dates for temporary access. Temporary access without an end date is permanent access with good intentions.
• A user type that permits interactive logon for an interface account. It is the account somebody will eventually log in as.
• Changing assignments and expecting them to take effect. The user master comparison has to run, and until it does the user has what they had before.
• Doing mass work one user at a time. SU10 exists, and hand editing forty users is forty chances to differ.