SAP Authorization Management

Especially in system landscapes that have been in operation for a long time, historically grown authorization structures can be found. Instead of small, modular, job-specific roles, existing roles are continually expanded and assigned to different employees in different departments. Although this leads to less administrative work in the short term, it causes the complexity of the role to increase massively over time. As a result, the efficiency of authorization development is increasingly lost.

Far more damage, however, can be caused by too extensive authorizations. For example, an employee may be authorized to access data for which he or she is not authorized. In the worst case, criminal activity can cause economic damage. To prevent this, an authorization concept must be in place that describes how authorizations are to be created and assigned to users.

The most common challenges are:

• Intransparent role structure

• Too many authorizations in roles

• No segregation of duties (SoD)

• Remaining authorizations after job changes

• No automated processes

Authorizations are used to map the organizational structure, business processes and segregation of duties. Therefore, they control the access options of users in SAP systems. The security of business data depends directly on the authorizations assigned. For this reason, the assignment of authorizations must be well planned and executed in order to achieve the desired security.

Authorizations are assigned to users in SAP systems in the form of roles. The goal is to create a system that is as secure as possible and to keep the complexity and number of roles as low as possible. This is the only way to achieve a balanced cost-benefit ratio.

The role concept provides that each user can only process the tasks to which he is authorized. It is developed across departments and must protect sensitive data from unauthorized access. A clear role concept enables a modular structure of authorizations without having to create separate roles for each user.

In a redesign, we follow the principle of job-specific workplace roles in order to technically map the job profile of employees. To minimize the effort for the same job profiles with different organizational affiliations, the organizational units are inherited via an additional role. The separation of technical and organizational requirements greatly simplifies role development and modification. If certain people, such as team leaders, require extended authorizations, key user roles are developed for them, which extend the existing job role.

This approach makes authorization management considerably more efficient, since functional changes do not have a global impact on the entire authorization structure. This ensures the quality of authorizations in the long term.

The path to SAP S4/HANA presents a particular challenge with regard to authorizations.

Many previously used transactions become obsolete and are dropped. In their place, some new ones will be added and replaced/enhanced by SAP Fiori apps. This inevitably leads to the need to revise authorizations after an upgrade to SAP S/4HANA. To simplify the revision of authorizations, it is strongly recommended to maintain the authorization default values (SU24). This must be done before the upgrade if it has not already been done. This will automatically provide the new transactions with the previous authorization values. The subsequent maintenance effort is significantly reduced.

In addition to the classic authorizations already mentioned, Fiori authorizations must be created for apps. These are added to the roles in the form of tiles and catalogs and assigned to the users. Here, too, it must be ensured that the catalogs and tiles meet the technical requirements and reflect job profiles.