- Home
- DevOps
- PFCG
PFCG: how SAP roles really work
In SAP ECC and SAP S/4HANA on-premise, every role is built in one transaction: the menu people see, the authorizations behind it and the profile that finally reaches the user. This page follows a role from the first click to the authorization check, with the reports, switches and traces that usually stay inside the security team.
- SAP S/4HANA on-premise and Private Cloud
- SAP ECC 6.0
- Any ABAP system
- PFCG · SU24 · SUIM
- Cross-application Authorization ObjectsStandard
S_TCODETransaction code checkMaintained- Financial AccountingChanged
F_BKPF_BUKCompany codesChangedACTVT01, 02, 03BUKRS$BUKRS · no valueF_BKPF_KOAAccount typesStandardKOARTopen
Twelve things only the authorization team usually knows
Each card is one small discovery, and most of them have caused a real incident somewhere. The details are further down the page.
- 01Validity
PFCG_TIME_DEPENDENCYExpired roles keep workingAn end date only bites when a comparison removes the profile. Schedule this report every night, before business hours. - 02Danger
Click on a yellow lightOne click fills every open field with *Clicking a yellow traffic light gives full authorization to every empty field below it. Maintain the organizational levels first. - 03Expert mode
Read old status and mergeThe option that keeps your workAfter a menu change, merge instead of recreating: your values stay and new proposals arrive marked New. - 04Traces
Authorizations › TraceFill a role from a traceThe Trace button reads an authorization or system trace, even from another system, and applies the values to the role. - 05Transport
USER_REL_IMPORTA transport can wipe production assignmentsImported user assignments replace all assignments of that role in the target. One line in PRGN_CUST stops it. - 06Obsolete
SUPOPFCG_ORGFIELD_CREATE is retiredSince SAP NetWeaver 7.50 SP09, transaction SUPO turns a field into an organizational level (KBA 2625102). - 07Mass change
PFCGMASSVALOne value, three hundred rolesOrganizational levels, field values and manual authorizations across many roles, with a simulation first. - 08Menu
Authorization DefaultGrant without a menu entryAdds the proposals of a transaction, RFC function or OData service with nothing visible in the menu. Built for technical users. - 09SU53
auth/su53_buffer_entriesSU53 forgetsIt keeps up to 100 failed checks per user, for three hours at most. “All checks successful” means: look somewhere else. - 10Security
SACFAn installed note may protect nothingMany security notes deliver switchable checks that stay inactive until you set them to productive in SACF. - 11Fiori
S_SERVICENever type S_SERVICE by handIts service field holds a hash, not the name. Add the catalog with Include Applications and let PFCG fill it. - 12History
AGR_Why role tables start with AGRRoles were activity groups until R/3 4.6C. The screens changed; the table names did not.
How it works
From role to access in seven steps
A role gives nothing until all seven steps have run. Most “I have the role but it still doesn’t work” tickets stop at step 4 or step 6. Pick a step to see what happens there, where it is stored and what to watch.
Step 1 of 7
Build the menu
On the Menu tab you add transactions, reports, web addresses, Web Dynpro apps and, in SAP S/4HANA, launchpad catalogs and spaces. You can also import a whole menu from the SAP menu, an area menu, another role, a file or a trace. The menu is what users see in SAP Easy Access and in the launchpad.
Where it is stored
AGR_HIERmenu treeAGR_HIERTmenu textsAGR_TCODEStransactions of the role
Tools
PFCGMenu tabSSM_CUSTCONDENSE_MENU_PFCG avoids duplicate entries
Watch out. Every transaction in the menu ends up in S_TCODE. Adding a menu entry is granting access to it, whatever its folder is called.
Step 2 of 7
SU24 proposes the checks
For each menu entry PFCG reads the check indicators and proposal values: SAP’s in SU22 and your own copy in SU24. Objects marked Check, with proposal Yes, arrive in the role with their default values. Objects with proposal No are still checked but not proposed.
Where it is stored
USOBX_Cyour check indicatorsUSOBT_Cyour proposal valuesUSOBX · USOBTSAP’s originals
Tools
SU24maintain proposalsSU25refresh them after an upgrade
Watch out. A transport of SU24 data replaces the default values in the target system. Keep SU24 up to date for your own custom transactions, or every role that uses them fills up with manual authorizations.
Step 3 of 7
Fill the authorization data
The Authorizations tab shows the proposals grouped by object class. You set the organizational levels once (company code, plant, controlling area) and fill the remaining open fields. The traffic lights and the status of each authorization tell you what is still missing and where each value came from.
Where it is stored
AGR_1251every field valueAGR_1252organizational level values
Tools
Org. levelsCtrl+F8Traceapply values from a trace
Watch out. Red means an organizational level has no value; yellow means another field is empty. Clicking a yellow light fills every open field below it with *. Green only means filled, never right.
Step 4 of 7
Generate the profile
Generate turns the authorization data into a profile whose name begins with T. The system proposes the name the first time, and it can’t be changed afterwards. Authorizations set to inactive are left out of the profile.
Where it is stored
AGR_1016role to profileUSR10 · UST12profiles and their authorizations
Tools
Generateone roleSUPCmany roles, also in the background
Watch out. Generating needs authorization object S_USER_PRO. In SAP’s split administration model it belongs to a profile administrator, not to the person who maintains the role.
Step 5 of 7
Assign users
On the User tab you add users, each with a validity period, or organizational units and positions when HR organizational management is switched on. Users of a composite role receive the profiles of the roles inside it.
Where it is stored
AGR_USERSuser, role, valid from and to
Tools
User tabin PFCGSU01 · SU10one user or many
Watch out. Assigning a role grants nothing yet. Without the next step the user has the role on paper and no profile in the user master.
Step 6 of 7
Run the user comparison
The comparison writes the current profiles into the user master record and removes the old ones. SU01 runs it automatically when you assign a role there, and PFCG does when AUTO_USERCOMPARE is on. Start and end dates in the future are handled by the nightly PFCG_TIME_DEPENDENCY job.
Where it is stored
UST04user to profile
Tools
PFUDmass comparisonPFCG_TIME_DEPENDENCYschedule daily
Watch out. Profiles carry no dates; only the assignment does. Without the nightly job, an assignment whose end date has passed keeps working until somebody runs a comparison.
Step 7 of 7
The check at runtime
At logon the profiles are loaded into the user buffer. The S_TCODE check when a transaction starts, and every AUTHORITY-CHECK in the code after that, is compared with this buffer and answered with a return code.
Where it is stored
User bufferin memory, per user
Tools
SU53last failed checksSTAUTHTRACEevery checkSU56the buffer itself
Watch out. Users who were logged on while the role changed may need to log on again before they see the new authorizations.
Anatomy
Role, profile, authorization, field: four boxes inside each other
People use the four words as if they meant the same thing. They don’t. You maintain the role; PFCG generates the profile; the profile holds authorizations; each authorization gives values to the fields of one authorization object.
Z_FI_AP_CLERK_1000Menu, authorization data, users. What you maintain in PFCG.T-…Generated from the role. This is what lands in the user master.S_TCODETCDFB60FBL1NF_BKPF_BUKACTVT010203BUKRS1000organizational levelWhat the program asks
Authorizations only matter because ABAP code asks for them. This is the check behind posting to a company code:
AUTHORITY-CHECK OBJECT 'F_BKPF_BUK' ID 'BUKRS' FIELD lv_bukrs ID 'ACTVT' FIELD '01'.IF sy-subrc <> 0. " no authorization: the program decides what to doENDIF.| sy-subrc | Meaning |
|---|---|
0 | One authorization in the user buffer covers all the values checked together |
4 | The user has the object, but not with these values |
12 | The user has no authorization at all for this object |
The trap: the values must sit in the same authorization. ACTVT 01 for company code 2000 in one authorization and ACTVT 03 for 1000 in another do not add up to “create in 1000”.
PFCG in four numbers
- 10
fields at most in one authorization object.
- 30
characters at most in a role name. The generated profile name can never be changed.
- 00–99
numbers for the authorizations of a profile. Utilities › Reorganize starts the count again.
- 312
profiles at most in one user master record; past that, message 01263 stops you.
Role types
Single, derived and composite roles
Build each task once, copy it per company code with derived roles, and bundle tasks into jobs with composite roles. Done this way, a new company code costs one derived role per task instead of a new set of roles.
Inheritance
Z_FI_AP_CLERKMenu + authorizations · $BUKRS left emptyZ_FI_AP_CLERK_1000BUKRS = 1000Z_FI_AP_CLERK_2000BUKRS = 2000Z_FI_AP_CLERK_3000BUKRS = 3000
Bundling
ZC_AP_TEAM_LEAD_1000Z_FI_AP_CLERK_1000 · derivedZ_FI_AP_APPROVER_1000 · derivedNo authorization data of its own| Property | Single role | Derived role | Composite role |
|---|---|---|---|
| Menu | Its own | Copied from the imparting role; no extra entries allowed | Put together from its roles; can be rearranged |
| Authorization data | Its own | Inherited from the imparting role, except organizational levels | None of its own |
| Organizational levels | Maintained here | The one thing you maintain here; copied only the first time, never overwritten afterwards | Not applicable |
| Users | Yes | Yes, not inherited from the imparting role | Yes; they get the profiles of the roles inside |
| Can contain | — | — | Single and derived roles, never another composite role |
| Typical use | One task: post vendor invoices | The same task for another company code, plant or sales organization | A job: everything an AP team lead does |
Single and composite role names look the same in every list, so SAP itself recommends a naming convention that tells them apart. Delete inheritance relationship cuts a derived role loose from its parent, and it cannot be undone.
Changing a role
Expert mode: the three choices that decide what you keep
Open an existing role with Utilities › Settings › Expert mode for profile generation switched on and PFCG asks how to treat the authorizations already there. The wrong answer can wipe months of manual work. Tell it what you changed.
Choose
Read old status and merge with new data
Your maintained and changed values stay. Proposals for the new transactions arrive with status New, so you can see exactly what came in, and organizational levels that are no longer needed are removed.
Values you changed or added by hand are not refreshed. If a removed transaction had a manual authorization, delete that authorization yourself.
Choose
Read old status and merge with new data
Merging makes PFCG read the SU24 data again. After an upgrade, SU25 steps 2a to 2c bring SAP’s new proposals into your SU24 data and list the roles to check; step 2d lists roles whose transactions were replaced.
Work through the list SU25 gives you, role by role, and generate each profile at the end.
Choose
Edit old status
Opens exactly what was saved last time. Correct the value, generate the profile, done.
Not useful if the menu changed since the last save: the new transactions would bring no proposals with them.
Choose
Delete and recreate profile and authorizations
PFCG throws away every authorization and rebuilds the role from the menu and SU24. Only the organizational levels survive.
Everything maintained, changed or added by hand is lost. Download the role first (Role › Download) so you can compare or go back.
| Option | What happens to your values | Use it when |
|---|---|---|
| Delete and recreate profile and authorizations | Everything maintained, changed or added by hand is lost. Only the organizational levels survive. | You want a clean rebuild from the menu and SU24 |
| Edit old status | Shows exactly what was last saved. New menu entries bring nothing in. | Only values change and the menu did not |
| Read old status and merge with new data | Keeps your values. New proposals arrive with status New, existing ones show Old, organizational levels no longer needed are removed. Values you changed or added are not refreshed. | The menu changed, or SU24 proposals changed after an upgrade |
The status column, decoded
Next to every authorization PFCG shows where its values came from. Switch on Utilities › Technical names to see object and field names beside the texts.
- StandardEvery value exactly as SU24 proposed it.
- MaintainedAt least one field the proposal left empty has been filled.
- ChangedAt least one proposed value was changed. A merge will not refresh it.
- ManuallyAdded by hand, not from the menu. It stays even after the transaction that needed it is removed.
- OldAfter a merge: this authorization was already in the role.
- NewAfter a merge: brought in by a new menu entry or new SU24 data. Check it before you generate.
- InactiveKept in the role but left out of the profile. It keeps its status too, as in Inactive Changed.
Inside PFCG
Tricks hiding in the menus
All of these are in the standard transaction. Most people never open the menu where they live.
Organizational levels: only through the button
Change company code, plant or controlling area with Org. levels (Ctrl+F8). A value typed straight into the tree turns the authorization to Changed, and later edits of the organizational level no longer reach that field.
Leave Standard entries alone
Need other values in an authorization with status Standard? Copy it, deactivate the original and change the copy, as SAP’s own authorization course recommends (SAP Note 113290). The original stays tied to the menu and to its SU24 proposal.
Grant without a menu entry
On the Menu tab, Authorization Default adds a transaction, an RFC function module, an OData service (TADIR service), a Web Dynpro or a BSP application only as a proposal. Nothing appears in the user menu, which is exactly what RFC and technical users need.
A report becomes a transaction
Add an ABAP report with a variant to the menu and PFCG can generate a transaction code for it, copying the report’s description. The same button takes SAP Query, transaction variants (SHD0), BW reports and Report Writer reports.
Menus from five places
Copy Menus imports from the SAP menu (also from a remote system through RFC), from another role, from an area menu, from a file or from a trace of what the user actually ran.
Start it in another system
A menu entry has a target system field that holds an RFC destination: the user clicks in one system and the transaction opens in another. Destinations can be variables, kept in
SM30_SSM_RFC.Edit many rows at once
From SAP NetWeaver 7.50, Utilities › Settings switches authorization maintenance to an ALV tree view, which can change values in many authorizations in one go.
Templates for the basics
Insert an authorization from a template instead of building the basics by hand:
SAP_USER_Bbrings the basic authorizations every user needs andSAP_PRINTthe ones for printing. Manually adds any object by its technical name.Back up before a risky change
Role › Download writes the role to a file with everything except user assignments and generated profiles. Upload brings it back; then generate the profile again.
Also worth a click: Utilities › Technical names, which shows object and field names beside the texts; Menu statistics, which counts nodes and levels; and Compress menu, which drops duplicate entries (switched on for everyone with CONDENSE_MENU_PFCG in table SSM_CUST).
Try it
Will this user pass the check?
A user has one derived role for company code 1000. Pick what they try to do and watch the checks run in the order the system runs them. When one fails you get the SU53 view and the fix in PFCG.
User master of MSANTOSZ_FI_GL_ACCT_1000
S_TCODETCDFB03FB50
F_BKPF_BUKACTVT0103BUKRS1000
Checks, in order
S_TCODEtransaction startTCD = FB50sy-subrc 0F_BKPF_BUKcompany code enteredACTVT = 01 · BUKRS = 1000sy-subrc 0
Allowed
Both checks find one authorization that covers all the values asked for.
In PFCG: Nothing to change. In STAUTHTRACE both checks would show return code 0.
Checks, in order
S_TCODEtransaction startTCD = FB50sy-subrc 0F_BKPF_BUKcompany code enteredACTVT = 01 · BUKRS = 2000sy-subrc 4
In, but not for company code 2000
The transaction starts. The check fails when the company code is entered: the user has F_BKPF_BUK, but no single authorization covers ACTVT 01 and BUKRS 2000 together.
SU53 · Authorization check faileduser MSANTOS
- Object
- F_BKPF_BUK Accounting Document: Authorization for Company Codes
- ACTVT
- 01
- BUKRS
- 2000
In the user master: ACTVT 01, 03 · BUKRS 1000
In PFCG: Don’t type 2000 into this role. Assign the derived role for company code 2000 (Z_FI_GL_ACCT_2000), or create it from the master role with Generate Derived Roles. Then run the user comparison.
Checks, in order
S_TCODEtransaction startTCD = FB03sy-subrc 0F_BKPF_BUKcompany code enteredACTVT = 03 · BUKRS = 1000sy-subrc 0
Allowed
Both checks find one authorization that covers all the values asked for.
In PFCG: Nothing to change. In STAUTHTRACE both checks would show return code 0.
Checks, in order
S_TCODEtransaction startTCD = FB03sy-subrc 0F_BKPF_BUKcompany code enteredACTVT = 03 · BUKRS = 2000sy-subrc 4
In, but not for company code 2000
The transaction starts. The check fails when the company code is entered: the user has F_BKPF_BUK, but no single authorization covers ACTVT 03 and BUKRS 2000 together.
SU53 · Authorization check faileduser MSANTOS
- Object
- F_BKPF_BUK Accounting Document: Authorization for Company Codes
- ACTVT
- 03
- BUKRS
- 2000
In the user master: ACTVT 01, 03 · BUKRS 1000
In PFCG: Don’t type 2000 into this role. Assign the derived role for company code 2000 (Z_FI_GL_ACCT_2000), or create it from the master role with Generate Derived Roles. Then run the user comparison.
Checks, in order
S_TCODEtransaction startTCD = FB02sy-subrc 4F_BKPF_BUKcompany code enteredACTVT = 02 · BUKRS = 1000not reached
Stopped at the door
The transaction never starts: FB02 is not in S_TCODE of any role the user has, so the second check is never reached.
SU53 · Authorization check faileduser MSANTOS
- Object
- S_TCODE Transaction Code Check at Transaction Start
- TCD
- FB02
In the user master: TCD FB03, FB50
In PFCG: Add FB02 to the role menu, open the authorizations with Read old status and merge with new data, fill what arrives as New, generate the profile and run the user comparison. Changing posted documents is a different task, so many role concepts give it a role of its own.
Checks, in order
S_TCODEtransaction startTCD = FB02sy-subrc 4F_BKPF_BUKcompany code enteredACTVT = 02 · BUKRS = 2000not reached
Stopped at the door
The transaction never starts: FB02 is not in S_TCODE of any role the user has, so the second check is never reached.
SU53 · Authorization check faileduser MSANTOS
- Object
- S_TCODE Transaction Code Check at Transaction Start
- TCD
- FB02
In the user master: TCD FB03, FB50
In PFCG: Add FB02 to the role menu, open the authorizations with Read old status and merge with new data, fill what arrives as New, generate the profile and run the user comparison. Changing posted documents is a different task, so many role concepts give it a role of its own.
Simplified on purpose. A real posting also checks objects such as F_BKPF_KOA (account type), F_BKPF_BLA (document type) and F_BKPF_BUP (posting period). STAUTHTRACE shows every one of them with its return code.
Troubleshooting
SU53 is only the start: which trace when
SU53 keeps up to 100 failed checks per user for at most three hours, and “All checks successful” only tells you the cause is somewhere else. The traces below record what really happened, and two of them feed PFCG directly.
| Tool | What it records | Use it for | Watch |
|---|---|---|---|
SU53 | The last failed checks of one user, in a ring buffer in shared memory | A first look right after “no authorization”; administrators can display another user | Size set by auth/su53_buffer_entries; shows failures only |
STAUTHTRACE | Authorization checks only, on all application servers at once, with a jump to the code | Real troubleshooting, including RFC and batch users; filter by user and errors only | Switch it off when you are done |
ST01 | The classic system trace: authorizations plus RFC, SQL and more | When you need to see more than authorization checks | Runs per application server |
STUSERTRACE | A long-term trace in the database: every check of a user once, with the first time it happened | Slimming down RFC and batch users; replacing `*` in S_TABU_NAM with real table names | auth/auth_user_trace = F with filters; avoid Y (SAP Note 2220030) |
STUSOBTRACE | System-wide: every check once per application and place in the code, whoever ran it | Designing SU24 proposals for custom transactions | auth/authorization_trace; not a troubleshooting tool |
SU56 | The user’s own authorization buffer, right now | “Do I really have it at this moment?” | Users who were logged on may need to log on again |
- Authorizations tab › Trace
Pull values from a trace into the role
Select an authorization and choose the Trace button. PFCG reads the authorization trace or the system trace, locally or from another system through RFC. Pick a field, a row or a column and choose Apply. Start objects (S_START, S_TCODE, S_SERVICE, S_RFC) can’t be changed this way: they come from the menu.
- Menu tab › Copy Menus › Import from Trace
Build the menu from what the user ran
Reads the S_TCODE, S_SERVICE, S_RFC and S_START checks from a trace and adds them as a list or in SAP menu order. Function modules are read one by one, not as function groups. The same Trace button exists in SU24 for proposal values.
For consultants
The authorization toolbox
PFCG is the centre, but rarely the only screen open. Reports run in SE38; tables open in SE16N or SE16H.
| Code | Name | When to use it |
|---|---|---|
PFCGTransaction | Role maintenance | Menu, authorizations, users and profile of one role. |
PFUDTransaction | User master comparison | Comparison for many roles at once; also the place to schedule PFCG_TIME_DEPENDENCY. |
SUPCTransaction | Mass profile generation | Generates missing or outdated profiles, in the background if needed. |
PFCGMASSVALTransaction | Mass maintenance of values | Organizational levels, field values and manual authorizations across many roles, with a simulation first. |
SU24Transaction | Proposals and check indicators | Your version of what PFCG proposes for each transaction, OData service or RFC function. |
SU22Transaction | SAP proposals | Meant for SAP’s own developers. Read it, don’t change it. |
SU25Transaction | Upgrade the proposals | Initial fill, comparison after an upgrade (steps 2a to 2d), transport and check indicators. |
SUPOTransaction | Organizational levels | Turns a field into an organizational level, or back. Replaces the PFCG_ORGFIELD reports. |
SACFTransaction | Switchable checks | Activates the checks that security notes deliver switched off. |
SE97Transaction | CALL TRANSACTION checks | Pairs of calling and called transactions, used when auth/check/calltransaction asks for them. |
SU01Transaction | User maintenance | Assigning a role here runs the user comparison automatically. |
SU10Transaction | Mass user maintenance | Add or remove roles for many users at once; every change is logged. |
SU01DTransaction | Display user | The user master with no risk of changing it. |
SU53Transaction | Failed checks | The last failed checks of a user; administrators can display another user. |
SU56Transaction | User buffer | What the user has in memory right now. |
SUIMTransaction | User Information System | Every report about users, roles, profiles, authorizations and change documents. |
STAUTHTRACETransaction | Authorization trace | Checks only, on all application servers, filtered by user and errors. |
ST01Transaction | System trace | Authorizations plus RFC, SQL and more, per application server. |
STUSERTRACETransaction | Long-term user trace | Weeks of one user’s checks, each stored once. |
STUSOBTRACETransaction | System trace for SU24 | Every check once, system-wide, for designing proposals. |
PFCG_TIME_DEPENDENCYReport | Nightly full comparison | Removes the profiles of expired assignments and adds those that start. Schedule it daily. |
RHAUTUPD_NEWReport | Comparison, step by step | The same comparison, with only the processing types you choose. |
PRGN_COMPRESS_TIMESReport | Clean up assignments | Deletes expired assignments and merges overlapping validity periods. Simulate first. |
RSUSR002Report | Users by complex selection | Who has a transaction or a value. Press Input Values to open the fields. |
RSUSR070Report | Roles by complex selection | Which roles give a transaction or a value. |
RSUSR050Report | Compare | Users, roles, profiles or authorizations, also across systems through RFC. |
RSSCD100_PFCGReport | Change documents for roles | Who changed the menu, authorizations, organizational levels or assignments, and when. |
REGENERATE_SAP_NEWReport | Temporary role after an upgrade | Replaces the obsolete SAP_NEW profile. Remove the role once the upgrade is done. |
PRGN_COMPARE_ROLE_MENUReport | Role menu against catalog | Keeps the menu of a Fiori role in line with its catalogs. |
AGR_DEFINETable | Roles | One line per role. |
AGR_TEXTSTable | Role texts | Short and long descriptions. |
AGR_USERSTable | Assignments | User, role, valid from and to, and flags for composite and HR assignments. |
AGR_AGRSTable | Composite roles | Which roles sit inside each composite role. |
AGR_TCODESTable | Transactions | Every transaction of every role menu. |
AGR_1251Table | Authorization values | Object, authorization, field, from and to values. |
AGR_1252Table | Organizational levels | The values of each $ variable. |
AGR_1016Table | Role to profile | The generated profile of each role. |
UST04Table | User to profile | What the comparison wrote into the user master. |
USOBX_C · USOBT_CTable | Your SU24 data | Check indicators and proposal values. |
TOBJ · TOBJTTable | Authorization objects | The fields of each object, up to ten, and its text. |
Some codes depend on release or on SAP Notes: PFCGMASSVAL arrives with SAP Note 2177996 on older releases, and SUPO replaced the PFCG_ORGFIELD reports from SAP NetWeaver 7.50 SP09 (knowledge base article 2625102).
Settings
The switches that change PFCG for everyone
PFCG reads its behaviour from a few cross-client tables and profile parameters. One line changed there decides whether a transport wipes the role assignments in production.
| Key | What it does |
|---|---|
USER_REL_IMPORTPRGN_CUST | YES by default: imported user assignments replace all assignments of the role in the target system. Set NO to keep test users out of production; always NO with Central User Administration. |
PROFILE_TRANSPORTPRGN_CUST | NO stops generated profiles from travelling with the role; then generate them in the target with SUPC. |
AUTO_USERCOMPAREPRGN_CUST | YES by default: the user comparison runs automatically when assignments are saved. |
HR_ORG_ACTIVEPRGN_CUST | Shows the Org. management button and lets PFUD resolve assignments to positions and organizational units. |
ADD_ALL_CUST_OBJECTSPRGN_CUST | Whether your Y and Z authorization objects go into SAP_ALL. |
CONDENSE_MENU_PFCGSSM_CUST | Avoids duplicate menu entries for everyone; each user can still decide in Utilities › Settings. |
ADD_COMPOSITE_ROLESSSM_CUST | Whether a mass transport also takes the single roles inside composite roles. |
Profile parametersRZ11
auth/no_check_in_some_cases- Must be on for the Profile Generator and the SU24 “do not check” indicators to work.
auth/object_disabling_active- Allows switching objects off system-wide (never Basis or HR). The transport carries the saved state, so activate it again by hand in the target.
auth/check/calltransaction- How CALL TRANSACTION is checked: never, always, or through the pairs kept in SE97.
auth/su53_buffer_entries- How many failed checks SU53 keeps per user.
auth/auth_user_trace · auth/authorization_trace- Switch on STUSERTRACE and STUSOBTRACE.
- Maintain roles in development onlyRoles and their profiles travel together by transport. Change them in quality or production and the next import overwrites the change.
- Run the comparison after every importThe import brings the new profile; users get it at the next user comparison or the nightly job.
- Deleting a role? Transport it firstPut the role in a request before you delete it; that is how the deletion reaches the other systems.
Finance
Authorization objects every FI/CO role meets
The objects a finance consultant sees again and again in PFCG, grouped the way they show up in a role.
| Object | Protects |
|---|---|
| Accounting documents | |
F_BKPF_BUK | Documents by company code |
F_BKPF_KOA | Documents by account type (assets, customers, vendors, materials, G/L) |
F_BKPF_BLA | Documents by document type |
F_BKPF_GSB | Documents by business area |
F_BKPF_BUP | Posting periods, through the authorization group set in OB52 |
F_BKPF_BESF_BKPF_BEDF_BKPF_BEK | Account authorization groups of G/L accounts, customers and vendors |
F_FAGL_LDR | Postings by ledger; replaceable through BAdI FAGL_AUTHORITY_CHECK |
| Master data | |
F_SKA1_BUKF_SKA1_KTP | G/L accounts by company code and by chart of accounts |
F_KNA1_BUKF_LFA1_BUK | Customers and vendors by company code (APP, GEN, GRP and AEN variants exist too) |
| Processes | |
F_REGU_BUKF_REGU_KOA | Payment program (F110) by company code and account type |
F_MAHN_BUK | Dunning by company code |
| Controlling | |
K_CSKSK_CSKS_SET | Cost center master data and cost center groups |
K_CCA | Cost Center Accounting, by responsibility area or hierarchy node |
K_ORDER | Internal orders |
K_PCA | Profit center accounting, by responsibility area |
K_ML_VAK_MLPR_VA | Material Ledger: costing runs and closing by plant; price changes |
| Customizing tables | |
S_TABU_DIS | Tables by authorization group (02 change, 03 display) |
S_TABU_NAM | Tables by name, checked when S_TABU_DIS fails |
S_TABU_LIN | Lines of a table, for example OB52 periods only for your company codes |
OB52
An asterisk kills the period control
OB52 can keep a period open only for an authorization group, for example the closing team. That works only if F_BKPF_BUP lists real groups: with
*every user counts as part of the group.&NC&
Tables without a group
A table with no authorization group falls into &NC&, so S_TABU_DIS on &NC& opens all of them. Give every Z table a group, and analyze table access with report
SUSR_TABLES_WITH_AUTH.SoD
The classic finance conflict
Maintaining vendor master data and starting payment runs in one person is the example SAP itself uses for segregation of duties. Build it into the role design, not into a review afterwards.
SAP S/4HANA
PFCG in SAP S/4HANA: catalogs, spaces and OData
In SAP S/4HANA the role menu also decides what the SAP Fiori launchpad shows. The rules are the same; the menu entries are new.
Menu › SAP Fiori › Launchpad Catalog
Always tick Include Applications
When you add a business catalog, Include Applications brings in the apps behind its tiles, and with them the OData start authorizations. Save the role before you change anything else.
Launchpad Space
Spaces show; catalogs authorize
Spaces go into the role menu and bring their pages along. They change the layout, not the authorizations: a tile the user can’t launch is simply hidden. Launchpad groups have been deprecated since SAP S/4HANA 2021.
S_SERVICE
Never type S_SERVICE by hand
Its SRV_NAME field holds a hash, not the service name. Let PFCG fill it from TADIR services: IWSG on the front-end server (start authorizations only) and IWSV in the back end (the business objects checked while the app runs).
Hub or embedded
One role or two
With embedded deployment one role can carry front-end and back-end content. A central hub needs two roles, and back-end users then also need S_RFC and S_RFCACL, with real system IDs and clients instead of
*.SAP_BR_*
Templates, not production roles
Business roles such as
SAP_BR_GL_ACCOUNTANTare meant to be copied. Task listSAP_FIORI_CONTENT_ACTIVATION(run in STC01) copies SAP_BR roles with your prefix of up to three characters, but sets the organizational levels to*: narrow them before anyone uses the copies.S_START
Web Dynpro apps need a start authorization
Since SAP S/4HANA 2021, S_START is checked by default when a Web Dynpro application starts. Roles carried over from older releases may not have it, so trace first when a Web Dynpro app suddenly refuses to open.
| Topic | On-premise and Private Cloud | Public Cloud and SAP BTP ABAP environment |
|---|---|---|
| Where roles are built | PFCG: single, derived and composite roles | Maintain Business Roles app |
| Smallest unit | Authorization object and its field values | Business catalog, maintained by SAP or developers |
| Restricting by organization | Organizational levels and field values | Restrictions (read, write, value help) by restriction type |
| SAP content | SAP_BR_* roles, copied to your namespace | Business role templates, which can’t be assigned directly |
| Users | SU01, SU10 | Maintain Business Users and the other IAM apps |
Need the catalogs of an app? The SAP Fiori apps reference library shows its business catalogs, technical catalog and business role. Shortcuts and launchpad tools are on SAP Fiori.
Good practice
Roles that survive an audit
Eight rules that keep a role concept small enough to understand and strict enough to defend.
- Maintain roles in development onlyTransport them onwards. A change made in quality or production is undone by the next import.
- One master role per taskDerive it per company code, plant or sales organization, and maintain organizational levels only in the derived roles: they are the one thing the master never overwrites.
- Make the type visible in the nameSAP_ is SAP’s; Y and Z are yours. Add a marker that tells single, derived and composite roles apart.
- No SAP_ALL, no SAP_NEWSAP_ALL for nobody, or one emergency user at most. SAP_NEW is obsolete; REGENERATE_SAP_NEW builds a temporary role for upgrades instead.
- No wildcards in organizational levelsNot * and not 10*. The next company code that matches gets access nobody decided to give.
- Keep SU24 current for your own codeCustom transactions without proposals fill roles with manual authorizations, and those stay long after the transaction is gone.
- Split the administrationMaintaining roles, generating profiles and assigning users can sit with three people. SAP describes the split with the templates SAP_ADM_AU, SAP_ADM_PR and SAP_ADM_US.
- Check conflicts, then keep reviewingRun segregation-of-duties checks before assigning, use emergency (firefighter) access for the rare exception, and let role owners recertify assignments regularly. SAP Access Control covers all three.
| Name | Type | Reads as |
|---|---|---|
Z_FI_AP_CLERK | Single (master) | Finance, accounts payable, clerk tasks; organizational levels left empty |
Z_FI_AP_CLERK_1000 | Derived | The same tasks for company code 1000 |
ZC_AP_TEAM_LEAD_1000 | Composite | The job: all roles an AP team lead in 1000 needs |
ZT_RFC_BANK_INTERFACE | Single (technical) | Authorizations of an RFC user, built from Authorization Default entries |
Myths
Six things people get wrong about PFCG
Myth
Assigning the role gives the access.FactAccess arrives with the profile, at the user comparison. SU01 runs it for you; start and end dates in the future need PFUD or the nightly PFCG_TIME_DEPENDENCY job.
Myth
A green traffic light means the role is right.FactGreen only means every field has a value. A role with ACTVT * and BUKRS * is fully green and wide open.
Myth
SU53 shows the cause.FactIt shows the last failed checks: up to 100 per user, for three hours at most. The real cause can sit deeper in the call chain, where STAUTHTRACE finds it.
Myth
An end date removes the role on that day.FactProfiles carry no dates; only the assignment does. The profile leaves the user master at the next comparison, which is why the nightly job matters.
Myth
Generate Derived Roles resets their company codes.FactOrganizational levels are copied only the first time. Values already maintained in a derived role are never overwritten afterwards.
Myth
Installing a security note closes the hole.FactMany notes deliver switchable checks that stay inactive until you set the scenario to productive in SACF.
History
From activity groups to business roles
Before the Profile Generator, authorizations were built by hand, profile by profile. PFCG turned a menu into authorizations, and almost three decades later the same idea runs SAP S/4HANA.
- EarlyBefore the Profile GeneratorProfiles and authorizations were built by hand, and an older tool, the Job Generator, produced activity profiles.
- 1998R/3 3.1GSAP presents the Profile Generator as available to R/3 3.1G customers, after a pilot on 3.0F, and promises 75% less authorization work.
- 4.6R/3 4.6Role menus with transactions, reports and web links; composite and derived roles; more than 1,200 delivered single roles; role menus compared across systems.
- 4.6CR/3 4.6CActivity group becomes role. The AGR tables keep the old name.
- 7.50SAP NetWeaver 7.50An ALV tree view for authorization maintenance. From SP09, SUPO replaces the PFCG_ORGFIELD reports.
- 2021SAP S/4HANA 2021S_START is checked by default for Web Dynpro applications, and launchpad groups give way to spaces and pages.
- CloudSAP S/4HANA Cloud Public EditionBusiness roles built from business catalogs in the Maintain Business Roles app. Customers don’t use PFCG there.
AGR_Why the role tables start with AGR
Roles were called activity groups until R/3 4.6C. The name changed on screen; the tables kept it. AGR_DEFINE, AGR_USERS, AGR_1251: each one is an activity group table.
The saving in authorization work SAP promised when it presented the Profile Generator to customers in 1998.
Single roles SAP delivered with Release 4.6, ready to copy.
Frequently asked questions
What is the difference between a role and a profile?
The role is what you maintain in PFCG: menu, authorization data and users. The profile is generated from it, its name begins with T, and it is the profile that lands in the user master record and is read by every authorization check. Never assign generated profiles directly in SU01: the automatic comparison removes profiles that don’t belong to an assigned role.
I added the transaction to the role. Why does the user still get “no authorization”?
Check the seven steps in order: was the profile generated after the change, did the user comparison run, and did the user log on again? If all three are done, trace with STAUTHTRACE: the missing piece is often a second object the transaction checks after it starts, not S_TCODE.
How do I find which roles give a transaction or a company code?
In SUIM, report RSUSR070 finds roles by complex selection; press Input Values to open the value fields. RSUSR002 does the same for users. For raw data, AGR_TCODES links roles to transactions and AGR_1251 holds every field value.
Can I transport roles without their user assignments?
Yes. Set USER_REL_IMPORT to NO in table PRGN_CUST of the target system and imported assignments are ignored. Without it, the assignments in the transport replace all assignments of that role in the target. Role download and upload never include user assignments.
How do I change one value in hundreds of roles?
Use PFCGMASSVAL. It changes organizational level values, field values or manual authorizations across many roles, and it can simulate first. On older releases it arrives with SAP Note 2177996. Run the simulation, check the log, then run it for real and generate the profiles.
Is PFCG available in SAP S/4HANA Cloud Public Edition?
No. Public Cloud and the SAP BTP ABAP environment use business roles built from business catalogs in the Maintain Business Roles app, with restrictions instead of organizational levels. PFCG is for SAP S/4HANA on-premise, Private Cloud and SAP ECC.
Why can’t I rename the generated profile?
The system proposes the profile name when the profile is first generated, and after that it is fixed. If you need a different name, the clean way is a new role.
Related pages
References
Checked in October 2026. SAP Notes and knowledge base articles need an SAP for Me login.
- The Profile GeneratorSAP Help Portal, R/3 4.6C
- Changes for Release 4.6SAP Help Portal, R/3 4.6C
- Traffic lights in authorization maintenanceSAP Help Portal
- Expert mode for profile generationSAP Help Portal
- Derived rolesSAP Help Portal
- Composite rolesSAP Help Portal
- User master comparisonSAP Help Portal
- Transporting rolesSAP Help Portal
- Evaluating a trace in role maintenanceSAP Help Portal
- Subtleties of authorization maintenanceSAP Learning
- Troubleshooting authorization checksSAP Learning
- The SAP Fiori authorization modelSAP Learning
- KBA 2625102: PFCG_ORGFIELD reports are obsoleteSAP for Me
- Authorization objects in Financial AccountingSAP Help Portal
- Seven tips to customize your authorization management settingsSAPinsider
- Do security notes live up to their name?SAST blog, 2018
- STUSOBTRACE: a new tracing optionSAP Community, 2019
- The Profile Generator, 1998 presentationMIT