AUTHORIZATIONS IN SAP SYSTEMS
SAP S/4HANA® migration audit
It is very important that critical authorizations are generally subject to a monitoring process in order to be able to ensure that they are assigned in a productive system in a very restricted manner or not at all. Law-critical authorizations in particular, such as deleting all change documents, debugging ABAP programs with Replace, and deleting version histories, must never be assigned in a production system, as these authorizations can be used to violate the erasure ban, among other things. It must therefore be ensured that these authorizations have not been assigned to any user, not even to SAP® base administrators.
The concept for in-house developments is obligatory for every company that writes its own software. It specifies requirements, for example, for the structure, naming and documentation of program components, and in particular for dealing with safety-critical aspects. The wording should not be too general, but should explicitly address the special features of programming in SAP.
Conclusion and outlook
Business objects to which companies refer authorizations are defined in the system as authorization objects. For individual conditions, SAP delivers the authorization objects F_FICO_IND and F_FICO_AIN. With F_FICO_IND you can define which individual conditions are checked when processing the contract depending on the defined authorization fields and their characteristics. Using the authorization object F_FICO_AIN, companies can define whether and how individual conditions are to be checked when processing in the BAPI channel depending on the defined authorization fields and their characteristics.
During go-live, the assignment of necessary authorizations is particularly time-critical. The "Shortcut for SAP systems" application provides functions for this purpose, so that the go-live does not get bogged down because of missing authorizations.
The website "www.sap-corner.de" offers a lot of useful information about SAP authorizations.
In particular, you can derive valuable information about customer transactions, since experience has shown that not all transactions are used.