Features of the SAP authorization concept
How to analyze roles and authorizations in the SAP system
If you want to use reference users and use the User menu, you should also ensure that users also see the role menus associated with reference users. To do this, enter the corrections in SAP Note 1947910. They include two switches for customising in the SSM_CUST table.
If the system trace has recorded permission data for this authorization object, it will appear in the right pane of the window. In the left pane, you can see the existing suggestion values. If you notice that you do not have any suggestion values that you think are necessary and have been recorded by the trace, you can set the suggestion values to Yes by selecting the appropriate row, column or field in the right pane and clicking the Apply button. You are free to make any manual adjustments to the field values. Afterwards, confirm maintenance and your changes are saved for this authorization object. Do the same for all other authorization objects.
Customise Permissions After Upgrade
By default, the transactions from the role menu can be found here as derived authorization values. Over the value assistance (F4) can be called partially the available functions fields to these field.
For the assignment of existing roles, regular authorization workflows require a certain minimum of turnaround time, and not every approver is available at every go-live. With "Shortcut for SAP systems" you have options to assign urgently needed authorizations anyway and to additionally secure your go-live.
The website "www.sap-corner.de" offers a lot of useful information about SAP authorizations.
The direct consequences are overauthorized users, a lack of overview and dangerous security gaps.