Business roles and catalogs

When you log on to SAP S/4HANA, you do not see the whole system. You see the part of it your job needs. That is not an accident and it is not a limitation of your screen. It is the result of the business roles your security team assigned to your user. Understanding how roles work makes you faster at finding things, better at asking for access, and much better at telling a real defect from a permissions gap.

A business role represents a job: accounts payable accountant, billing clerk, warehouse clerk, internal sales representative. One person often holds several roles. At Contoso Motor Co., Maria, the order-to-cash key user, has a sales role for order entry and a billing role, because in Detroit she does both.

What a role contains

A role answers two separate questions. First: which apps can this person start? Second: which data can they see or change inside those apps? SAP handles the first through catalogs and the second through authorizations.

Business catalogs grant access to apps. Spaces and pages decide how those apps are laid out on your launchpad. The two are not the same thing. An app can be in one of your catalogs without having a tile on your home page; you can still find it through the App Finder or the search bar. Since SAP S/4HANA 2020, spaces and pages are the default launchpad layout and the older "groups" concept is being phased out, so if colleagues talk about "my groups", they are describing the older layout.

Templates and copies

SAP delivers hundreds of business role templates, one per typical job. In on-premise and Private Edition systems, the security role behind a template has a name starting with SAP_BR_, such as a role for the accounts payable accountant. SAP's guidance is that customers copy a template and adjust the copy rather than changing SAP's original. So at Contoso you will see copies with a Contoso prefix, built in role maintenance (transaction PFCG) by the security team.

In SAP S/4HANA Cloud Public Edition, the idea is the same but the tools differ: administrators create business roles from templates in a Fiori app and restrict them by organizational values there. The principle you need as a user does not change.

Restrictions by organizational unit

Two people can hold copies of the same role and still see different data. A billing clerk in Detroit may be restricted to sales organization 1710, while a colleague in a different business unit sees only her own sales organization. These restrictions use the organizational units you met in the foundations courses: company code, plant, sales area, purchasing organization.

Seeing your own access

You rarely need to read your role list, but it helps to know where to look. In the Fiori launchpad, the App Finder lists every app in the catalogs assigned to you, whether or not it has a tile. If an app is not in the App Finder, you do not have it. In SAP GUI, your own user settings (SU3) hold defaults such as date format and decimal notation, but the list of roles is normally maintained by the security team in user maintenance; your help desk can tell you which roles you hold.