Lesson 3 of 5
Authorization errors
9 min
Sooner or later SAP will tell you no. The skill is recognizing whether the "no" comes from your authorizations (you are not allowed) or from the process (the system will not let anyone do this with this data). The two look similar to a frustrated user and need completely different fixes.
What a missing authorization looks like
In SAP GUI, authorization failures are usually explicit. You see a message in the status bar such as "You are not authorized to use transaction" followed by the code, or a message that you have no authorization for a specific organizational unit, for example a company code or a sales organization. The message text names the object you lack.
In the Fiori launchpad, the symptoms are more varied, and some are silent:
- The app is simply not there: no tile, nothing in the App Finder. Your catalogs do not include it.
- The tile opens but shows an error that the app could not be opened, or that navigation to the target is not possible. Often a missing role for that app or a related navigation target.
- The app opens, but an action button such as Create or Edit is missing or disabled. You may have display access but not change access.
- The app opens and shows fewer records than expected, with no error. Data restrictions filter the list to the organizational units you are allowed to see.
Using SU53
In SAP GUI, transaction SU53 displays the last authorization check that failed for your user. Run it immediately after the error, before you do anything else, and include the screen (or its text) in your ticket. It tells the security team exactly which authorization object and value were checked. For Fiori apps it is less reliable: some Fiori checks are not captured there, and the data restrictions behind analytical and list apps do not raise a failure at all. That is why the symptom description in your ticket matters so much.
Authorization or process?
A process error is the system enforcing a business rule that applies to everyone. Examples: the posting period is closed, the customer is blocked for delivery, the material has no sales view for this sales organization, a mandatory field is empty, or the credit limit is exceeded. A super-user would get the same message. These are fixed by correcting data or following the process, not by changing your roles.
- Does the message say you are not authorized, or name an authorization object?Yes → authorization issue; capture SU53 and raise an access ticket · No → keep checking
- Is the app or button missing entirely for you but present for a colleague in the same job?Yes → likely catalog or activity difference; compare roles · No → keep checking
- Does the message describe the data, such as a closed period, a block, a missing view or an empty field?Yes → process or master data issue; fix the data or follow the process · No → keep checking
- Would a colleague with full access get the same result with the same data?Yes → process issue or defect · No → authorization issue
Raising a good ticket
Security teams handle dozens of access tickets a day. A ticket that says "SAP doesn't work" goes to the back of the queue. A ticket with these items gets fixed:
- System and client (for example QAS client 100) and your user ID.
- The app name and, for Fiori, the app ID from the reference library, or the transaction code.
- What you tried to do, with the data: "change sales order 1000457 in sales area 1710 / 10 / 00".
- The exact message text, or a description of what was missing, such as "Edit button not shown".
- The SU53 result for SAP GUI errors, captured straight after the failure.
- Why you need it: the business task, and whether a colleague in the same job can do it.
| Message or symptom | Likely type | First action |
|---|---|---|
| "You are not authorized to use transaction ..." | Authorization | Capture SU53, request the role through the access process |
| "No authorization for company code 1720" | Authorization (organizational) | Confirm you should work in 1720; if yes, request the restriction |
| "Posting period 007 2026 is not open" | Process | Ask finance whether the period should be open; do not request roles |
| "Customer is blocked for sales" | Process / master data | Check the block reason with the credit or master data team |
| List shows fewer records than a colleague sees | Possibly authorization (data restriction) | Compare the filters, then the organizational restrictions |
What would you do?
During Contoso UAT, Maria reports "Billing is broken: I get an error creating the invoice for delivery 80001234." Priya asks for the message. It reads that the posting period is not open for company code 1710. What should Priya do?
- Authorization errors say you are not allowed; process errors say the data or process does not permit the step for anyone.
- In Fiori, missing authorizations can appear as missing apps, missing buttons, navigation errors or silently filtered lists.
- Run SU53 straight after a SAP GUI authorization failure and attach it to the ticket.
- A good ticket names the system, client, app or transaction, the data, the exact message and the business reason.
Check your understanding · not graded
Lesson check
1. Which transaction displays the last failed authorization check for your user?
2. A message says the posting period is not open. What kind of error is it?
3. Why is a silently filtered list risky for a tester?
4. What should a good access ticket include?
5. The Edit button is missing in an app that a colleague in the same job can edit in. What is most likely?