Lesson 2 of 5
Roles and profiles
10 min
Listen to this lesson
Nobody assigns authorizations one by one. Access is packaged in roles, built in transaction PFCG (role maintenance). A role has a menu of what the user can start and the authorizations those functions need. When the role is generated, the system creates a profile that holds the authorizations. This lesson explains the role types and how they relate to profiles.
Single roles
A single role is the basic unit. Its menu lists transactions, Fiori launchpad content, reports and links. From the menu, PFCG proposes the authorization objects and default values the functions need, the administrator completes the open values (company code 1710, purchasing organization 1710, and so on), and then generates the profile. Authorizations only take effect after generation. SAP's material notes that a role can have several generated profiles if it is large.
- Build the menuAdd the apps and transactions the job needs
- Review proposalsPFCG proposes objects and default values for the menu
- Fill open valuesOrganizational levels and other empty fields
- GenerateThe profile is created; only now do authorizations take effect
- Assign usersOn the User tab, then run the user comparison
Composite roles
A composite role is a container of single roles, so one job can be assigned in one step. SAP's material is precise about its limits: a composite role holds no authorization data of its own; to change what it grants, you change its single roles. Composite roles cannot contain other composite roles. When a user is assigned a composite role, the user comparison assigns its single roles, which appear read-only in the user master.
| Single role | Composite role | Derived role | |
|---|---|---|---|
| Has its own authorizations | Yes | No; only through its single roles | Yes; values differ from its parent |
| Has a menu | Yes | Yes, read from its single roles | Inherited from the parent; not editable |
| Generates a profile | Yes | No | Yes |
| Typical use | One task or function | One job made of several functions | Same function for a different organizational unit |
| Contoso example | ZCMC_AP_INVOICE_POST | ZCMC_JOB_AP_CLERK | ZCMC_AP_INVOICE_POST_1810 |
Derived roles inherit the menu and authorizations of a parent role and differ only in their organizational values, such as company code 1710 versus 1810. They are the subject of the role design course; for now, know that they exist and why: maintain the function once, vary the organization.
Profiles
A profile is the technical container the user buffer is built from. Today almost all profiles are generated by PFCG. SAP recommends generating profiles through roles and using manual profiles only in exceptional cases. Two rules follow. Never type a generated profile directly into the user master in SU01, because the next comparison removes profiles that are not backed by an assigned role. And treat the few remaining manual profiles with suspicion: SAP_ALL grants every authorization and SAP_NEW grants broad access to checks added in an upgrade. Neither belongs on a business user in production.
Assigning roles to users
Roles reach users on the role's User tab or in SU01, but the assignment only becomes effective access after the user comparison, which writes the generated profiles into the user master. SAP's material describes running it from PFCG, in the background with report PFCG_TIME_DEPENDENCY, or with transaction PFUD, and recommends running it regularly. Time-limited assignments depend on it: a role with an end date is only removed when the comparison runs after that date. A tester who is told "the role is assigned" should check that the comparison has run before logging an authorization defect.
Templates and namespaces
SAP delivers roles that start with SAP_ as templates. They can be overwritten by upgrades and support packages, so copy them into the customer namespace before changing them. Contoso's roles start with ZCMC_, with a naming convention that tells a single role from a composite one, because the system does not distinguish them by name.
What would you do?
Contoso's security lead, Nadia, finds that a composite role for buyers grants change access to company code 1810, which buyers should not have. Where must she fix it?
- Roles are built in PFCG; generation creates the profile and makes authorizations effective.
- Composite roles bundle single roles and hold no authorization data; they cannot contain composites.
- Derived roles share the parent's menu and function and vary organizational values.
- Copy SAP_ templates into your namespace; never assign generated profiles directly; keep SAP_ALL and SAP_NEW off business users.
Check your understanding · not graded
Lesson check
1. What does a composite role contain?
2. When do a role's authorizations take effect?
3. Why should SAP_ template roles be copied before changing them?
4. Why not type a generated profile into SU01 directly?