Lesson 3 of 5
User types
10 min
Listen to this lesson
Not every user is a person at a keyboard. Interfaces log on, background jobs run under a user, and some accounts exist only to pass authorizations to others. SAP's user type, set on the Logon Data tab of SU01, tells the system how each account may log on and how its password behaves. Getting it right is a basic control that auditors check early.
The five user types
| Type | Code | Dialog logon | Password behavior | Typical use |
|---|---|---|---|---|
| Dialog | A | Yes | Expiry and initial passwords checked; user can change own password | One named person: Ana, Maria, Priya |
| System | B | No | Not checked for expiry; only an administrator can change it | Background processing and internal RFC calls |
| Communication | C | No | Depends on whether logon is interactive | Dialog-free communication between systems, such as RFC users for ALE, workflow, transport management |
| Service | S | Yes | Not checked for expiry; only an administrator can change it | A dialog user for a larger anonymous group, with very restricted authorizations |
| Reference | L | No (cannot log on) | Not applicable | Passes identical extra authorizations to other users |
SAP user types, as described in SAP's authorization course.
Two points are easy to get wrong. A service user can log on in dialog, unlike system and communication users, which is why SAP says it should have only very restricted authorizations. And a reference user cannot log on at all; it exists so that a set of authorizations can be attached to many users at once. SAP's material advises caution with reference users, because whatever they carry spreads silently.
- Is the account used by exactly one person?Yes → dialog user (A) · No → next
- Does a background job or internal process run under it?Yes → system user (B) · No → next
- Does another system call in without dialog?Yes → communication user (C) · No → next
- Is it an anonymous shared dialog access?Yes → service user (S), tightly restricted · No → next
- Is it only a carrier of shared authorizations?Yes → reference user (L), used with caution · No → review the request
Business users in S/4HANA
SAP S/4HANA adds the business user concept. A business user is a person represented by a business partner and a linked user, in a one-to-one relationship that cannot be changed. SAP's material notes that many S/4HANA applications, including several Fiori apps, need business users. Technical users for interfaces and batch stay as plain SU01 users. In Contoso's conversion, every ECC dialog user who is an employee has to become a business user, which is a data migration and testing task, not just a security one.
User master essentials
- Validity period: a user can have from and to dates; so can each role assignment, which suits temporary project access.
- User groups: divide user maintenance among administrators, who can only maintain users in groups they are authorized for.
- Locks: an administrator can lock a user; failed password attempts can also lock it.
- Mass maintenance: SU10 changes many users at once and logs who changed what.
Technical users deserve their own inventory. Contoso's conversion carries over dozens of RFC and batch users from ECC, some created years ago with broad authorizations because it was quicker. Sam and Nadia list every non-dialog user with its type, owner, the interfaces or jobs it serves and its roles, and they remove or restrict any that nobody can explain. A technical user without an owner is a standing invitation, because its password rarely changes and nobody notices when it is used.
What would you do?
Sam finds an RFC user for the EDI interface with Great Lakes Fleet Services set up as a dialog user with broad authorizations. What should he recommend?
- Dialog (A) users are for one person; system (B) and communication (C) users cannot log on in dialog.
- Service (S) users can log on in dialog for anonymous groups and need very restricted authorizations.
- Reference (L) users cannot log on; they pass extra authorizations to other users.
- S/4HANA business users link a person's business partner and user one-to-one.
Check your understanding · not graded
Lesson check
1. Which user type is intended for system-to-system communication without dialog logon?
2. What is special about a reference user?
3. Which user type can log on in dialog but is meant for an anonymous group?
4. What links a person to a user in S/4HANA's business user concept?