Least privilege

The building blocks say how access is granted. Least privilege says how much. NIST's glossary defines it as a principle that restricts users' access to what their assigned tasks require; one NIST source phrases it as each entity being granted the minimum system resources and authorizations it needs. In SAP terms: the right functions, the right activities, and the right organizational values, and nothing else.

Least privilege in SAP terms

Least privilege in SAP works on three dimensions at once. A role can be too broad in any of them, and each needs its own test.

Wildcards are the usual culprit. An asterisk in an organizational field grants every value, including company codes created in the future. When Contoso adds company code 1910 for Alternadores del Norte in Wave 2, every role with BUKRS = * silently gains access to Mexican data. Roles with explicit values do not.

Need-to-know and dual control

Least privilege has two close relatives. Need-to-know limits display access, not just change access: an AP clerk may need to see a supplier's address but not every employee's salary. Dual control, which SAP's course describes for administration itself, splits sensitive tasks so no single person controls them end to end. SAP's example is splitting user, authorization data and profile administration among several administrators. The same idea, applied to business processes, is segregation of duties: the buyer who creates a PO over $25,000 should not be the one who approves it, and the person who maintains supplier bank details should not be the one who posts payments.

Practices that keep access lean

• Start from tasks. Build roles from what the job does, not by copying a colleague's user.
• Use explicit organizational values. Avoid asterisks in company code, plant and purchasing organization fields.
• Use validity dates. Time-limit project and temporary access, and run the comparison that enforces it.
• Reuse before you add. SAP's advice when a trace shows a missing authorization: check whether an existing role fits before creating a new one.
• Review regularly. SAP recommends monitoring critical authorizations and who holds them with a defined procedure and checklists.

Least privilege in a conversion

A system conversion carries ECC roles into S/4HANA. That is convenient, but it also carries over every shortcut taken in fifteen years of support: wildcard plants, copied users, roles nobody owns. Contoso uses the conversion as a checkpoint. Each role is assigned an owner, compared with what its users actually ran in production, and tested in CMQ with the new apps before it is accepted. Roles nobody claims are not converted.

Why testers care

Role defects cut both ways. Too little access shows up at go-live as users who cannot work; it is loud and gets fixed. Too much access shows up months later in an audit finding or a fraud case; it is quiet and expensive. Most test plans only cover the loud side. A role test that never includes a negative case has not tested least privilege at all.