Lesson 2 of 5
Building roles
10 min
Listen to this lesson
With the design agreed, the build happens in transaction PFCG. A single role passes through the same tabs every time: description, menu, authorizations, users. This lesson follows Nadia's team building ZCMC_AP_INVOICE_POST, the master task role for posting supplier invoices, and explains what PFCG shows along the way.
The menu
The menu is where a role starts. SAP's course lists what it can hold: transactions, reports (each gets a transaction code), queries, transactions with variants, web addresses and file links, and, for Fiori, launchpad catalogs and spaces. Entries can be added one by one, copied from another role, or imported from a trace of what a user really ran. When the menu changes, the authorization proposals change with it.
- Description tabPurpose, owner, approval reference; for derived roles, the parent role
- Menu tabFiori catalogs, spaces and any SAP GUI transactions the task needs
- Authorizations tabChange authorization data: proposals appear from SU24 defaults
- Organizational levelsFill company code, plant and other org values with the dedicated dialog
- Open fieldsComplete yellow fields deliberately; avoid full authorization
- GenerateCreate the profile; then assign test users and run the comparison
Reading the authorization tree
When you choose to change authorization data, PFCG builds a tree of object classes, objects and authorizations from the menu's default values. Traffic lights show what still needs attention. SAP's course defines them precisely.
| Light | Meaning | What to do |
|---|---|---|
| Red | At least one organizational level field below has no value | Fill it with the Organizational Levels dialog |
| Yellow | At least one field below has no value (no org level missing) | Decide each value; do not fill blindly |
| Green | All fields below have values | Still review: green does not mean correct, and it can hide default values |
PFCG traffic lights, as SAP's course describes them.
SAP warns about two shortcuts. Assign Full Authorization of Subtree sets every open value to an asterisk, turning yellow to green in one click and least privilege off in the same click. And entering organizational values directly in the tree, instead of through the Organizational Levels dialog, changes the authorization's status to Changed and makes later maintenance harder.
Maintenance status
Each authorization carries a status that says how it got its values. SAP's course defines four, and they matter later when the menu changes and PFCG merges old values with new proposals.
| Status | Meaning | Effect on later maintenance |
|---|---|---|
| Standard | All values are unchanged defaults; org levels filled through the dialog still count | Updated cleanly when proposals change |
| Maintained | At least one empty default field was filled | Kept, and merged with new proposals |
| Changed | At least one proposed value was altered | The link to the menu can break; review after menu changes |
| Manual | Added by hand, not proposed by PFCG | Never refreshed from proposals; must be maintained by hand |
SAP's advice for a proposed value that must change: copy the standard authorization, set the original to inactive, and change only the copy. Deactivating keeps the entry and its history, so the default can be restored; deleting makes that harder. SAP's material calls deactivation the safer option.
Menus from real usage
For a conversion, the best evidence of what a job needs is what people ran in ECC. SAP's course shows that PFCG can import menu entries from a trace. Nadia's team uses usage data from EP1 as a starting list, then replaces retired ECC transactions with the S/4HANA apps that replace them, and asks the process owner to confirm each entry. Transactions nobody used in a year are left out; if someone needs them later, the request goes through the normal approval.
Generate, assign and compare
Authorizations take effect only after the profile is generated. Assign test users, run the user comparison, and only then start testing. For broad changes across many roles, SAP provides transaction PFCGMASSVAL to change organizational values or field values across roles in one go, which is useful when Wave 2 adds company code 1910 to selected roles.
What would you do?
Nadia's team is behind schedule. A consultant clicks Assign Full Authorization of Subtree on ZCMC_AP_INVOICE_POST to clear 14 yellow lights, generates, and reports the role ready for test. What should Nadia do?
- Build the menu first; proposals for authorizations follow from it.
- Red means an org level is missing, yellow means a field is open, green means filled but not necessarily correct.
- Statuses Standard, Maintained, Changed and Manual decide how authorizations behave when the menu changes.
- Fill org levels through the dialog, deactivate rather than delete, and avoid full authorization of subtrees.
Check your understanding · not graded
Lesson check
1. A red traffic light in PFCG means:
2. Which status shows that an authorization was added by hand rather than proposed?
3. Why does SAP recommend deactivating instead of deleting an unwanted authorization?
4. Which transaction changes org values across many roles at once?