Role Design and Maintenance with PFCG

Keep this: job aid

PFCG role build and release checklist

• Design first: task roles as building blocks, derived by org level, combined into composite job roles.
• Name it: ZCMC_ prefix, type, area, task, org value; never change SAP_ templates in place.
• Build the menu; check SU24 defaults exist for every app, especially custom ones.
• Fill org levels through the dialog; decide each yellow field; avoid full authorization of subtrees.
• Change proposals by copying and deactivating the original; never delete to hide.
• Keep non-org values in the master; push with Generate Derived Roles; check org values first.
• Document purpose, owner, master, apps, exclusions and test links.
• Transport without user assignments (USER_REL_IMPORT = NO in targets); include the master for derived roles.
• After import: user comparison, then positive and negative tests with SU53 evidence.
• Review Do not check, manual and full authorizations before approving for production.