Business catalogs and roles

SAP describes a business role as an abstract construct that represents a job a person does. In practice it is the bundle of apps, layout and authorizations that lets someone in that job work. SAP delivers business roles as templates, with IDs in the SAP_BR_* namespace, such as an accounts payable accountant or a purchaser. You copy and refine them; you do not assign them as delivered and you do not edit the originals.

Inside a business role are business catalogs: groups of apps that belong together for a task, such as processing supplier invoices. In the on-premise and private cloud content model, a business catalog holds references to tiles and target mappings that are defined once in technical catalogs (IDs containing _TC_). Business catalogs carry _BC_ in their IDs. Referencing instead of copying keeps app definitions consistent across every catalog that uses them.

Private Edition: business roles are PFCG roles

In SAP S/4HANA Private Edition, which is what Contoso is moving to, a business role is implemented as a PFCG role. On the role's Menu tab you insert launchpad catalogs and a launchpad space; generating the profile then pulls in authorization proposals from SU24 for every app in those catalogs. Legacy apps (SAP GUI for HTML transactions and Web Dynpro applications) still belong to catalogs, so their tiles appear the same way, but their proposals come from the transaction or Web Dynpro application they call.

To get started quickly, Sam's Basis team can use the task list SAP_FIORI_CONTENT_ACTIVATION in transaction STC01. It activates the apps, OData services and ICF nodes for selected SAP business roles, generates working copies of those roles with authorization profiles, and can generate one test user per role. SAP advises applying the latest version of SAP Note 2686456 first and running it in the background for large selections. A companion task list handles customer-built roles. This is a fast way to get a sandbox where the delivered content works, which is excellent for fit-to-standard demos and for comparing your design against SAP's.

Public Edition: Maintain Business Roles

In SAP S/4HANA Cloud Public Edition, you never touch PFCG. Administrators use the Business Role Templates app to find SAP's templates, and the Maintain Business Roles app to create roles, usually with Create From Template. The new role inherits the template's business catalogs; you add or remove catalogs, set restrictions and assign business users. SAP's own guidance is the same as for private cloud: copy, don't edit the standard role, and apply least privilege.

Designing Contoso's roles

Contoso's ECC roles were transaction-based: Ana's AP role was a long list of SAP GUI transactions. Nadia's approach for S/4HANA is to start from the SAP template closest to the job, compare its catalogs with what the ECC role allowed, and remove catalogs the job does not need. A catalog is an all-or-nothing unit: if you include it, the user gets every app in it. When only part of an SAP catalog fits, Nadia creates a custom business catalog that references just the apps required, rather than adding whole catalogs and hoping nobody notices the extra apps. SAP's guidance is to keep catalogs to around 100 apps at most.