Now accepting guest editorial from SAP, Oracle, Workday and ServiceNow practitioners.Pitch a guide
The Sign-Off Table

Lesson 4 of 5

Minimal fixes

9 min

Listen to this lesson

0:00 / 5:25

Finding the gap is half the job. The other half is closing it without opening something else. Most audit findings about SAP roles are not missing access; they are excess access added under time pressure during testing or hypercare. SAP's own training says it directly: do not immediately turn the result of a trace or SU53 into new roles or profiles. Look at what already exists first.

Four questions before any change

  1. Should this job do this at all?Yes → continue · No → the failure is correct; close the defect as working as designed
  2. Does an existing role already grant it?Yes → assign that role if it fits the job · No → change the role that owns this task
  3. Is the gap functional or organizational?Functional → fix the master role · Organizational → fix the derived role's org values
  4. Would the change create an SoD conflict?Yes → stop and involve the risk owner · No → make the change and test it
The decision path before Nadia changes any role.
The Sign-Off Table · thesignofftable.com/academy/sap-sec-203

What a minimal fix looks like

  • Add the value, not the object: if the gap is activity 01 for company code 1710, add exactly that.
  • No wildcards for convenience: * in an activity or organizational field grants every current and future value, including delete and company codes not yet created, such as 1910 before Wave 2.
  • Fix the role, never the user: no manual profiles on user masters, no direct authorizations outside roles.
  • Fix it where it belongs: functional values in the master role, organizational values in the derived role, so all derived roles stay consistent.
  • Fix the source when the app needs it everywhere: if SU24 lacks a proposal the app always needs, maintain it in SU24 so every role containing the app inherits it.
  • Prefer merge over manual edits: regenerate with the merge of new proposals rather than adding manually maintained objects that drift from SU24.
Gap foundOver-granting fixMinimal fix
F_BKPF_BUK, activity 01, company code 1710Activity * and company code *Activity 01 for 1710 in the AP master role
Plant 1720 missing for a Chicago warehouse clerkPlant * in the inventory master rolePlant 1720 in the Chicago derived role
Table display for one custom tableS_TABU_DIS with all authorization groupsS_TABU_NAM for that table, display only
Job user missing one RFC function groupSAP_ALL on the job userS_RFC for that function group in the job's role
Four real gap types from Contoso's test cycles, fixed two ways.
The Sign-Off Table · thesignofftable.com/academy/sap-sec-203

After the change: prove it is minimal

A fix is only minimal if a test says so. After Nadia changes a role in CMD and it reaches CMQ, Priya reruns the failed step with the role-based test user (the positive test) and then runs at least one step the change must not allow, such as posting for company code 1810 or deleting a document (the negative test). If the role contains derived roles, she samples one sibling derived role as well, because a change in the master role reaches all of them. Only when both tests pass does the defect move to closed.

A change in the master role reaches every derived role, so Priya's retest covers the fixed role, a negative case and one sibling.
The Sign-Off Table · thesignofftable.com/academy/sap-sec-203

One more trap: fixing the test user instead of the role. During cycle 2, a tester added a second role to her test user to get past a failure. The test passed, the role defect stayed hidden, and it reappeared on day one in production. Priya's rule is that test users are changed only to match the planned production assignment, never to pass a test.

Widening a test user to pass a test only moves the role defect to production; the fix belongs in the role.
The Sign-Off Table · thesignofftable.com/academy/sap-sec-203

What would you do?

Maria's role-based test user cannot change a sales order for distribution channel 20 in sales area 1710. SU53 shows the gap on V_VBAK_VKO. The role design says Maria's order-to-cash role covers distribution channels 10 and 20. A colleague proposes setting the distribution channel to * so this never happens again. What should Nadia do?

Key points
  • Check the design first: a failed check can be correct behavior.
  • Add the missing value in the right place: master role for functions, derived role for org values.
  • Avoid wildcards, manual profiles and SAP_ALL; they create audit findings and SoD conflicts.
  • Fix SU24 when an app always needs a value, so every role inherits it.
  • Never widen a test user to pass a test.

Check your understanding · not graded

Lesson check

  1. 1. Why is granting * in the company code field a risky fix?

  2. 2. A Chicago warehouse role lacks plant 1720. Where should the value be added?

  3. 3. When is maintaining SU24 the right fix rather than changing one role?

  4. 4. A tester adds a second role to her test user to get past a failure. What is the problem?