Authorization Troubleshooting and Tracing

Keep this: job aid

Authorization troubleshooting card

• Read the exact message; compare with a broad-access user before routing to security.
• SU53 says all checks were successful? Look at data, configuration or locks.
• Capture SU53 at once: system, client, time, step, object, requested and held values.
• Use STAUTHTRACE for long processes, technical users, Fiori service calls, or chains of failures.
• Trace only the affected user, run the whole process, switch the trace off, filter failures first.
• Ask: should the job do this? Does a role already grant it? Functional or org gap? SoD impact?
• Add the value, not the object; no wildcards, manual profiles or SAP_ALL.
• Fix SU24 when an app always needs a value.
• Record evidence, design reference, approval, transport, risk check, positive and negative retest.