Designing a Compliant Role Architecture for S/4HANA Transformation

Keep this: job aid

Role redesign and go-live access checklist

• Baseline: users, roles, usage, conflicts, broad access, custom transactions, emergency access.
• Classify each legacy role: retire, adapt or redesign; record the approach and the numbers.
• Start from SAP business role templates (SAP_BR_*), copied to your namespace.
• Task roles from catalogs; derived roles for organizational values; business roles for jobs.
• Update the rule set for Fiori apps and OData services before design; regenerate rules.
• No conflict inside a task role; every remaining job conflict split, mitigated with an owner, or redesigned.
• Test roles positive and negative; UAT with real mapping for high-impact jobs.
• Mapping: usage proposal, manager review, user-level SoD analysis, reconcile in every mock.
• Cutover: lock, freeze, load, reconcile, analyze, unlock, revoke; emergency access owned and logged.
• Evidence pack complete and findable; first access review within ninety days.