Testing SAP Authorizations and Roles

Keep this: job aid

SAP role testing card

• Start from the role-to-process matrix: allowed, restricted, not allowed.
• Positive tests: complete the step through save with exactly the planned roles.
• Negative tests: wrong org unit, wrong activity, sensitive data, direct start of out-of-role functions, SoD pairs.
• Test users mirror production role combinations and org values; run the user master comparison after changes.
• Never widen a role-test user to get past a failure; log it.
• Diagnose: SU53 first in SAP GUI; STAUTHTRACE for Fiori, background or unclear cases; gateway error log for 403s.
• Role defect: user, roles, expected access, step, failed object and values, evidence.
• SoD: rule set plus access risk analysis plus negative tests; accepted conflicts need a tested mitigating control.
• Upgrades: SU24/SU25 role adjustment, then the role regression pack and a fresh risk analysis.
• Restore test users after every refresh.