Now accepting guest editorial from SAP, Oracle, Workday and ServiceNow practitioners.Pitch a guide
The Sign-Off Table
All guides

Guide · SAP security

Test Fiori Catalog Authorizations in S/4HANA Roles

Test Fiori tile visibility, app launch and data access after an S/4HANA role redesign, using PFCG, SU24, SU53 and a per-catalog test matrix.

Matt Angerer
November 5, 2026 · 8 min read · 15 sources
Connect on LinkedIn

To test Fiori authorizations after a role redesign, prove three things separately for every catalog: the tile is visible, the app launches, and the data loads. Each one depends on a different object. Most redesign defects we see pass the first check and fail the second or third, so a clean launchpad screen is not a sign-off. Run the test per business role, with a negative case for each user who should not see the tile.

What changed from ECC

In ECC, most role testing started and ended with transaction codes in the PFCG menu. In S/4HANA the same role also has to carry the Fiori catalog, the OData services behind each app, and the business authorizations those services check. The launchpad itself has moved too. The Groups-based home page has been officially deprecated since S/4HANA 2021 FPS01, and SAP no longer invests in innovations for Groups, according to a SAP Community answer. SAP Note 3500249 says Groups still work in S/4HANA 2025, so a redesign that keeps Groups is valid, but it is a dead end for new work.

Two S/4HANA 2025 changes affect how you collect evidence. With SAP S/4HANA 2025, the Launchpad Content Aggregator (/UI2/FLPCA) also includes spaces and pages layouts, and a new tool, the Launchpad Content Aggregator by User (/UI2/FLPCA_USER), is added. The older overview of roles, spaces and pages, /UI2/RSP_LIST, is retired. Update your evidence scripts and screenshots to match.

The layers you are actually testing

Keep the layers apart in your test design. A defect in one layer looks like a defect in another, and mixing them is the most common reason a retest cycle runs long.

Launchpad layoutSpaces and pages decide where a tile sits. They carry no authorization of their own.
Catalog in the role menuThe business catalog in the PFCG role decides which apps the user can see at all.
Start authorizationS_SERVICE entries for the front-end (IWSG) and back-end (IWSV) OData services let the app open and call its data.
Business authorizationsObjects such as those proposed in SU24 for the app's transactions and services control what the user can read or change.
Figure 1. The four authorization layers behind a Fiori tile, from layout down to business data

The layout layer is safe to change without a security review. Spaces and pages do not touch authorization. If a tile sits on a page but the user has no authorization for the underlying app, SAP hides that tile automatically. That is useful for testing, but it also means a missing tile can have several causes. Work out which layer is broken before you change anything.

The catalog layer does the heavy lifting. If available, the system determines the OData services for a catalog and automatically includes the start authorizations when adding the catalog to the role menu. Adding the catalog is the right design choice, but it also means a catalog edit can change a role without anyone touching the authorization tab. Record the catalog version in your test evidence.

Build the test matrix before you touch PFCG

Write the matrix from the design, not from the system. For each business role, list every catalog and every tile in it. Then add the expected result for three checks: tile visible, app opens, data loads. Add a fourth column for the user who should be blocked.

  • Role name, catalog ID, and the tile ID or app ID from the SAP Fiori apps reference library.
  • The OData services the app uses, taken from the app's implementation information in the reference library.
  • Expected tile visibility for the target role, and the role that must not see it.
  • The business objects the app checks, confirmed in SU24 for the service and any transactions it calls.
  • Test user ID, date of the test, system and client, and the tester's name for the evidence file.

For SoD-sensitive roles, the matrix should show that the tile is hidden from the conflicting role as well as visible to the owner. The SAP Fiori Launchpad Role & App Test Checklist gives a starting layout, and the Security, Role & SoD Test Plan covers the conflict cases.

Run the three checks in order

Run the checks in this order, so each failure points to one layer.

  1. VisibilityLog on as a test user with only the redesigned role. Confirm the catalog tile appears in the expected space or group.
  2. LaunchOpen the app. If it fails to open, check the start authorization for the OData service and the front-end role.
  3. DataConfirm the lists and KPIs load. A tile that opens but shows an error often means a business object is missing.
  4. NegativeRepeat with a user from the excluded role. The tile must be absent, and a direct URL call must fail.
  5. DiagnoseFor each gap, read the failed check in SU53 and the app trace before granting anything.

SU53 is the first tool to open. SU53 shows the last failed authorization check, which makes it the first stop when a tile is missing for authorization reasons. For the data layer, use App Support on the launchpad. One SAP blog describes a case where a security team granted the launch authorization but not the data authorization, so the app showed a "cannot load tile" error. The app's SU24 result showed the S_SERVICE object for launching it, plus two business objects the user needed to see the data. That pattern is the one to look for in every role review.

Do not test with SAP_ALL. A user with broad access will hide the gaps you are trying to find. Test with the user profile that the business will receive, and log every failed check.

Test after SU25 and every upgrade

Authorization defaults move with the release. Run transaction SU25 once on first install and again after each S/4HANA release upgrade. Treat that as a gate in your upgrade plan. If SU25 is skipped or run late, SU24 proposals may not match the new app versions, and your role generation will produce authorizations that do not match what the app checks.

Catalog content also changes at upgrade. The missing apps issue commonly happens after a system upgrade, because business catalogs can change after each system upgrade. Compare the tile list before and after the upgrade for each custom business role. The Launchpad Content Aggregator can help: the source release must be S/4HANA 1909 SPS04 or 2020 FPS01 or higher to use it, and you run it on your custom business roles in the source release. Use the output as the baseline for your regression scope, as covered in the guide to S/4HANA upgrade cadence and regression.

Keep the segregation of duties intact

Catalog changes are a security change, even when they look like a layout change. Separate the people who maintain launchpad content from those who run the Basis tasks. SAP's rapid activation task list SAP_FIORI_FCM_CATALOG_ACTIVATION activates apps by business catalog. The SAP Community guidance on it notes that your Basis expert is responsible for service activation but is not allowed to maintain roles or change launchpad content. Your test evidence should show who ran the task and who approved the role change.

Also keep catalogs narrow. Business catalogs should follow discrete tasks, and catalog assignment governs visibility, while backend authorization objects govern capability. Test both, and record them separately. The SAP Testing CoE operating model shows how to assign these checks across Security, Basis and business owners in a RACI, and the RISE testing ownership guide explains why this still falls to your team under RISE.

If your roles include Joule or agent features, add those to the matrix. Launchpad features can now be controlled by role from S/4HANA 2025, including who sees the Joule icon. The Joule agent authorization testing guide covers the agent side of the same question.

Evidence and sign-off

An auditor will ask for four things: the role design, the matrix, the results with timestamps, and the approval trail. Keep them in one folder per release.

  • Role export and the catalog list for each business role, with the catalog version.
  • Matrix results for visibility, launch, data and the negative case, one line per tile.
  • SU53 and App Support screenshots for every failed check, with the fix ticket linked.
  • SU25 run record for each system and the date it was run.
  • Sign-off by the Security lead, the business role owner, and the Basis lead, with separate names.

If you want practice on this before the next release, the free Business Roles in SAP Fiori and SAP S/4HANA Cloud course covers the role model, and the Authorization Troubleshooting and Tracing course covers the diagnosis step.

Frequently asked questions

If a user can see the tile, does that mean the app works?

No. The tile shows that the catalog reached the role, but the app still needs the start authorization and the business authorizations behind its data. Test launch and data as separate steps, and record each result. A pass on the launchpad alone does not meet a sign-off standard.

Do spaces and pages affect authorizations?

No. Spaces and pages control layout only. A tile on a page is still hidden if the user has no authorization for the app. When you redesign the layout, retest visibility for each role, but you do not need a new authorization review just because a tile moved.

Can we keep Fiori groups in S/4HANA 2025?

Yes, for now. SAP Note 3500249 confirms that Groups remain available in S/4HANA 2025, but the Groups-based home page is deprecated and SAP does not invest in it. Plan the move to spaces and pages as a separate project, and test both the old and new layouts during the transition.

What should we do when SU24 does not show the app's objects?

Check that the OData service for the app is activated and that the app's reference entry lists the service you are looking at. Then run SU25 for the release if it has not been run since the last upgrade. If the objects still do not appear, open a support incident with the app ID and the release.

Sources

  1. Explaining SAP Fiori Authorization Model, SAP Learning
  2. SAP Fiori Launchpad Content and Authorization Concept, SAP Help Portal
  3. SAP Fiori for SAP S/4HANA: Finding authorization objects for SAP Fiori apps with SU24, SAP Community
  4. SAP Fiori for SAP S/4HANA: Composite Roles in launchpad content and layout tools, SAP Community
  5. SAP Fiori for SAP S/4HANA: Upgrade Faster, more use cases for Launchpad Content Aggregator, SAP Community
  6. Catalogs and Groups for FIORI Launchpad, SAP Community Q&A
  7. SAP Fiori for SAP S/4HANA: Replacing SAP Fiori apps during system conversion, SAP Community
  8. SAP Fiori for SAP S/4HANA: Activating Apps by Business Catalog, SAP Community
  9. Controlling SAP Fiori Launchpad Features by Role, SAP Learning
  10. Can't Find Apps in the Fiori Launchpad? Hints Here, SAP Community
  11. SU24 blog, SAP Community (see SU25 guidance), SAP Community
  12. SAP Fiori Launchpad Configuration: Spaces, Pages and Catalogs, Rakesh Narayan
  13. SAP Fiori Tiles Missing After Login: Role Checks, Galal Academy
  14. Securing SAP Fiori Apps: Catalogs, Groups & Roles, BMCG
  15. Acing the SAP Roles and Authorization Design Review, SAP Community

Free S/4HANA testing templates

Master test strategy, migration test plan, cutover runbook, go/no-go checklist and more.

The RISE Testing Playbook

One practical move a week for testing your ECC to S/4HANA transformation.

How this guide is made: researched with AI-assisted search across SAP documentation and practitioner sources, with every fact linked to its source. Found an error or have field experience to add? Tell us.