topic PFCG Authorization Updates in Application Development and Automation Discussions

PFCG Authorization Updates

Former Member — Sun, 13 Apr 2014 18:08:10 GMT

Hi,

To reorganize the work inside our SAP team, we are in discussion for who should be responsible for functions (MM,FI,CO,HR,Sales) PFCG authorization modifications.

Please; advise the best practice from SAP, who can better handle functions (MM,FI,CO,HR,Sales) PFCG authorization modifications, the BASIS

team or the function consultants?

Best Regards

Fawzy Ibrahim

Re: PFCG Authorization Updates

Colleen — Sun, 13 Apr 2014 21:56:26 GMT

Hi Fawzy


the BASIS
team or the function consultants?

I'd say the security team

Whoever you choose, ensure they are actually trained and knowledgeable of PFCG/SU24/general security. Splitting role maintenance across several teams can create inconsistent role build.

Basis might know how to click and tick boxes (or at least a step ahead of 'just assign sap_all') but they need to understand what the authorisations are for and how to appropriately restrict for functional requirements. Both may know how to build but do they understand how to interpret a misleading authorisation failure check in a trace?

Best practise is to choose someone who is competent

Regards

Colleen

Re: PFCG Authorization Updates

Former Member — Mon, 14 Apr 2014 08:16:00 GMT

Accountable are the MM, FI, CO, HR, SALES etc. business process owners. They should initiate all role changes

Responsible for the actual changes in the system normally is the security team.

Re: PFCG Authorization Updates

Former Member — Wed, 16 Apr 2014 08:31:17 GMT

Hi Fawzy Ibrahim ,

Is it means that, in each module there will be different BASIS people? Like the responsible to MM users cannot change SD users authentication? If yes then, there is a good solution.

You need to group the users module wise. Then assign the BASIS peoples to maintain those particular group only(Using authorization object S_USER_GRP). Please have a try. If you face problem let me know

Asad

Re: PFCG Authorization Updates

Former Member — Wed, 16 Apr 2014 20:06:21 GMT

Fawzy,

If the company you work for/contract for has to adhere to SOX compliancy, then you definitely do not want the Basis folks doing security. This is for the security team to define the authorizations, modifications, roles, etc, related to SAP Security.