We want to assign SAP_ALL but remove TR, movement

[SAPSupport]

Hi Team,

Please suggest, We assign SAP_ALL to user but remove from his/her id TR movement.

------------------------------------------------------------------------------------------------------------------------------------------------
Learn more about the SAP Support user and program here.

[SAPSupport · Accepted solution]

Hello,

this is not that hard, as it seems.

First, identify the authorizations, which you do not want to be contained (STAUTHTRACE/ST01).
Once you know, what you want to exclude, Create a role from scratch. Either enter authorizations from profile SAP_ALL or use the SAP_ALL template.

Then remove the unwanted authorizations or set them to 'inactive'.

Generate the profile and assign the role to the corresponding user.

Done.

All steps shall be easily to be performed by a role administrator. This is no miracle.

b.rgds, Bernhard