Showing results for 
Search instead for 
Did you mean: 

Regarding Authorization

Former Member
0 Kudos

Hi all,

I have created a user with Profile : SAP_ALL and now I want to remove SU01, PFCG and SPRO for that user

Please guide me how to do it...



Accepted Solutions (0)

Answers (2)

Answers (2)

Former Member
0 Kudos


If you want the role like SAP_ALL without some t-codes goto

SU25 there you will find the option -->Create role from old profiles

click that ption and select SAP_ALL then edit the t codes those you dont want.



0 Kudos

I am afraid Ravi's solution wont work, because the S_TCODE field would have a '*' when copied from SAP_ALL.

Putting us back to square 1.

I would suggest

1. Create an empty Role

2. Open the Role in edit mode --> Change Authorization Data.

3. It will ask for chose Template. Select SAP_ALL.

4. It will incorporate all Authorizations, including '*' for S_TCODE.

5. Edit object S_TCODE. Remove '*'

6. Enter

From - To

0* - PFCF



SU02 - Z*

Rows 1 and 2 would eliminate PFCG

Rows 2 and 3 would eliminate SPRO

Rows 3 and 4 would eliminate SU01

I dont think this is the best way, but it works.

Former Member
0 Kudos

create an empty Z role in pfcg , go to authorizations and edit/insert authorizations from profile . i.e. sap_all and then give authorization to organizational levels and edit the role but removing or blocking autho to spro , pcfg and other objects depending on requirement.