SAP access control and traceability

Overcoming Missing Authorizations in SAP SU53 doesn't always tell the correct authorizations. If the program has done authorization checks to make decisions nothing will show in SU53 and the program will not execute correctly and then we have to go searching through code to find with authorization checks are there and what is being checked. Best Practice for User Access issue in SAP When SU53 Falls Short 1. Run STAUTHTRACE/ST01 - Trace will give you details of missing authorization and help to decide on next steps to provide access 2. SUIM - Check if roles for missing access are assigned to User or not, then we need to check role with minimum access for missing authorization (Based on process of organization - If we will do role changes or assign role) 3. Ensure that all the roles for the user are properly configured in PFCG. Roles are generated and User Master Comparison is green (Use transaction PFUD for User Master Comparison) 4. Role Changes/Provisioning - Always run role simulation or User simulation in GRC to avoid SOD conflicts for access to be provisioned to user SU53 will mostly fail in cases where Fiori app, Custom transactions or reports are involved. This approach minimizes risk and ensures access issues are resolved without compromising security. #SAPSecurity #SU53 #AccessControl #GRC #SODConflicts #Authorization #ST01 #SAPBestPractices #RoleProvisioning #AccessManagement #SAP

𝐒𝐀𝐏 𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐄𝐬𝐬𝐞𝐧𝐭𝐢𝐚𝐥𝐬: 𝐒𝐌19 & 𝐒𝐌20 When it comes to system security, two lesser-discussed but highly critical transactions in SAP are: ↳ 𝐒𝐌19 – 𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐀𝐮𝐝𝐢𝐭 𝐂𝐨𝐧𝐟𝐢𝐠𝐮𝐫𝐚𝐭𝐢𝐨𝐧 This is where you set up what to monitor in your system. You define audit classes, users, and events you want to track — like logon attempts, RFC calls, or table changes. Think of it as installing CCTV cameras in the right places. ↳ 𝐒𝐌20 – 𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐀𝐮𝐝𝐢𝐭 𝐋𝐨𝐠 Once SM19 is configured, SM20 is where you review the evidence. It gives you detailed logs of system activities, helping detect suspicious behavior, unauthorized access, or even accidental missteps. 𝐖𝐡𝐲 𝐭𝐡𝐞𝐲 𝐦𝐚𝐭𝐭𝐞𝐫: ↳ Crucial for compliance (SOX, GDPR, etc.). ↳ Helps forensic analysis during security incidents. ↳ Enables proactive monitoring to prevent risks. In short, SM19 defines what to watch, and SM20 shows what actually happened. Together, they form the backbone of SAP’s Security Audit Framework. How often do you review your audit logs in SM20? RAP Interview Prep: https://lnkd.in/gQvPsvNy BTP Interview Prep: https://lnkd.in/gSKJx67A