Implementing User Authorization Security in SAP R3

« System Development Process - CISA Exam Questions 2007

Knowledge Obtained During Previous Audits - Revised AS2 »

Implementing User Authorization Security in SAP R3

The process of granting user's access to the SAP system is complex. In some of my earlier posts, I have discussed critical SAP authorization concepts as well as important concepts of profile generator, activity groups etc. Some of the readers here have requested for a step by step procedure for implementing user authorization security in SAP R3. I am discussing the same below. I am using certain SAP technical terms below, which you can find in some of my earlier posts. I am taking an example of a Sales Manager's role in SAP.

1. The first step in implementing security is to create an 'activity group' for the sales manager.

2. Once the activity group is created, one needs to include all transactions which are required by the sales manager in his day to day functions. Special care should be taken at this stage so as not to assign conflicting transactions as the same may result in segregation of duties issues.

3. The next step is to generate an authorization profile for the sales manager activity group.

4. Assign the 'sales manager' profile to the new user in the SAP R3 system.

5. Lastly, the user master record for the user should be updated.