Roles and profile in SAP

what is role and profile in SAP?
how we can diffferentiate both?

Hi Swati,
Role refers to the collection of associated activities (privilages) such as transactions, reports and so on. There are 2 types of Roles, Standard Role and Derived Role. While profile is a set of authorizations that are valid for the transactions defined in that role. Roles contain no actual access. They contain a role menu composed of transaction codes. These transaction codes are then mapped into the profile automatically by profile generator. When a role is generated (once created) the profiles are created automatically by profile generator. Every transaction code is different and may require different numbers of accompanying authorization objects to execute. A single profile can only contain 150 authorizations.  Once that number is exceeded the profile generator will automatically create a second profile, sorted alphabetically by object name.
Please refer the below links:
The specified item was not found.
Re: difference between profile and role
Difference between Role & Profile

Similar Messages

  • SAP Roles and Profiles provisioning

    Hi all,
    I am trying to provision SAP CUA using the SAP UM Connector.
    User gets provisioned, but its role and profile do not get assigned.
    The tasks "Add Role" and "Add Profile" are seen as completed.
    But the roles and profiles are not seen in SAP.
    Thanks in advance

    Any inputs from anyone ???

  • Compliance Calibrator Design - Roles and Profiles

    Hi guys,as you know SAP's authorization concept involves generation of Roles into Profile before it can be assigned to a User. In CC, i wonder why is there a need to segregate Roles and Profiles into 2 seperate functions. Isnt it already sufficient to analyse roles instead of profiles? Profile are names which is too technical which i feel should be omitted unless really necessary.
    Well, unless it is to cater for indirect assignment where profiles are granted to position/org unit etc... I will also be trying out whether there is a difference when you only batch analyse a Role and intentionally excluding the 'profile' whenever a new role is created. Will the system work fine when i do a role analysis?

    I agree that profiles are old fashioned and should be phased out.  The system has to stop people from being able to maintain profiles directly and assign them directly before they do this though.  SAP_ALL etc can be converted and assigned as a role.  It would make the whole authorisation concept just that little bit easier.  We are talking about a German company though!
    Also, you don't need profiles for indirect assignment.  You can relate roles to the position using PFCG!  Click on the organisational management button on the user-tab, next to the user comparison button.
    Using profiles (ie, maintaining directly and assignment) is highly recommended against.

  • VIRSA tables for users, roles and profiles sync?

    I am in a customer, implementing CC 5.2. At the first time, we tried CC 5.2 in DEV environment, and when everything was OK, we redirect RFC connectors to QA environment.
    After doing user, roles and profiles sync in DEV and in QA environment too, I have 4.500 user (1.100 from DEV + 3.400 from QA) when I recover all users "*" with "user level - risk analysis" from the "Informer" tab.
    It seems that "users, roles, profiles, sync" works like and "APPEND", but I did a COMPLETE syncronization not an INCREMENTAL.
    If I start an analysis for QA environment, CC works properly and only analyse QA users (3.400). But I would like to clean CC tables (users, roles and profiles) in order to have a clean copy of QA in CC.
    Which VIRSA tables (users, roles and profiles) I need to clean?
    It is necessary to do the same with authorization and text objects? Which would be these tables?
    Thanks in advance,

    Hi all,
    SAP GRC Support provides a script which allows you to remove a connector since it does delete all data link to it. Anyway, I would recommend a deep analysis of it and find out if it does what you really want to do.
    Víctor, if what you want to do it is just to remove all user, role and profile master data (stored in tables VIRSA_CC_SYSUSR and VIRSA_CC_GENOBJ) you could upload a text file using data extractor functionality with the delete field set to X. Doing so user, role and profile master data will be removed from CC database.
    In order to use data extraction functionlaity you connector must be of type "File Local".
    Be careful about removing data directly from DB since, as Prem states, you might loose the DB consistency.
    Hope it helps. Best regards,

  • Webservices roles and profiles r/3

    Hi gurus i have a little problem i guess
    i develop a web service and i want that an extern client use this webservice.
    the basis consultan has created an user and he has assigned the sapall and sap new profile and the role.
    the client executes the webservice without problem, but i dont want that the user has this profiles, i need to restric the prmissions of the user created by the basis consultant
    and when the basis consultant take out the sap all and sap new profile and assing other profile an role the webservice cant be executed, the error is that the user has not permission to execute the function group zsd001.
    Does any one knows which roles and profiles does the basis consultant has to assign to the user?

    thanks gurus

  • Su01 recreate old user - lost roles and profiles

    Situation: a person's sap account was deleted, but now that person needs it again with the same sap access as before
    when you recreate an old sap user account in su01,
    sap gives a message "found old user information, do you want to reacreate this".
    Press yess, then all is copied except roles and profiles (empty)....
    You can find them back via the menu : information<change dcuments for users.
    Is there a way to make sure that roles (and/or profiles) are instantly copied from the old records of the sap account (like
    the name, email user group, user parameters, etcetera)?

    No. There is no such feature.
    The solution is not to delete the user but rather lock the ID and move it to a "retired" user group where it is protected. From there you can restore it again easily.

  • BW Roles and profiles Tables

    I would like to download a list of all users and what roles and profiles each has.  I did it once before but now I can't remember the table names.  Can anyone help?

    Authorizations are
    Links for user roles:
    For profiles and authorisations:
    Also chk this link..
    Hope this helps,
    CSM reddy

  • Developing security Roles and profiles

    Hi Team,
    Can you guys let me know how to develop security roles and profiles. We are rolling out for a company in Japan, and the congif is completed. We are in the process of developing test cases ans also security roles and profiles for users? Can somebody guide and help me on this?

    Use Tcode = PFCG -->then create any customized roles and profiles for any users on module based.
    user masters: USR01 to 09, UST04,
    profiles: USR10, USR11, UST10S, UST10C,
    authorisations: USR12, USR13, UST12.
    password exceptions USR40.
    History tables(may not be applicable but FYI): users: USH02, USH04,
    profiles: USH10, auths USH12.
    R/3 Security Tcodes
    End User Transaction Code  Menu Path   Purpose
    SU3  System > User Profile> Own Data  Set address/defaults/parameters
    SU53  System > Utilities > Display Authorization Check  Display last authority check that failed
    SU56  Tools --> Administration --> Monitor --> User Buffer  Display user buffer
    Role Administration Transaction Code  Menu Path   Purpose
    Tools --> Administration --> User Maintenance --> Roles  Maintain roles using the Profile Generator
    PFUD   Work on SAP check indicators and field values
    Select: Copy SAP check IDu2019s and field values
    1. Initial Customer Tables Fill
    2a. Preparation: Compare with SAP values
    2b. Reconcile affected transactions
    2c. Roles to be checked
    2d. Display changed transaction codes
    Same as for SU25:
    Select: Change Check Indicators > Maintain Check Indicators>Maintain 
    Srini Nookala

  • Difference between Roles and Profiles

    What is difference between Roles and Profiles?
    Thanx in advance..

    It is a simple hierarchy level difference for grouping levels of authorization and the need avoid maintenance on a large number of individual authorizations on a user level.
    In SAP, authorizations are grouped together into profiles. These profiles usually represent some sort of functional access (i.e. Create customer master records). The profiles can then be allocated roles which group the individual functional access into a more abstract level of a role (i.e. accounts clerk). Roles are then assigned to users based on their specific responsibilities.
    More information is available on the help portal:

  • IDOC for roles and profiles

    Hi Guru.
    I need this: I wish to export the new and the modified roles and profiles to an external non-SAP system. This non-SAP system is able to receive iDoc message.
    Is it possible? Can I find n the SAP system the change point and the iDoc to do this?
    Manuel Chiarelli

    not for roles. no. you can:
    transport them
    up-/download them
    RFC-copy them
    but not idoc them.

  • Security roles and profiles

    Could you please provide information on "security roles and profiles "
    I would appreciate.

    Roles give you authorization to specific area of the system. Use TC pfcg and you will see different setting for a role.
    In specific Role -> Authorization -> click on Display Authorization Data.
    Here all specific InfoArea, Cube, ODS, Reporting componets: display, execute and other security rules are defined.
    User Section: defines who has access to this role.
    Multiple authorization are combined to create an Authorization Profile. You defined a profile at TC su01 and under profile section.
    Hope that helps.

  • Active a role and profile

    Hi Experts,
    Could you guide me on how to activate a role and profile? Kindly suggest to me the proper procedure of doing this.
    One more thing experts do you have any idea on what tcode used to change a password for multiple user's? Could you give to me as well the proper procedure of doing this.

    To activate a profile, choose Profile Activate on the Profile List screen. If an active version of the profile exists, you will see the active and maintenance versions of the profile so that you can verify the changes.
    New or modified profiles must be activated before they can be assigned to users or become effective in the system.Activation copies the maintenance version of a profile to the active version. If the activated profile already exists in a user master record, the changes to it become effective as each affected user logs onto the system. Changes are not effective for users who are already logged on when the profile is activated.
    For it to take effect, you must hand over your role to the User Management Engine. You do so by activating the user role.
    To activate a user role, choose Activate User Role ( ). To undo, choose Deactivate User Role.
    If u want to change password number of user at a time .For my kind of information its not possible need to change password indivisualy.

  • After BI 7.0 Upgrade, Authorization Roles and profiles are not visible

    Hi Gurus,
    We have an issue with authorization roles and profiles are not visible for all end users with new Bex Analyzer (BI 7.0) tool. But still they can see these roles with old Bex Analyzer ( Bex 3.5) tool.
    As a developer I have SAP_ALL acces and I can see all authorization roles in new BEx Analyzer (BI 7.0).
    I verified in SU01 for user access and every are assigned there roles and they are green.
    Do we need to add any new authorization object to fix this issue, please let me know
    Thanks and appreciate your help.
    Ganesh Reddy.
    Edited by: Ganesh Reddy on Oct 26, 2009 4:41 PM

    Hi Ganesh,
    check the behaviour, if you assign
       ACT_GROUP = " of the assigned role.."
       ACTVT = 03 (for "display")    

  • After BI 7.0 Upgrade, Roles and profiles are not visible

    Hi Gurus,
                                  We have issue with the roles and profiles, all our users doesnt see any roles or profiles in Bex Analyzer, under there user access after BI 7.0 Upgrade. 
                                   When I go and check there profile in SU01 and I can see all roles are assigned but not able to see in the Bex Analyzer reporting tool.
                                   Do we need to do any configuration settings after BI 7.0 upgrade to visible roles. This problem with every user.
                                   Your help will be really appreciated.
    Ganesh Reddy.
    Edited by: Ganesh Reddy on Oct 22, 2009 5:19 PM

    Hi Mohan/Vijay,
                            Sorry for little bit late. I have all authorization roles access, and users dont have that access. Difference between our roles is I have SAP_ALL and SAP_NEW.
                            But when they login with old bex analyzer they can see all roles, but not with new bex analyzer.
                            Please some suggest me still I need to run SU25.
    Dayaker Reddy.
    Edited by: Ganesh Reddy on Oct 26, 2009 10:19 AM

  • Authorization : roles and profiles

    I have two questions that I need answers
    - How do I check roles that are assigned to reports and
    - roles and profiles needed to execute reports
    thanks in advance

    Roles or profiles are assigned to user not specific reports or queries, if u need u can check what roles are assigned to u in SU01, provide the user name and go to display mode there u will find profiles tab, u can check .
    Hope this helps u a lot.........
    Assigning points is the way of saying Thanks in SDN
    Ramakrishna Kamurthy

Maybe you are looking for