SAP Standard Roles

Hello everyone.
What is SAP's best practice for using (customizing) the SAP standard roles? I have always used the standard roles as templates to customize for my customers. Is there a stated SAP best practice for this?
If I use a standard role, customize it and copy it to the company namespace and the standard role it is customized off of changes, does my customized role change?
How do release upgrades affect the standard SAP roles?
Thanks!
Todd

Hi Todd,
If you copy the roles to a your own namespace then they won't be touched during upgrade.
I can't comment on what happens to standard roles during upgrade as I tend to avoid them.
There is no accepted best practice around using standard roles, though there is reasonably wide belief that developing your own from the ground up is a better way to develop roles to meet your customers business processes. 
I find that where standard roles have been used, the end user roles have generally a lot of unused transactions.  Functional & business people see a large list & choose most of them rather than building up from a subset of inscope transactions which are also used for training, BPP's etc.
There is also the consideration that using standard roles guides you to building in the same way.  That's not to say it is a bad way, just can limit flexibility if you build down to a task level (nasty, nasty, nasty) or higher at a job or function level.
Cheers
Alex

Similar Messages

  • Break sap standard role into two sub roles

    hi,
    i have one SAP standard role. now i want to break this role into two  sub roles. how shall do it.
    please suggest me.
    regards
    ramesh
    Edited by: Ramesh Sammiti on Jul 31, 2008 11:00 AM

    Hi Ramesh,
    When you say that you want to split the SAP Standard role into two roles:
    1.Do you mean to say that you want to split the transactions and authorization data of the SAP Standard role into two separate Z* or Y* roles?
    2.Do you want to copy the SAP Standard role into two different Z* or Y* roles and then modify the authorization data according to your company's requirements?
    In the above two scenarios you must copy the SAP Standard role into Z* or Y* roles in PFCG transaction with the appropriate naming convention and make necessary changes in both the transaction data and the authorization data.
    Please be clear which SAP Standard role you are willing to split into roles and i can provide more details.
    Hope this helps.
    Regards,
    Kiran Kandepalli

  • Deletion of SAP standard roles

    I have been asked by the client if we could delete all of the SAP standard roles. I think there are many good reasons not to delete them, but does anyone know what SAP's official recommendation would be to that question and could you point me to the documentation or SAP Note where that recommendations is written?
    So far all I have found is the following documentation(http://help.sap.com/saphelp_47x200/helpdata/en/52/67164b439b11d1896f0000e8322d00/frameset.htm) saying that:
    Do not change the delivered standard roles (SAP_), but rather only the copies of these roles (Z_). Otherwise, the standard roles that you have modified will be overwritten by newly delivered standard roles during a later upgrade or release change.
    But it does not say that you should never delete them.
    Br,
    Jon

    Christensen Jon Jagd wrote:>
    > The client want's to "clean up" the authorizations concept by deleting all of the unused roles. And all the SAP_* roles are not assigned to any users (and not generated neither).
    I've seen that before, the urge to clean up...... unused roles aren't the worst thing to happen on a system, as long as they're part of the concept.
    Come to think of it. I'd delete them from my test and prod systems to avoid confusion and/or (mis)use, but not from dev. On dev the majority of roles is not assigned to users anyway........
    > But I would like to know if for example "SAP recommends that you do NOT delete system delivered roles".
    I don't think such advice exists. Try to convince the client they should be kept on dev for future reference. Delete them on the other systems to clean up. Everybody happy.
    Jurjen
    Edited by: Jurjen Heeck on Feb 12, 2008 10:16 AM

  • SAP Standard roles assignment

    Hi,
    I want to assign a SAP standard role SAP_BC_BMT_WFM_ADMIN to a user.
    Since I do not directly assign a SAP standard role to a user,i created a copy of the SAP_BC_BMT_WFM_ADMIN of the role and tried assigning it to the user.
    But when I tried to generate the role I was not able to because all the objects are Inactive.So when i tried to activate the object it is not possible to do so.
    Can anyone provide me a solution for this.
    Regards,
    Arjun

    > But when I tried to generate the role I was not able to because all the objects are Inactive.
    Please try to tell us a bit more about what you see and which messages you get. I had a look at this role in my customers'system and did not see any deactivated objects.

  • Download all roles Individually and list all the SAP standard roles

    Hi ,
    I have two questions .
    1. I want o download all the roles individually in SAP.
    2. I want to list all the SAP standard roles whose profile is generated.
    Can anyone help me . to achieve this

    Dear,
    I am no sure what kind of problem you have faced that requires revert back. Which took 2 days. If it's for mass role revert back then mass role download should work. If it few selective role then change history should help you out.
    Anyway I might pull this out of the topic.
    Even you download mass role in a single file then also if you want then can upload a single role only with 2-3 mins spending on replace function in notepad!!
    Let say you have taken 1000 role in a single file and want to upload a specific role only. Open the file (copy of the file) in a notepad. Now replace(Ctrlh) LOADED_AGRS with nothing. Find(Ctrlf) the role you want to upload. In begining of that line paste LOADED_AGRS
    Above file will upload the specific role only.
    Regards,
    Arpan Paik

  • SAP standard roles for Mii inside of objects?

    Hi,
    It is our practice to rename SAP standard roles we plan to use "as is" to our company's naming convention.  I am being told by an Mii implementer that Mii uses the standard role names in objects and that by changing these names to our convention, I will create "complications" in their implementation process.  I find this hard to believe, it would be a departure from what (little) I know about SAP and how they handle authorizations and roles.  It also seems to be very limiting when it comes to customization in the future.
    Is this true?  Does Mii name standard roles inside of objects? (These "objects" were not clearly defined to me and I plan on calling a meeting so they may show me examples.)
    Anyone else on Mii have this issue?

    As far as I know, in Mii a user typically needs at least one of these roles:
    SAP_XMII_User
    SAP_XMII_Developer
    SAP_XMII_Administrator
    You can of course add additional roles with the authorization the different users require using your own naming convention.
    I think this is what the Mii implementer is talking about.
    Good luck!

  • Customer role from sap standard role SAP_SM_SCHEDULER_DIS or SAP_SM_SCHEDUL

    HIi,
    according SAP Note Note 1054005 - FAQ: Job Scheduling Management with SAP Solution Manager we want to design a customer role with this roles as templates.
    But:
    There are a lot of open authorization objects.
    We need proposal how to fill this role with adequate values.
    Does anybody has designed customer roles from that standard roles ?
    What values are advisable ?
    Regards,
    Roland Fischl

    Dear Aviya Paul,
    1. Who will responsible for Authorization Matrix?
    Authorization Matrix that define "what position may have access to which authorization/ role" shall be developed by User (Management), with support from BASIS. User is the one who have the authority to decide, while BASIS should help User in understanding the technical knowledge of access authorization.
    2 to 5. BASIS.

  • Modifying SAP standard roles - best practice

    Hi,
    Is there a Best practice How-to guide for configuring SAP BPs roles for client use.  I know I shouldn't change the content delivered by SAP but I'm not quite sure what I should delta link copy into client namespace.
    I am implementing MSS.  Do I just delta link copy the Manager role into client namespace or I should make a delta link copy of the My Staff workset then make changes to the workset and assign it to a completely new ClientManager role?
    I have the TransportEP6Content how to guide but it doesn't say explicitly what is best parctice.  This doc references 'HowTo Use Business Packages in Enterprise Portal 6.0' but it isn't where it says it is on service marketplace.
    TIA,
    J

    Hi,
      'How to use Busiess Packages in Enterprise Portal 6.0' is available in this link.
    http://help.sap.com/bp_epv260/EP_EN/documentation/How-to_Guides/misc/Using_Business_Packages.pdf
    Check out for the best practices.
    Regards,
    Harini S

  • List of SAP standard Roles

    What are the Authorization Roles that already exists in an SAP system?
    Could you list them out if possible?
    Also, there are many System RFC Roles whats the significance of S_RFCACL role?

    Hi Gautam
    These are the pre-defined roles exist in the SAP System, as you can adopt and make template to design your own roles.
    For the list of existing roles, please click on the "Other Roles"  and click on the start search with the * selection, then you can request for the print.
    S_RFCACL replced by the SAP_S_RFCACL being manage by the SAP Solution manager to help you to manage and run your mysap.com e-business platform.
    Kindly refer to see: SAP Note: 831535
    Regards
    Anwer Waseem

  • Best practices / preferred usage of SAP standard (delivered) roles

    Dear Experts,
    When going about designing roles for a new system, what is the preferred usage on SAP standard/delivered roles?  I was thinking of using them as a "base", then tweaking auth objects here and there to make the roles work but the more I work with them, I find it may be better to create roles entirely from scratch.  A lot of the time, I find a lot of inactivated auth objects or objects that seem to not really be needed when looking at the t-codes offered in the menu (S_TCODE).
    In that case, I figured it might be cleaner if I started creating roles and adding t-codes via the Menu and maintaining only the auth objects that are proposed in PFCG (and adding a few if necessary).
    Do people typically build their roles around these the standard SAP role set or is it preferred to create your own and only use the SAP standard roles as reference (i.e. the t-codes offered in the menu, etc.)?
    Thanks for any insights!

    > When going about designing roles for a new system, what is the preferred usage on SAP standard/delivered roles?
    Those are provided by SAP as a reference so that you can consult with the Authorization Structure of a Standard Position / Task for which you are going to create your own role. For e.g. what are the TCodes, values of Objects should be given to users for their tasks.
    I was thinking of using them as a "base", then tweaking auth objects here and there to make the roles work but the more I work with them, I find it may be better to create roles entirely from scratch.
    Absolutely! Please do not use SAP delivered roles for you use and also don't try to alter any values.
    A lot of the time, I find a lot of inactivated auth objects or objects that seem to not really be needed when looking at the t-codes offered in the menu (S_TCODE).
    >
    > In that case, I figured it might be cleaner if I started creating roles and adding t-codes via the Menu and maintaining only the auth objects that are proposed in PFCG (and adding a few if necessary).
    >
    > Do people typically build their roles around these the standard SAP role set or is it preferred to create your own and only use the SAP standard roles as reference (i.e. the t-codes offered in the menu, etc.)?
    >
    Yes.. as reference.. as you say..
    Regards,
    Dipanjan

  • Issue on copying standard role

    Dear Guru's,
    We're implementing E-rec system and we have two users name as user1 & user2, standard role was assigned to both the users
    User1 - SAP_RCF_EXTERNAL_CANDIDATE
    User2 - SAP_RCT_UNREGISTERED_CANDIDATE
    webdynpro application was working fine with the above roles.
    Once we made a copy of the standard role z-role, we assigned the z-role to those users and removed the standard role. After assigning the z-roles for the above user, the webdynpro application was not funtioning properly. Only I can see the initial screen, the next screen is not responding.
    Could anyone suggestion me on this.
    regards,
    Guna

    Hi,
    the most common reason for this error is a missing change in the customer version of role SAP_RCF_UNREGISTERED_CANDIDATE. The sap standard role contains the name of role SAP_RCF_EXTERNAL_CANDIDATE in the authorization object S_USER_AGR field ACT_GROUP. People often forget to change this to the name of the client role.
    In spite of the e-rec mechanism that the service user assigns the authorization to the external candidates user by assigning a reference user, it still needs the authorization to assign the roles and profiles the reference user has as if it would assign the them directly. If you do not put the name of the customer copy of role SAP_RCF_EXTERNAL_CANDIDATE  into your copy of SAP_RCF_UNREGISTERED_CANDIDATE the user creation can't be done properly and the appiication runs into an error when it tries to switch the session to the user.
    Kind Regards
    Roman

  • SAP Delivered Roles

    Can anybody tell me how to find SAP deliver roles for specific Modules (CD,FI) and stuff. Please tell me how can I find SAP Standard roles?
    Thanks in Advance
    Faisal

    Hi Fisal,
                     This you can find from PFCG, go to PFCG-----> in the roles field pull down the menu, then give a search with FI, finance, or accounts yopu will get all the SAP delivered standard roles.
    This way you can search for the other modules/ areas as well.
    Regards,
    Hari.
    PS: Award points if helpful.

  • Disabled standard role com.sap.pct.pdk.JavaDeveloper

    Hi - I've logged an OSS but if anyone can help me quicker it ould be most appreciated;
    the role com.sap.pct.pdk.JavaDeveloper can be found in the portal
    content location
    pcd:portal_content/com.sap.pct/platform_add_ons/com.sap.pct.pdk/Roles/com.sap.pct.pdk.JavaDeveloper
    when i double click on that role it shows only one Workset called
    Examples and within it a workset called OBN Examples
    I searched the SDN and found this post:
    /community [original link is broken]
    forumID=53&threadID=19464&messageID=162992
    which sounded exactly right. sure enough the role was assigned to the
    administrator.once i removed it, the role is now not working for any of
    my logons - test users or Administrator.
    in addition we do not have the object com.sap.pdk.JavaDeveloper in our
    system.
    help
    andy

    sorry, probably haven't explained it well enough.
    it used to have lots of entry points, yes. but none of them were visible in the portal catalogue, except one "Examples"
    the linked post describes exactly the same problems. when i followed the recommended steps "remove the role from the Administrator account" in that post, the role stopped working, apart from the "Examples" workset. Apparently we are not using NWDI and apparently this has some relevance, in that we can't create the system alias for the webDynpro as the post also recommends.
    to recap - the standard role, since unassigning it from the administrator account, now does not function for any user. only the workset "Examples" is visible in the role. this was the case before. trying to view the other objects in the role is the reason I was working on it., since we have a requirement to add the Portal Logviewer in to the content developer role, without giving them the whole of the PDK/PRT  maintenance applications. it now transpires that they were not displaying and were hidden becasue they are not Iviews, but are components accessed directly.
    Does it need to be rebuilt? if so , how?
    thanks ,
    andy

  • SAP Standard Menu Text missing while Creating Role in PFCG

    All:
    I am having a weird issue to where the "SAP Standard Menu Text" is missing when creating a role in PFCG and using the "Copy Menu > From SAP Menu" function.
    When I click the button I get the following:
    1) Popup of the SAP standard menu tree
    2) The area for the folders where there should be text is missing
         - appears as the " [ ] " symbols
    3) "[ ]" symbols appears through entire menu tree for folders and transactions.
    Any ideas?
    - Thanks Matt

    Yes this is a bug....Please see note 1421375 for the solution

  • Standard SAP HR Roles in SUCCESSION PLANNING

    hai all,
    Can any one please let me know what are the standard SAP HR Roles in SUCCESSION PLANNING for user.
    Thanks

    Hi,
         Career and Succession Planning
    Purpose
    The Career and Succession Planning component enables you to create, implement and evaluate succession planning scenarios. In Career Planning, you can identify possible career goals and draw up career plans for employees. You use Succession Planning to find people to fill unoccupied positions. Career and Succession Planning has two main goals. One is to advance employeesu2019 professional development within a company, the other is to ensure that staffing requirements are met.
    Integration
    If Career and Succession Planning is integrated with the Qualifications and Requirements component, you can:
    Create profiles for objects. You can include these profiles in Career and Succession Planning.
    You can compare these profiles against each other (to see how suitable a person is for particular positions, for example).
    Integration with the Development Plans component gives you the following functionality:
    You can plan and manage your employeesu2019 further training and education
    Suitable development plans for eliminating qualification deficits are proposed automatically
    See also the recommendations contained in the Integration section of Personal Development.
    Features
    The Career and Succession Planning component provides you with the following functions:
    You can create careers. These describe the various career paths possible within a company. Careers are used in career and succession planning scenarios.
    You can use a whole range of planning criteria when working through career and succession planning scenarios. These planning criteria are independent of each other.
    You can define user parameters to specify whether essential requirements, alternative qualifications or depreciation meter information should be taken into account in career planning scenarios. See User-Specific Settings.
    You can plan for a specific key date.
    To identify career and development goals, you can carry out career planning for persons and for other object types.
    To identify potential successors, you can carry out succession planning for positions. You can analyze the knock-on effects of succession planning by conducting a simulation.
    You can work through career and succession planning scenarios without taking careers into account.
    You can display a ranking list for every career and succession planning scenario. This ranking list is sorted on the basis of an objectu2019s suitability. Suitability is expressed as a percentage value.
    Suitability percentages should be regarded merely as a criterion for sorting lists.
    You can also define suitability ranges and thus structure the ranking list better (Customizing).
    You can specify how the system should handle overqualification when the suitability percentage is being calculated (Customizing).
    You can display ranking list entries by screen (Customizing setting).
    From the career (or succession) plan you can:
    Access the profiles of all the objects displayed
    Match up profiles with each other
    Evaluate qualification deficits
    Display training proposals and book courses (business events)
    Access careers
    Create preferences and potentials
    In career and succession planning scenarios, you can designate planning objects for positions. You can then include these designations for the rest of the planning scenario.
    If you have found a suitable position for a person, or if you have selected a person as the successor to a position, you can transfer the person directly to the position in question.
    Rupa Prasad

Maybe you are looking for

  • Can l make an instance of EJB home handler / Datasource shared by EJB objs

    all ejb guru As far as l know, it is general rule of thumb to cache the EJB home handlers and datasource object at EJB bean instance. But can l go a step further, make the same instance of EJB home handlers and datasource object shared by more than 1

  • Call taking forever to load when I answer, anyone have this problem?

    When I receive a phone call, I push the green button to accept the call and normally it would go into the active call screen which shows the buttons: mute, keypad, speaker etc. but lately it takes forever to switch to that screen. It'll stay on the c

  • Email customer relationship history

    Hi Folks, We've got email configured for Cisco Agent Desktop and UCCX but have questions from business units that we are struggling to come up with answers for.  Staff want to know if they use CAD for email in email CSQs, how they can refer to previo

  • BAT ERROR

    HI , I am trying to install BAT in my ccm server. I am having only one server in my setup. it is connected to other servers in another region via ICT. I am getting a error "BAT SHOULD BE INSTALLED ON A MACHINE WITH PUBLISHER DATABASE. ABORTING SETUP"

  • Pages won't run

    After I installed Tiger Pages won't run. It gives me this message: "The application Pages quit unexoectedly after it was reopened." There is no other indication of trouble, no splash screen or anything.