Comparison Required for the large role with multiple profiles

Question

Hello,
We are small SAP team of only several people. I have created a large functional role for our functional person. Everything was fine for a while, but now whenever I need to add/remove code from the role and push it over to production I get an unusable role (in red) and some type of "Comparison Required" message.  I am not sure how to do this Comparison so I have to remove this role (and underlying profiles) from user than add it again to the user's profile.  This fixes the issue of an unusable role, but raises auditing questions.
I tried to address the issue via transaction SUC but it seems I am not using it properly.  Please, advise.
Thanks in advance
Galina

Answer 1

Yes you should schedule it at least once a day, in my systems it's running around midnight.
Use transaction PFUD or schedule a background job with one of this reports:
PFCG_TIME_DEPENDENCY (this is the old report)
RHAUTUPD_NEW (this is the new version of report) <- I'm using this in R/3 4.7 and Netweaver 7.0
Short text
User Master Data Reconciliation
Description
This report runs the user master comparison for roles you have selected. For single roles you can also start the user master comparison in transaction PFCG.
You can either execute it with the single processing types in dialog mode or schedule it as a complete reconciliation in the background.
To run only specific processing types in the background, schedule a variant of program RHAUTUPD_NEW.
You can choose the following processing types:
Profile Comparison
/>: Start the profile comparison directly after the profiles have been generated or imported. Provided you are using time-dependent role assignments, we recommend you schedule daily background jobs. The authorization profiles will then be reconciled with the user master data. Profiles no longer current will be deleted from the user master records and the current profiles will be entered.
Composite Role Comparison : Start the composite role comparison, if you want to make changes to a composite role definition  (that is, add to or delete single roles from a composite role) or if you want to import a change. Single role assignments will then be reconciled with the composite role assignments for the user. If you want to include single roles in the composite role, the single roles are assigned to those users who are assigned to the composite role. Conversely, the single roles assigned to users are deleted, if the single role is removed from the composite role.
HR Comparison : Start the HR comparison, if you want to make changes to the HR Org Model, which affect the indirect role assignment. You can only select this processing type, if HR Org is active. The switch HR_ORG_ACTIVE in table PRGN_CUST must be set to YES.
Cleanups: Carry out a cleanup, if  you want to generate or import profiles. Generated profiles that do not have any roles are deleted.
Further options:
Issuing error messages: In dialog mode all error mesasges are displayed on the screen.
Replicating local HR assignments centrally (You can only select this option, if this client is an active child system of a CUA group and HR org. Role assignments in the child system that have arisen from links in the local HR Org model are replicated for information in the central system
Thanks,
Adrian