Providing all authorisations except basis transaction codes

Question

Dear all,
I am planning to give SAP_ALL authorisation to users in the system.
but I need to restrict such that they dont have access to critical basis t-codes like (SU01, PFCG, SCC4 etc..)
Can you pls let me know how to perform the same.
Is there any predefined roles to do the above....
I am using an ECC 6 server. This is a normal test server.
Any suggestions and ideas are warmly appreciated.
Regards,
chandru.

Answer 1

Hi Chandru ,
If you want have a  customized role SAP_ALL and exlcude all BASIS and Security authorizations in the role following is one way of approach.
1) GOTO PFCG transaction and create a new role
2) Now go to MENU tab , here is transactions column , click on *FROM SAP MENU*  and select all the fields except Admistration and CCMS options under TOOLS and now click on transfer.
3) this will transfer all SAP transaction codes in the system except BASIS and SECURITY transactions
4) Now go to authorization --> change authorization data .
Here inactivate the following :
BC_A --> Basis - Administration
BC_C --> Basis - Development Enviromment
BC_Z --> Basis Central Functions
And finally save and generate the role.
This will role will give you the access to all the SAP transactions of all the functions in the system except the critical modules BASIS and SECURITY.
Thanks & Regards
Kantikiran Duggirala