Security profiles for configurators and developers

Question

hello experts,
is there a generic (standard) profile for:
1) functional configurators that are not allowed to touch development objects, and
2) developers that are not allowed to perform functional configuration?
I am familiar with the S_DEVELOP authorization object; is there a way to exclude the customizing tables from the list of objects?

Answer 1

Tiberiu,
You cannot disable (deactivate) them all at once. You will need to disable 1 object at a time. Like I said, this option is cumbersome, but it will make sure that your Functional Consultants do not have access to Basis Objects and still have access to all the Functional ones.
In case you are not aware of how to copy sap_all in a role, do this.
1 Create a role using PFCG
2. Go to the Authorizations tab
3. Click change
4. Copy sap_all from the list of profiles that you will get.
5 To disable, you will need to go to each object and click on the small green rectangle/square to the left. It will say "deactivate" if you place your mouse cursor on it.
A few more comments/suggestions from my side
Workout with your team to whom you want to provide the access.Let them(functional team) come with what access they need and accordingly provide the access.
If you can do that, great ! If the Functional Team members are non-cooperative, then you don't really have a choice. Again, if this is a Prod system, don't do what I said. That is too liberal an access. If it is Dev it should be okay. QA is also debatable.
Inactivate the objects which are not needed and provide display activity for the objects which you are not sure.
I would say disable the objects that you are not sure about rathar than giving Display access. Display access to S_TABU_DIS can be an audit issue in some cases.
There will still be some authorization issues since some transactions change tables. But you can always add the ones needed.
Kunal