What roles a user has used

Question

At our company, people move around a lot.  Typically they get given additional roles, but old roles don't get removed.  I have been tasked to trim our users roles.  So my question is, "Is there any way to determine what roles have been needed by the user in say the last year?"  As an alternative, what is the best way to determine what TCodes they actually use?
Neal

Answer 1

As long as SU24 is well maintained, then removing roles can be easy as there are less "authorization surfers". Typically the "common role for all users" is the biggest problem.
But if you have relatively qualitative roles and Su24 well maintained, then a "coverage analyser" has worked very well for me (as Tobias indicated, you need to code it on your own or find partners who specialize in such concept conversions without disruptions.
Another cool trick is to license users via role classification and the user classification is inherited, and distribute the costs internally based on the assigned roles. As long as the roles can survive on their own (SU24!!), then you can assign system costs via role assignments and if role owners don't want the cost of the role which accesses their data assigned to the user, then they will contact you instead or you having to take best guesses.
However a "coverage analysis" will typically let you find the "movers and leavers" depending on how you build the roles.
Tapping into HR movements about users is also generally a good idea, depending on how qualitative the HR data is and whether all users are there (consultants? SYSTEM users? Test users? etc.. you might not want to automate this process, but good reporting is very useful....).
Cheers,
Julius