Creating Roles in SAP - PFCG

Hi all,

Mainly 5 Types of Roles in SAP

1)     Single Role2)     Composite Role3)     Derived Roles4)     Orphans Role5)     Reference Roles

Single Role 

Single role is role which generally does not have a Org level.

Composite Role

A composite role is a container with several different roles.Composite roles do not contain authorization data. If you want to change the authorizations (that are represented by a composite role), you must maintain the data for each role of the composite role. Maximum 164 Single can be added in a Composite role.

Derived Role

A Derived role is the copied role from a master role, coping transaction and authorization object. 

Orphans Role

Orphans Roles are Stand-alone roles and are many a times required for IS uses/. So a System Admin role, a Security Auditor role and many other special roles mainly not used in Business side are created as ORPHANS. This role limits the user to a particular organization.

Reference Role

They are SAP standard Roles.

Here we will discuss about how to create roles in SAP

PFCG Tcode is using to create Roles in SAP

Enter PFCG

 Here, fill the Role column. All roles created with users must be start with "Z or Y".                         

  

After the Role name, Click on the 'Single Role' button (here we discuss about single role)               

     

It goes to the Description tab,                                                                                                               

In top fill any description about the the Role and at the bottom  give detailed description .                

                

Then *Save and next click on the * Menu Tab                                                                                       

              

Click on the *Transaction button, the it shows another window like in the image. Add transaction you want to add in the role and *Enter to next tab after complete click on *Assign Transaction Button      

Then the *Menu tab shows green , and the Role menu shows the assigned roles like in the image.   

 Go to next tab *Authorization                                                                                                                

                                                                                                  

Click on the *Propose Profile names Button (Shown in the Figure), it will create a Profile name and   profile text automatically (Show in next Figure)                                                                                    

 Click on *Change Authorization Data Button, Save                                                                                

Here the Organization level values are given by the Functional Team if it is not then click on           

        *Full Authorization and then *Save                                                                                                                 

     

Then Click on the *Generate button on the Top, it will generate the Profiles for the Roles then       

      *Back to Authorization Tab  click on *User tab                                                                                                            

Here we adding the Role to the users we want. Enter the user name on the User ID area and *Enter,     after completing User Id's Click on the *User Comparison Button then *Save , Its Competed.