SAP S/4HANA: Analysis and simple adjustment of your authorizations
Checking at Program Level with AUTHORITY-CHECK
Which authorization objects are checked (SU22)? When calling a transaction, such as the ME23N, various authorization objects are checked. You can get an overview as follows: Call transaction SU22 (SAP tables) or SU24 (customer tables), enter e.g. "ME23N" in "Transaction code" and execute the transaction. As a result you will see all authorization objects that are checked when calling transaction ME23N.
With Managed Services, you receive professional management and improvement of your SAP authorizations. In doing so, we analyze your existing workflows and processes and work out optimization potentials. The implementation of the potentials takes place within a few months. As a basis for central and efficient administration, we implement an underlying tool, working continuously and directly with your SAP key users.
Security Automation for HR Authorizations
If you use configuration validation, we still recommend that you use the AGS Security Services, such as the EarlyWatch Alerts and SAP Security Optimisation Services, which we describe in Tip 93, "AGS Security Services." SAP keeps the specifications and recommendations in the AGS Security Services up to date and adapts them to new attack methods and security specifications. If you have identified new security issues within a security service, you can set your target systems accordingly and monitor these aspects in the future.
The report shows system owners in real time which roles exist in SAP SuccessFactors and which authorizations these roles contain. The report also shows which roles are assigned to which users and whether there are duplicates, for example of groups or authorizations. The user can export this overview at any time.
Assigning a role for a limited period of time is done in seconds with "Shortcut for SAP systems" and allows you to quickly continue your go-live.
You will learn how to integrate the different stakeholders into the lines of defense and harmonize the knowledge for the process.
You can also find some useful tips from practice on the subject of SAP authorizations on the page www.sap-corner.de.
In any case, you should ensure that these inactive users are either blocked or invalidated.