SAP security T-codes: the working list
SAP security covers who can log on and what each user may do, through users, roles and authorization objects. This page lists the transaction codes security and authorization consultants use most, grouped by task.
Each line gives the code as you type it and what it does. When a user is missing access, SU53 right after the failed step is usually the first check.
Users
- SU01
- User maintenance
- SU01D
- Display users
- SU10
- User mass maintenance
- SU3
- Maintain your own user data
- SUGR
- Maintain user groups
- SCUA
- Central User Administration distribution model
Roles and profiles
- PFCG
- Role maintenance
- PFUD
- User master comparison for roles
- SUPC
- Generate profiles for roles in bulk
- SU24
- Authorization checks and default values per transaction
- SU25
- Profile Generator upgrade and first install
Authorization checks
- SU53
- Display the last failed authorization check
- ST01
- System trace, including authorization checks
- SU56
- Analyze a user's authorization buffer
- SU20
- Maintain authorization fields
- SU21
- Maintain authorization objects
Audit and certificates
- SUIM
- User Information System
- SM19
- Configure the Security Audit LogNewer releases use RSAU_CONFIG
- SM20
- Read the Security Audit LogNewer releases use RSAU_READ_LOG
- STRUST
- Trust Manager for certificates
What changes in SAP S/4HANA?
User and role work in S/4HANA on-premise still runs through SU01, PFCG and SUIM. Fiori adds business catalogs and spaces that roles must carry, so a role now grants both transactions and apps. Public cloud has no PFCG: access is managed through business roles in Fiori apps. Newer releases replace SM19 and SM20 with RSAU_CONFIG and RSAU_READ_LOG.
20 codes. Any code's title can be checked in the system itself with SE93.
The area itself: SAP security and authorizations.