SAP authorization and role diagnostics

Core idea

Authorization failures stop users before they can reproduce a functional issue. The diagnostic goal is to capture the missing authorization object, compare it with the user's roles and profiles, and decide whether the fix is a role change, a user exit, or a process change.

Common symptoms

• User receives 'No authorization' or 'You are not authorized' messages.
• A transaction starts but specific functions or fields are grayed out.
• Background job fails with authorization errors under its service user.
• An interface or RFC call fails with authorization_check errors.
• Authorization works in one client but not another after a transport.

Likely causes

• Missing authorization object: the role does not contain the required object/activity/value.
• Organizational level mismatch: the user is authorized for a different company code, plant, or sales organization.
• Profile not generated: the role was changed but the profile was not regenerated or not assigned.
• Buffer refresh: user context still holds the old authorization after a role change.
• User comparison incomplete: the user master record was not compared after role changes.

Where to check in SAP

• SU53 — display authorization check values from the last failed check.
• PFCG — role maintenance: check objects, organizational levels, and profile generation status.
• SU01 — user master: compare roles and profiles assigned to the user.
• ST01 — authorization trace for harder cases.
• SU56 — authorization buffer for the current user session.

Key tables / transactions / objects

• UST04 / UST12 — user master authorization profiles.
• AGR_1251 — authorization values in roles.
• USR02 — user master logon data.

Diagnostic workflow

1. Reproduce the error or capture SU53 immediately after it occurs.
2. Identify the missing authorization object, field, and required value.
3. Check whether the user has a role that should contain that object.
4. If the role exists, verify profile generation, user comparison, and buffer refresh.
5. If the role does not contain the object, decide whether to extend the role or change the process.
6. Document the authorization object and value before requesting a security change.

Typical fixes or next actions

• Add the missing authorization object/activity to the correct role and regenerate the profile.
• Adjust organizational levels if the user works across company codes or plants.
• Run user comparison for affected users after role changes.
• Refresh the user context or have the user log off and on again.
• Escalate to security team if the request conflicts with segregation of duties.

Support takeaway

Authorization tickets are most useful when they include the SU53 screenshot or authorization object, the user's roles, the transaction and activity, and the business reason for access.

Boundaries and non-goals

This page is a support diagnostic, not a security role design or SoD review guide. It does not replace the security team's authorization concept.

This is not official SAP documentation and not a replacement for system-specific analysis.