SAP Security

This is done when ever role is already assigned to users and changes are done in that role. In order to get the changes adjusted in the roles, user comparision is done.

prerequisites are follows before assigning sap_all to any

user .

1.enabling the audit log ---- using sm19 tcode.

2.retreving the audit log-----using sm20 tcode.

this process follows when your not implementing grc in your

system.

scheduling and administrating of background jobs can be done

by using tcodes sm36 and sm37

We can restrict autho groups via object S_TABU_DIS, first

we need to create a autho group in SE54 then assign this

autho group in a role by using the object: S_TABU_DIS.

Execute SM37 and search for PFCG_TIME_DEPENDENCY

GRC Landscape is 2 system landscape,

1. SAP GRC DEV

2. SAP GRC PRD

in GRC there is no Quality system.

It is high importance data should be protect against unauthorized access.

IN SAP BI

Reporting Users – Analysis Authorization using transaction

RSECADMIN, to maintain authorizations for reporting users.

RSECADMIN – To maintain analysis authorization and role

assignment to user.

/virsar/ZVRAT

SPM can be used to maintain and monitor the super user

access in an SAP system. This enables the super-users to

perform emergency activities and critical transactions

within a completely auditable environment. The logs of the

SPM user IDs helps auditors in easily tracing the critical

transactions that have been performed by the Business users

Main difference--we can add/delete the tcodes for the

single roles but we cann't do it for the derived roles.

If we do the adjusted derived role in the master role

while updating the values in the master role thn values will

be reflected in the child roles.