Value set role verus Derived Role.

[Former Member]

Hi All.

We are in process of implementing SAP in worldwide have more than 50 branches in different companies. We are in process of standardized authorization concept which is applicable to all companies with control point on organisation level. We approached consult for this and he success us a for value set role will help us to reduce administration task. see in attached file but when I refer knowledge base documents in Internet then they suggest us to use derived role instead of value role and I am also agree with him but this is long term so that I would like to make sure that it is perfect .

http://www.sapsecuritypages.com/transaction-value-roles/

http://sap.ittoolbox.com/groups/technical-functional/sap-security/sap-security-value-roles-2147196

Which one is better in long term?

[jurjen_heeck]

My advice: stick with the SAP standards, even if it looks like more work in the beginning. Value roles are a known source of irrecoverable trouble.

Jurjen