SAP_ALL profile to role: If SAP_ALL changes?

[Former Member]

Hi,

We wanted to give SAP_ALL profile to users with validity date and it is advised to generate a role from SAP_ALL profile.

My question is SAP_ALL is a live profile, when new authorization objects added to system (maybe after new functionality), SAP_ALL is also expanded with a report and these new authorizations are also added to SAP_ALL, right?

When I generate a role using this profile as template and then if SAP_ALL changes, how can I update the role created from SAP_ALL automatically?

Thank you for your help.

Best regards

Oktay 

[Former Member · Accepted solution]

Hi Oktay,

When new SAP auth objects are added via support packs/upgrade you would need to regenerate SAP_ALL from SU21 or execute report RSUSR406 to include these new objects in SAP_ALL profile

• The role copied from SAP_ALL cannot be automatically updated when SAP_ALL is regenerated with new auth objects. You would need to select the template again, else you would need to manually add the new objects which have been introduced in SAP_ALL.
• It's not "best practice" to assign roles copied from 'sap_all' profile. You would need to deactivate sensitive authorizations like S_USER_*, S_DEVELOP, S_TRANSPRT, S_ADMI_FCD, S_BTCH_ADM,  S_CTS_ADMI, etc.

Hope it helps.

Best Regards,

Savitha