SAP user License cost savings

[Former Member]

Dear gurus,

I am a Basis admin and assigned a SAP security project by our management. The project is to verify/validate all user definations and their classifications.

Most of the users are having only display access in our production landscape and they are all classified as professional user.

To me professional user means, having access to multiple tcodes with create/update/delete/display access.

In our landscape  users having only display access are also classified as professional users.

Is the above classification is true? We checked our contracts with SAP and there is no such proper definations.

Any thoughts (we planned to open a ticket with SAP also) or any one have this type of classifications.

Also there are some users using system to run one tcode per day (ST03N shows only 3 steps for that users per day). Those 3 steps belongs to a display tcode  also. They do have other accesses like printing reports, printing screens, downloading custom table data to a spreadsheets etc.

Is these consider as professional user classification?

Our previous security user defined all these classifications and left the company. I need to understand the process first and where should I begin?

I think above users should be classified as Limited users and this will save some cost for us.(lot of SAP blogs says this and not sure this is true or not).

Currently I am reading our contrancts with SAP and not sure that is the correct process to start with.

Any suggestions will be greatly appreciated.

thanks and best regards,

KK

[yakcinar]

Hello Kannappan,

There is no certain definition for classification of users. SAP leaves the details to contract. If they are not defined in detail in your contract it is not certain.

You can find detail definitions of user types in below links. Especially in excell.

Let me give some brief info about some types. Check the docs for details please.

Developer user is clear. If users name is in DEVACCESS table it is counted as developer.

Professional User: If entering, updating in more than one module, displaying data, taking reports, Giving Approvals etc.

Limited Professional:  Display data and give approvals etc. Managers can be in this clas.

MSS: Only for managers that are doing their own HR related works and giving HR related approvals etc .

ESS: Only for personnels that are doing their own HR related works.

Mostly SAP sends an xml file for all systems that needs to be measured according to your system data on SMP(service.sap.com). You must check all users in all clients of ABAP production and development systems. USMM checks all clients' users.

If you did not make any measurement before SAP uses Professional User type as default and assigns this to all unclassified users. Don't worry about these users you can reclassify them again.

1. I advise you to start gathering all users from all systems and clients to one excel sheet (can be seen below in picture) firstly, using SUIM user lists in each client . This distinct user list will be your scope for classification.

2. Then take users last 3 months "# of steps" using ST03N  User statistics as seen below picture. There is no chance to take all 3 months you need to take one month and sum all 3 months # of steps. Or you can take the last month also. System measurement program looks for the last month as I know.

4. Clean all unnecessary users from all clients of all measurement asked systems. Be carefull when you are deleting. Check ST03N (from User stats part) for at least last 3 months usage and ask business also.

5. Unclassify all users that have user type B System or C Communication. These users must have been used for integrations between systems. DDIC, SAP* can be unclassified. Measurement program accepts these users as Technical Users. They are not measured.

6. Compare the number of distinct users on your excel and you contract. If # of users in your excel is more than in your contract this means you need to buy extra license. If # of users in your contract is more than you are in your license limit.

7. Classify users with the user types that are defined in your contract in your excel. Check # of steps that is collected in step 2. Higher the # of steps means professional user type, limited professional user type. You can check your contract how many users needs to be in each user types.

8. According to the classification you did in excel login to each system and client and classify users using USMM transaction.

9. Run Sytem measurements. If system warns you about misclassifying, change classification of those user with the higher one and rerun System Measurement.

When you are running System measurement in USMM transaction system warns you if you classified user in lower ranks (eg: ESS User, Limited user etc) and if they are indeed  higher degree users (eg: developer, Professional etc). That time you classify one upper degree user type and rerun system measurement.

If measurement gives no warning export the result to law file.

10. Choose one of your system as central system (can be solution manager). Use SLAW in central system and import xml file. Then import all of the export results of the systems obtained in step 10.

11. Combine all results, Consolidate them and if everything is okey, "Transfer Direcly to SAP"

That's all.

Check the document links for details.

You can see detailed information from below links.

Information about SAP System Measurement

Overview of all available user types

SAP SYSTEM MEASUREMENT GUIDE

Regards,

Yuksel AKCINAR

[kaus19d]

Hi Kannappan,

My friend, see the thing like Mr. Yuksel said the usage & license categorization here is no issue, unless you allow multiple login or say you have created more users than you have been licensed. In case you are have more users than licensed, i would suggest you delete them on immediate basis. Another thing is when SAP asks for the License Audit report, the report is considered for the Dialogue Users Only. So need to worry about other User category. The report when combined it considers about the Dialogue users of Production system & the Development Id with DEVACCESS for the development system. Rest other users in Development system can be classified as TEST.

Another thing is if these things are ok, then you do not need to worry. The categorization actually comes according to the workload getting executed through any particular id which when we generally send report to SAP will manage accordingly. Say you are having one material department id like MATERIAL1 & that i8d is used for all material consumption & stock transfer & activities like that. So, it is obvious that when you will click for the report in USMM->System Measurement, it would be showing inconsistency in the shown location.

All you need to do here is swap the category of this user with another user with higher classification & that user is also not getting used so much & then you run the system measurement once again until like me this area is not containing any user list

You can also see all the Users classification in USMM->User Classification. To combine all the system reports you can use the LAW tool, t-code SLAW.

Note that Only ABAP systems are done using LAW Tool. More info is in Information about SAP System Measurement

Thanks,

Kaushik

[bkarabulut]

"Application Development" classified user type is more related to the E070 table than the DEVACCESS table. Even if one username is removed from the DEVACCESS table, the Violation message will continue to appear. USMM gets the usernames from the E070 table according to the current year and then It checks the SE06 defined user license table for correlation. As a result, the Application Development user counts/violations can be seen.

indeed, The other functional user types(Prof, Ltd.Prof, Loj, Empl, Worker, etc.) are determined with regard to some table records and created document type that's contained in the table TUL_AC_UNITT. Some of them are VBAK, VBAP,VTTK,VTTP,VTTS,EBKN,BKPF,EBAN.