Difference between Authorization Object and Group

[Former Member]

Dear Consultants,

Please explain me the difference between Authorization Object and Authorization Group

[Former Member]

An authorization object is the security object which has been coded in SAP ABAP to secure access to a certain area. For example, F_BKPF_BUK is an authorization object that is used to secure posting of FI docs by company code.

An authorization group is a term that is used in various areas in SAP such as table authorization groups or ABAP authorization groups. It essentially allows the security administrator to group data for the purposes of security. For example, S_TABU_DIS is the authorization object for table authorization groups - here you can enable access to a group of tables.

[Former Member]

An authorization object is a control element for establishing authorizations for users.

It consists of 1 to 10 fields.

The authorization objects are listed in the table TOBJ.

The authorization group is an element for extra protection.

It can be found as a field value in several authorization objects.

These objects are optional objects in most cases.

If we take the object F_KNA1_BED as an example.

The object is for "customer : account Authorization"

and is related to several transactions

[table USOBT_C or transaction SU24].

The objects consists of two fields.

ACTVT [activity] and BEGRU [authorization group].

You can group customer master records and assign an authorization group

to these master records [on general or company code level].

In the above listed object you can enter now the authorization group into the field when creating an authorization, and with this the user will only have access to master records that have this authorization group assigned.

This is a simplified explanation. Hope this helps a bit.

Additional remark:

[An individual value will always be overruled by a "*", and all master records that are then not protected by an authorization group can be accessed in general].