Adding/Deleting T codes to roles. Finding the correct roles to add/delete T

[Former Member]

Hi Folks

I would like solutions to 3 questions.

1) How do you Add/Delete transaction codes to roles (ECC6)

2) How do you find the correct roles to Add/Delete these T codes

3) Has anyone any documentation and or screenshots on Versa, the Compliance Calibrator.

We are using single roles within composite roles.

Useful answers will be rewarded.

Thank you very much

Mark W

[Former Member]

1. Use transaction PFCG

2. Ask the role owners, functional team etc. As a security admin/consultant you should have a good idea of what goes where when you understand the role build.

3. All the docs you need are here: https://websmp101.sap-ag.de/~form/sapnet?_SHORTKEY=01100035870000691285&;

It might be worth checking out courses ADM940 & TGRC20 which cover all of those topics

[Former Member]

Hi Alex

Thank you for coming back to me, but I need a little more detail.

I am at the stage of a go live for a new implementation of ECC 6, and in preparation for any problems, I posed the questions below. I know you use PFCG to add a transaction but my question was "where would you place a new transaction, and how do you find out which role to add it to"

I know I can go into PFCG, and click on the "add transaction button" but I want to know which role to add it to, or indeed do I need to add it to a role at all.

I have done the course ADM 940.

I do not have access to the SAP Market Place which your link took me to.

I hope I have made myself a little clearer.

Thanks

Mark

[Former Member]

Hi Mark,

Typically the functional team or organisational design team will specify the roles required and the transaction assignment to those roles. By working with them, you can understand what part of the business processes the roles represent and get an idea about which transactions go in what roles. They will also be able to advise if a new role is required id a transaction is missing.

The allocation of tx to roles should only be approved by role owners or appropriate responsible resource, and they should stipulate exactly which roles those tcodes go into. If you have not been involved in the role design then it is not appropriate for them to expect you to make those kind of decisions.

All of the recent compliance calibrator docs are on the service marketplace, I'm sure that the basis team on your current project will either give you their OSS ID to let you download them, or alternatively will download the docs for you if they have concerns about sharing the ID. From memory, if you have security certification, you should be able to get an individual OSS ID from SAP.

There is some high level info available from www.sap.com/grc and a brief overview of an install of CC5.1 here: http://www.sapsecurityonline.com/sox_sod/sox_sod.htm

Hope that helps

Cheers

Alex

[Former Member]

Hi Alex

Thank you very much for your help. Especially in regards to the CC information.

Cheers

Mark