How can I find the profiles which are not in a role

[Former Member]

Hi all,

how can I find all profiles which are not used in a role. Its important for a security check.

[Former Member]

Hi Stefan,

you do one thing use the transaction SUIM

SUIM>>Profile>>By Roles

give all the role name and execute you will get roles with profiles

and extract to excel sheet

to get only profiles

suim>>profile>>by profile name or text give * and execute

and extract in excel sheet no compate profile coloumns get the profiles which does not there in any roles

hope ds helps

thanks

kishore

[Former Member]

Hi Kishore,

thanks for your idea, but it doesn't work. One role can have many profiles. With the transaction SUIM I only see one profile for one role.

regards

Stefan

[Former Member]

Hi Stefan,

if i am wrong correct me

one role always will have only one profile

if you careate from PFCG role name and when you generate authorization create your desired profile

can you show me one std. role which contains more than one profile

thanks

kishore

[Former Member]

Hi,

Transaction su02 is about profiles. You can see which are generated by the profile generator, profile with activities hand made and profiles containing profiles (nested).

From a role more profiles can be created, that is why sap uses two digits at the end of each profile. So a role can have more then one profile up to 99.

have fun

Jan van Roest

[Former Member]

Hi all,

here is the solution. Transaction S_BCE_68001409 - Profiles by Complex Selection Criteria. All profiles with the type: S Single profile is a profile which is not in a role.

thanks for all ideas

regards stefan

[sivakumar_kilari3]

Stefan,

This transaction you can exectute through SUIM ->PROFILES>PROFILES BY COMPLEX SELECTION CRITERIA.

Regards

Siva

[Former Member]

Stefan,

The general rule of thumb is Role's profiles normally begin with T-, unless you change it during role profile generation. The generated role's profiles also will have standard description that begin with "Profile for role ...."

Stand alone profiles tend to have name that tell you what the profiles are for.

Good luck,

Lye