role maintenance

[former_member1354684]

Hi There,

We are in the process of remediating roles. When we delete a t-code from the role menu and then select the expert mode for profile generation with the option merge , it shows up the old objects that I have already deleted the previous time. Can anybody suggest if this is normal or am I doing someting wrong?

[jurjen_heeck]

This is expected behaviour.

Everytime you change the menu and edit the profile the PFCG will re-evaluate the customer tables as configured in SU24. The manual changes you did in the past are not taken into account.

[Former Member]

so message here is: Never delete objetc that are comming in via SU24 relations, only deactivate them!

[former_member1354684]

Hi Auke,

Thank you for the suggestion . What happened here is we used to follow the same but for virsa they have asked us to delete the objects instead of disabling as the results are showing incorectly

[Former Member]

>

> Hi Auke,
> 
> Thank you for the suggestion . What happened here is we used to follow the same but for virsa they have asked us to delete the objects instead of disabling as the results are showing incorectly

Who is recommending this for Compliance Calibrator?

The correct course of action is to configure SU24 correctly for the transactions which require them rather than delete the objects from the role.

This way your roles never get auth object values which they do not need.