Deassignment of users from roles

[former_member188806]

Hi,

We have a couple of users in our system who are assigned to some standard SAP roles.

These roles are themselves not composite roles , but form a part of some composite roles.

Now when I try to deassign the "blue" users from these roles, it's not possible.

How do I go about it?

Please help.

Thanks,

Saba.

[Former Member]

Hi,

You need to remove the composite from those users and add back in the single roles which they require.

Trying to remove one role assignment from a composite assigned to a user defeats the objective of using composites

[former_member188806]

Hi,

Thanks for your reply..however the problem is that the user is NOT assigned a composite role..he is assigned single roles ..which are a part of other composite roles(which are not assigned to the user).

Thanks,

Saba.

[Former Member]

Oops, sorry - I misread that part.

If you go into the user via SU01 can you remove the role from them that way?

[former_member1061482]

You should also be able to remove the users from roles through pfcg from user tab.

[former_member188806]

Hi,

Both ways its not possible.

When I remove the user from the role, it comes back after user comparison:((

& the role refuses to get deleted from the user.

Also, both appear in blue.

Plsss. help..

Thanks,

Saba.

[Bernhard_SAP]

Hello Sumant,

please check the table agr_users.

There are 2 fields for indirect assignements:

ORG FLAG

COL FLAG

If there is an entry 'X' in ORG FLAG, the role has been assigned indirectly by HR-ORG.

If there is an entry 'X' in COL FLAG, the role has been assigned indirectly by composite role.

I suppose, somebody has assigned the roles with HR-ORg....

b.rgds, Bernhard

[former_member188806]

Hi,

Thanks so much for the reply.

The COL Flag has X for all the troublesome roels.

However, they themselves are not composite roles, but single roles present in other composite roles.

Thanks,

Saba.

[former_member1061482]

Hi Sumant,

Are you sure that the users don't have "any" composite role assigned to them?

It may be that the single roles that you want to remove are coming from some other composite role which is assigned to the user.

In that case, you will have to remove the composite role and single roles would automatically get removed.

[former_member188806]

Thank u so much every1...my problem is nw resolved:)