For each user, How do I extract from SAP, all the Composite and Single Role assigned?

[Former Member]

I will soon be performing a user attestation/recertification for all SAP systems however I don't believe we have any of the GRC tooling in place at the moment. I need to extract all users Composite roles and Single Role provisions so that they can be reviewed.

[alessandr0 · Accepted solution]

Hi Tom,

agr_users will show you that. If field COL_FLAG is empty, it's a direct assignment. In case it comes through a composite role, the field will be X.
Cheers, Alessandro

[D039507]

Hi,

you can use the transaction SE16

roles to user -> AGR_USERS

roles to profile -> AGR_PROF

Also for profile -> User you can try to use UST04

Best Regards

Thorsten

[Former Member]

Thanks Thorsten, however I neglected to mention that I need to be able to determine which Single Roles are part of which Composite role assignment and which are standalone, can this be evidenced in the above SE16 tables aforementioned?

[Former Member]

Cheers Alessandro & Thorsten.

[Rizwan9697]

Hi Tom,

Please play around with AGR* tables,

• AGR_Users will give Users with assigned roles
• AGR_AGRS will give all Composite Roles
• AGR_Tcodes will give role with Tcodes
• AGR_Define will give Child role with Parent role relationship