No any role but can use t-code

[former_member600161]

I see our new training account in test system is like this:

I use SU01 to see user's roles. It is blank.

And I see profile is only one line, SAP ALL Authorizations.

I search a t-code with role complex selection like ME21n in SUIM transaction with my ID and found nothing.

But I can use T-code ME21N.

Why can be like this....

I just know profile is from role and tcode is in role menu and generate profile then user can use it.

Can anyone tell me how to do configuration like my description？

Many thanks ! ! !

[former_member144617]

Hello You are able to use Tcode as you have assigned SAP_ALL profile.

[former_member600161]

But I have no role, why can I use all t-code? I just know profile come from roles.

Can profile be assigned to a user directly?

Thank you

[Colleen]

HI Mercury

PFCG roles are an "interface" that helps you build security profiles. Profiles that are generated from PFCG cannot be assigned directly to end users.

However, SU02/SU03 is where standard and composite profiles can be built (goes back to 3.1X system days). Customers generally don't build profiles directly (they use PFCG)

However (again), SAP still delivers some standard single and composite profiles such as SAP_ALL. These can be directly assigned to your users in SU01 and will give them and grant authorisations to users.

[former_member600161]

Many Thanks ！

[Colleen]

SUIM - are you searching for transactions in menu or for authorisation S_TCODE = ME21N

Transaction field will search the PFCG menu tab (AGR_TCODES) table. SAP_ALL is a profile which is authorisation data only - no menu

try SUIM with roles by complex criteria for authorisation.

[former_member600161]

Hi
I search by SUIM --> complex selection with transaction and user name not by S_TCODE

It is different?
So for example，I can use t-code ME21N，maybe ME21N is not in the PFCG role menu but I can find it by searching S_TCODE?

Thank you.

[sujit_sharma]

Hello Mercury,

Answers are following for your comments:

But I have no role, why can I use all t-code? I just know profile come from roles.

- Yes.Since you have the profile SAP_ALL associated with your ID which contains all the authorization objects, so you are able to execute all the t-codes. You are correct that profile comes from role, of course however profiles separately also can be created.

Can profile be assigned to a user directly?

- Yes, that can be directly assigned to user and user gets all of the authorizations defined in this profile. However its always a good practice to assign any access by associating it with a role to a user.

Best regards,

Sujit

[former_member600161]

Many thanks

Could you please tell me how to assign profile directly not by role?

Like SAP_ALL profile. Which T-CODE should I use?

[Colleen]

transaction SU01 to maintain a user and go to profile tab.