SAP authorization menu tree

[antonio_steinhuser]

Hello,

i am searching for the ECC 6.0 SAP authorization menu tree in Excel format.

i want this, because to assign Rolles to transactions without access to the SAP System.

Does anyone have the ECC 6.0 SAP authorization menu tree in Excel format?

I know , that for 4.6 there was a Excel menu tree from SAP directly.

Gruß

Antonio

[Former Member]

I only know of tricks to get it out into a formatted file. The easiest is to go to SE43 and select the S000 area menu and use the print formatting to create a spool file.

But, you must consider that S000 is like a composite area menu, so there are others embedded as nodes within it. Actually, I believe that a full expansion would be likely to produce an endless loop if any of the nodes also embed another node. Never tried to reach the bottom of it myself though (I am not a hamster :-)) so cant ne 100% sure.

Cheers,

Julius

[antonio_steinhuser]

Hi,

yes i also know how to export to Ecel like over SE43 or pfcg.

But the output to Excel is very confusing and long.

I need this in Excel with menues to expand the separat tree's etc.

Gruß

Antonio

[Former Member]

. Never tried to reach the bottom of it myself though (I am not a hamster :-)) so cant ne 100% sure.

I have.  I wouldn't recommend it, every time I have tried it takes down SAPGui.

Antonio - what is your motivation for using the menu to populate roles? I would usually expect the roles to come from the process flows and where the process flows have a SAP activity then that is documented and forms the basis for the roles.  If you take a transaction-list approach then there is a high likelyhood that users will get transactions that are superfluous to the processes they are supporting.

Cheers

[antonio_steinhuser]

Thanks,

but we do not use here process flows. the customer use a module oriented conzept here.

So i need a tools to create the roles and therefore i have good experience with excel menu tree's where the customer can select the transactions with should be included in the role.

Gruß

Toni

[Former Member]

Hi Toni,

I'm not aware of any good source of menu. Without understanding the processes it will be difficult to understand the control points and how users interact with the system as part of their wider job.

Good luck!

[Former Member]

There used to be a thing from 46C times called the Business Process Blueprint in Excel. Perhaps you are referring to that?

My christmas wish in 2012 would rather be an experienced functional consultant with indistry knowledge and someone from the business side who also appreciates the cabailities of transactions and to some degree how building authorizations for them works.

Given the number of transactions now in SAP and about 5000 authorization objects, such lists are not easily deployable anymore. Or would be like giving them the hamster tredmill to run in...  🙂

Something in the middle between the tredmill excels and building roles for them with expert inputs combined with that which they actually use... is to use the SAP Best Practice roles as a starting point and give them the opportunity to scale them down by removing that which they should not use or dont want to see, and they even have industry solution versions. Do you have access to the Knowledge Base area on the service market place? They are attached there as download files. Not master pieces and dont deliver anything for Su24, but a lot better than an excel sheet of S000 content.

Cheers,

Julius

[Former Member]

ps: Trick it to get up and running fast without a huge discussion and explosion or number of roles and get the application authorizations right. Then you can tune the tcodes down and trick is to simulate the affect on the roles at the application object level.

There is even a "best practice" and "use of expert tools" training course on this offered by SAP Education.

Disclaimer for transparency: These "best practices" include inputs from me and we develop the training materials and some of the tools together with SAP. If you search sap.com for "WCHXIT" then you will find more infos on it

Cheers,

Julius

[antonio_steinhuser]

Hello Julius,

yes i have access to the Knowledge Base area on the service market place but i did not found what you meanß

Do you have a link to the download files and infos?

Gruß

Antonio

[Former Member]

HI Antonio,

See SAP Note 1165371.

Cheers,

Julius

[antonio_steinhuser]

Hello Julius,

thanks for the note. But i have some questions to this.

This note contains files with predefined roles for SAP Best Practices packages

based on SAP ERP 6.0 Enhancement Package 3 and SAP NetWeaver Business Client

(NWBC).

These roles are required to run SAP Best Practices business processes in the

NWBC

Which ZIP-file need i for normal "CO" and "FI" Roles in germany? Is it

SAP Best Practices Baseline Package Germany - V1.603 ?

Gruß

Toni

[Former Member]

It might be that the folks in WDF got north and south Korea mixed up, but Germany being Germany should be a safe bet.. 😉

Note that some of the NWBC versions should not be used unless you are using the NWBC.

Cheers,

Julius

[Former Member]

Hello

I am that hamster as I have been creating module-based display roles (MM/PM/PP/AP/AR/GL etc) by running down the menu in PFCG - import from menu (local) option.

Apart from going even greyer it's perversely enjoyable seeing the same folder/tcodes appear when trawling for'display' or list display' or 'change documents' transactions.

There is an end ....eventually -  then run AGR_TCODES on the resulting horrendous role, check against usage and then build a 'real' role that reflects the business' needs.

There's - (edit) Probably a better way of doing it but it's nearly done so I don't want to know

I just had a look at that se43 option but couldn't work it out.

Cheers

David

Message was edited by: David Berry

[Former Member]

The methodology (see comment above about "WCHXIT -> Best Practices for Authorization Lifecycle Management") of doing this is similar, except it is automated and contains some safety nets.

Goal should be to achieve a consistently structured and translated menu with optimized SU24 for what you use and minimized number of roles to make it work.

Cheers,

Julius

[Former Member]

Hello

I couldn't access that from my works PC but I'll try over the weekend.

What interests me is this first comment

'i want this, because to assign Rolles to transactions without access to the SAP System.'

With this as a starting point I really can't see a solution to the post - it's a no-brainer...

Cheers

David

[Former Member]

Oh! Somehow I missed that..

You at least need access to the system yourself (Z-tcodes?) but sending the folks a menu to confirm in a structured Excel file is still OK in my books.

Better is to switch their menus only before you switch their authorizations. There are tricks for that as well  🙂

Cheers,

Julius

[Former Member]

That is eactly where I am now - plenty of SAP standard display only used transactions (the SU24 not used and 'basic PFCG auth tab 'change' authorisation methodology also scares me) and now to find a shed load of custom transactions... Phooey.

That last point about switching sounds interesting

Cheers

David

[antonio_steinhuser]

Hi,

here i have create a picture from what i mean.

https://www.dropbox.com/s/udvfht9n8t8er4y/SAP_Menue.JPG?m

@David

do you have something like this for ECC 6.0 ?

This procedure helps the key-users to define the sap-roles in the first step.

Gruß

Toni

[Former Member]

If you can get the data into Excel via SE43 and add the Z-tcodes at the correct places.. then the remainer of the work to create filters to get to line 41531 is in Excel, not in SAP.

* (note that according to the Mayans, the world is going to end tomorrow anyway!  🙂

However, how are you going to get these various chosen lists back into the menu of the role in the same or at least a consistent structure, even if one can get intuitively fast to line 41531?

I think the approach is no longer used much, that is why one sees less and less of these Excel "blueprints" around.

Cheers,

Julius