Is there a way to assign Profile SAP_ALL to a user excluding SU01?

[liyame]

Hi everyone.

I'm a trainee for the SAP Basis and I've only been taught a few chosen parts of security as of now. Since my job is only about daily monitoring. But right now I've come across a requirement. I need to give SAP_ALL but excluding SU01 and other few chosen TCodes if asked in future. So, I've tried searching for it and came across the answers like creating a separate Role and choosing a template in the "change authorization tab" in PFCG. I guess this is how roles or profiles are copied.

I think I'm almost there but stuck at this point. Can someone please explain briefly how to restrict Tcode here? it would be really helpful. Also if there are any other ways to restrict or lock Tcodes l'd love to know those as well. Those would we useful if this doesn't work.

Thanks in Advance.
I would really Appreciate the help. 🙂

[FredericGirod]

create a Z_SAP_ALL ..

[david-barba]

Hi Ali, you shouldn't be copying auth from SAP_ALL, this is a highly restricted profile from SAP with all the authorizations open. You could use SAP_ALL for a test and perform a trace using STAUTHTRACE tcode to gather the authorizations needed and from there create a role with a profile to only the auth needed. This is one aproach from several (All of this on a Non-productive environment) . Additionally, there are templates from SAP to a variety of different profiles. SAP_ALL is a very powerfull, therefore, dangerous and risky profile, acces should be restricted to everyone.

As you mention you are new to security aspects for SAP, I highly recommend you to read ADM940, you'll find answers to all your security queries and more, it is fundamental to read this.

[holm]

This approach makes no sense at all. There are 1000 ways to circumvent the few t-codes not being in the copied profile (e.g. call the report directly via se38, write a program, ...).

Roles always have to be built from scratch to be secure.

[JoeyLi]

change authorization data