Profile Generator: Tips and Tricks

Profile Generator: Tips and Tricks

1. Limiting activities by time

Even if you are not using HR-Org. you can still take advantage of the option to assign activity groups to users for a limited period of time. This is useful, for example, for your year-end closing, where inventory activities should only be permitted for a limited time.

Choose Tools ® Administration ® User maintenance ® Activity groups.

Under the tab User, you can set the assignment validity period.

To put a time–delimited assignment of an activity group to a user master record into effect, you must first execute a comparison.

The authorization profile is only entered or deleted in the user master record automatically if you have scheduled the background report to run periodically.

Job scheduling is also important for ensuring activity group consistency after an import.

SAP recommends that you schedule background report program PFCG_TIME_DEPENDENCY for these cases.

2. User assignment

Never insert generated profiles directly into the user master record (Transaction SU01). In the activity group maintenance transaction (Transaction PFCG), choose User and enter the users to whom you want to assign the activity group or profile.

If you then compare the user master records, the system inserts the generated profile in the user master record.

3. Do not assign any authorizations for modules you have not yet installed

If you intend to gradually add modules to your system, it is important you do not assign any authorizations for those modules you have not yet installed. This ensures that you cannot accidentally change data in your production system you may need at a later stage.

Leave the corresponding authorizations or organizational levels open. Do not set the Check Indicator in Transaction SU24 to No check.

4. Initial authorization assignment

Suppose you want to create a user in your test system with authorization to do ‘almost anything’. These types of users are usually not authorized to create user master records or change authorization profiles.

The fastest way to set up this user is as follows:

Create an activity group.

In Authorizations, choose Change authorization data and then Edit ® Insert ® Full authorization.
Expand the Basis administration object class.
This contains the authorization objects generally regarded as critical.

Deactivate all authorizations which begin with User Master Maintenance, as well as any others you regard as critical. Note that authorization S_USER_GRP, User Master Maintenance: User Groups (S_USER_GRP) with value * in fields CLASS and ACTVT is required to execute Transaction SU24.

Generate the profile and assign the authorizations to a user under User.

You assign the activity group you have just created to users entering them in Activity group.