Distributed Administration

Distributed Administration

If you are using the Profile Generator, you can automatically generate authorization profiles based on selectable R/3 transactions. You can also generate these type of profiles for administrators using templates.

For reasons of system security, you should divide up system administration tasks between different administrators as described below.

The superuser sets up user master records, profiles and authorizations for administrators in one or more areas.

An area may be a department, a cost center or any other organizational unit.

Within an area, administration tasks are divided among the following three administrators:

User administrator

User administrators have authorizations to do the following:

Create and change users (Transaction SU01)
Assign users to activity groups
Assign profiles beginning with T to users
Display authorizations and profiles
Use the user information system (Transaction SUIM)

They are not authorized to:

Display or change activity group data
Change or generate profiles

Authorization data administrator

Authorization data administrators have authorizations to do the following:

Create and change activity groups
Change the transaction selection and authorization data in activity groups
Use the user information system (Transaction SUIM)

They are not authorized to:

Change users
Generate profiles

Authorization profile administrator

Authorization profile administrators have authorizations to do the following:

Display activity groups and their data
Generate authorizations and authorization profiles beginning with T based on existing activity groups.
Execute Transaction SUPC
Use the user information system (Transaction SUIM)

They are not authorized to:

Change users
Change activity group data
Generate authorization profiles containing authorization objects beginning with S_USER.

For information about assigning administration tasks to the various users see Setting Up Administrators.

You can use authorization objects S_USER_AGR and S_USER_TCD to further differentiate the roles of the administrators.