Regenerate the Authorization Profile Following Changes (SAP Library

Regenerate the Authorization Profile Following Changes

When you change a role, you must regenerate the authorization profile. In this case, the tab index Authorizations is marked in red or yellow. The status text displayed on the tab explains the status of the profile in more detail.

If a red symbol appears on the tab index, you must compare and adjust the profile. The menu has changed since the profile was last generated. If the display is yellow, the profile has been changed and saved since it was generated. This means that the generated profile is no longer current.

On the maintenance screen Change role: Authorizations, you can make the necessary changed and regenerate the profile.

If you select Expert mode for profile generation under the Authorization tab, you can choose the option with which you want to maintain the authorization values (this option is automatically set in normal mode).

In expert mode, you can:

Delete and recreate profile and authorizations

All authorizations are recreated. Values which had previously been maintained, changed or entered manually are lost. Only the maintained values for organizational levels remain.

Edit old status

You can edit the authorization profile you previously maintained using the saved values. It is not worth doing this if the assignment of transactions to roles has changed.

Read old status and compare with new data

The Profile Generator compares the old data to the current data in the role. It is worth doing this if the role menu has changed. Unchanged data is marked as Old, new data as New.

Note the following when you execute the comparison:

The maintained organizational levels remain. If new levels are added, they need to be maintained. Superfluous organizational levels are deleted.
If authorizations in an authorization object have changed, a manual comparison is necessary: you must decide whether you want to retain the old modified data, or use the current version. Delete or maintain the authorizations you no longer require.
Maintained authorizations are filled automatically, as far as possible, with the values you have maintained .

The transactions in the role determine the following activities in an authorization: Create, Change, Display Authorization group 0001 (maintained by you).

This is the old, maintained status. You change the role to have the following actions: Change, Display and Delete. The value 0001 is then copied for the authorization group activities Change and Display as these were already maintained. Insert is no longer displayed on the screen. You still need to maintain the authorization group for the Delete activity, since this was not maintained in the old status.

Wherever the New attribute appears, you need to check whether the new authorizations make sense. If necessary, you can compare them manually with the old values.
Manually entered authorizations are not deleted.
The values for authorization object T_CODE are always filled automatically with the current transactions from the role, but receive the attribute Old.

Choose one of the three options. The system displays a browser view.

The status line contains the authorization profile status: unchanged, saved, changed or generated.