Here we have mentioned most frequently asked SAP GRC Interview Questions and Answers specially for freshers and experienced.
1. What is the use of SAP GRC?
Ans:
SAP Governance, Risk and Compliance solution enables organization to manage regulations and compliance and remove any risk in managing organizations key operations. As per changing market situation organizations are growing and rapidly changing and inappropriate documents, spreadsheets are not acceptable for external auditors and regulators.
2. What are the different activities that you can perform in SAP GRC?
Ans:
SAP GRC helps organization to manage their regulations and compliance and you can perform following activities
- Easy integration of GRC activities into existing process and automating key GRC activities.
- Low complexity and managing risk efficiently.
- Improve risk management activities.
- Managing fraud in business processed and audit management effectively.
- Organizations perform better and companies can protect their values.
- SAP GRC solution consists of three main areas: Analyze, manage and monitor.
3. What are the different GRC modules you have worked on?
Ans:
- SAP GRC Access Control
- SAP GRC Process Control
- SAP GRC Risk Management
- SAP GRC Audit Management
- SAP GRC Fraud Management
- GRC Global Trade Services
4. What are the key activities under SAP GRC Access Control?
Ans:
To mitigate risk in an organization, it is required to perform risk control as part of compliance and regulation practice. Responsibilities should be clearly defined, managing role provisioning and managing access for super user is critical for managing risk in an organization.
5. How Process Control is different from Access Control in SAP GRC?
Ans:
SAP GRC Process control is used to monitor task and reports in real time and you can generate compliance status of controls in place as per business processes and aligning business processes to perform risk prevention and mitigation.
6. What is the use of GRC Risk Management?
Ans:
SAP GRC Risk management allows you to manage risk management activities. You can do advance planning to identify risk in business and implement measures to manage risk and allow you to make better decision that improves the performance of business.
7. What are the different types of Risk?
Ans:
Risks come in many forms –
Operational Risk
Strategic Risk
Compliance Risk
Financial Risk
8. What is SAP GRC Audit management?
Ans:
This is used to improve the audit management process in an organization by documenting artifacts, organizing work papers, and creating audit reports. You can easily integrate with other governance, risk and compliance solution and enables organizations to align audit management policies with business goals.
9. What is SAP GRC Fraud Management?
Ans:
SAP GRC Fraud management tool helps organizations to detect and prevent frauds at early stage and hence reducing minimizing the business loss. Scans can be performed on huge amount of data in real time with more accuracy and fraudent activities can be easily identified.
10. What are the key capabilities of Fraud management module?
Ans:
SAP Fraud management software can help organizations with following capabilities
- Easy investigation and documentation of fraud cases.
- Increase the system alert and responsiveness to prevent fraudent activities to happen more frequently in future.
- Easy scanning of high volumes of transactions and business data.
11. What is Global Trade Services?
Ans:
SAP GRC GTS software helps organizations to enhance cross border supply within limits of international trade management. It helps in reducing the penalty of risks from International Trade Regulation authorities.
It provides centralize global trade management process with a single repository for all compliance master data and content irrespective of size of an organization.
12. Is it possible to lock all the users at same time in SAP system?
Ans:
Yes, using T-code: EWZ5
13. What is Authorization object and authorization object class?
Ans:
Authorization objects are groups of authorization field that are used to regulate activities in SAP system. All the objects come under Authorization class and grouped by different functional areas like Finance, accounting, etc.
14. How do you perform user authorization in SAP system using GRC access control?
Ans:
SAP GRC access control uses UME roles to control the user authorization in the system. An administrator can use actions which represents the smallest entity of UME role that a user can use to build access rights.
One UME role can contain actions from one or more applications. You have to assign UME roles to users in User management engine (UME).
15. What is UME and how it works?
Ans:
User management engine (UME). When a user does not have access to a certain tab, the tab will not display upon user logon when user try to access that tab. When a UME action for a tab is assigned to that particular user, only then he will be able to access that function.
All available standard UME actions for CC tabs can be found in the tab “Assigned Actions” of the Admin User.
16. What are CC roles that can be created at time of implementation?
Ans:
CC.ReportingView
Description: Compliance Calibrator Display and Reporting
CC.RuleMaintenance
Description: Compliance Calibrator Rule Maintenance
CC.MitMaintenance
Description: Compliance Calibrator Mitigation Maintenance
CC.Administration
Description: Compliance Calibrator Administration and Basis Configuration
17. What is Risk Analysis and Remediation under Access Control?
Ans:
Risk Analysis and Remediation (RAR)
In GRC access control, you can use Risk Analysis and Remediation (RAR) capability to perform security audit and segregation of duties (SoD) analysis. It is a tool which can be used to identify, analyze, and resolve risk and audit issues linked to regulatory compliance.
18. What are the key activities that Process Control share with Access Control in GRC?
Ans:
Access control and process control shares the compliance structure in below areas
- In process control solution, controls are used as mitigation control in access control under SAP GRC 10.0 solution.
- Access control and process control share same organization.
- In process control, processes are used as business processes in access control.
- Process control and access control are integrated with access risk analysis to monitor segregation of duties SoD.
19. What are different Process Control areas that are shared with Risk management?
Ans:
GRC Role assignment
Process Control planner
Risk Management Planner
Central Delegation
20. What is IAM Internal audit management?
Ans:
Internal audit management allows you to process the information from Risk management and Process control to use in audit planning. Audit proposal can be transferred to audit management for processing when required and audit items can be used to generate issues for reporting. IAM provides you a place where you can perform complete audit planning, create audit items, define audit universe and create and view audit reports and audit issues.
21. What are the different activities that can be performed under IAM?
Ans:
In Internal Audit Management work center you can perform various activities
Audit Universe contains auditable entities
Audit Risk Rating
Audit planning to define procedure for audit compliance
Audit issues from audit actions
Audit reports to see what risks are there on auditable entities
22. What is an Audit Universe?
Ans:
Audit Universe contains audit entities which can be classified as Business units, Lob’s or departments. Audit entities define the audit planning strategy and these can be linked to Process control and Risk management to find risks, controls, etc.
23. What is Audit Risk Rating ARR?
Ans:
Audit Risk rating is used to define the criteria for an organization to find risk rating and establish ranking for risk rating. Each audible entity is rated as per management feedback in ARR.
- You can use ARR to perform the below
- You can find set of auditable entities and risk factors
- Define and evaluate risk scores for risk factor in each auditable entity.
- As per risk score, you can rate the auditable entity.
- You can also generate an Audit plan from ARR by comparing risk scores for different auditable entities. Selecting the high risk score auditable entities and generate audit proposal and audit plan proposal.
24. What is the use of Report and Analytics Work Center in GRC?
Ans:
Reports and Analytics Work center is shared by Process Control, Risk management and access control. The Process Control Reports and Analytics work center consists of Compliance section in GRC application.
25. What are the different reports under Process Control?
Ans:
In compliance section, you can create various reports under Process Control.
Evaluation Status Dashboard
Shows a high-level picture of the overall status of corporate compliance throughout different business entities and provides analytics and drilldown capabilities to view data on different levels and dimensions.
Survey Results
Displays the results of surveys.
Datasheet
Provides comprehensive information on master data, evaluation, and remediation activities for subprocesses and controls.
26. What is SoD Risk Management?
Ans:
In every business, it is required to perform Segregation of Duties risk management starting from Risk recognition to rule building validation and various other risk management activities to follow continuous compliance.
As per different roles, there is need to perform Segregation of Duties in GRC system.
27. Based on SoD, what are the common roles and their key duties?
Ans:
Business Process Owners
- Identify risks and approve risks for monitoring.
- Approve remediation involving user access.
- Design controls to mitigate conflicts.
- Communicate access assignments or role changes.
- Perform proactive continuous compliance.
Senior Officers
- Approve or reject risks bet ween business areas
- Approve mitigation controls for selected risks
- Security Administrators
- Assume ownership of GRC tools and security process
- Design and maintain rules to identify risk conditions
- Customize GRC roles to enforce roles and responsibilities
- Analyze and remediate SoD conflicts at role level
Auditors
- Perform risk assessment on a regular basis
- Provide specific requirements for audit purposes
- Perform periodic testing of rules and mitigation controls
- Act as liaison bet ween external auditors
SoD Rule Keeper
- Perform GRC tool configuration and administration
- Maintain controls over rules to ensure integrity
- Act as liaison bet ween basis and GRC support center
28. What are the different phases in GRC Risk Management?
Ans:
There are various phases in risk management process
- Risk Recognition
- Rule Building and Validation
- Analysis
- Remediation
- Mitigation
- Continuous Compliance
29. What are the different phases under Risk management in GRC?
Ans:
- Risk Recognition
- Rule Building and Validation
- Analysis
- Remediation
- Mitigation
- Continuous Compliance
30. What is rule building and validation under Risk Management?
Ans:
- Reference the best practices rules for environment
- Validating the rules
- Customize rules and test
- Verify against test user and role cases
31. How do you perform Risk classification? What is difference between low, medium and high risk classification?
Ans:
Risk should be classified as per the company policy. There are various risk classifications that you can define as per risk priority and company policy
Critical
Critical classification is done for risks that contains company’s critical assets that are very likely to be compromised by fraud or system disruptions.
High
This includes physical or monetary loss or system-wide disruption includes fraud, loss of any asset or failure of a system.
Medium
This includes multiple system disruption like overwriting master data in the system.
Low
This includes risk where the productivity losses or system failures compromised by fraud or system disruptions and loss is minimum.
32. You have created a custom role methodology for your firefight related security roles. However, when you create a specific firefight related security role, the expected methodology is not applied. What could be the reason?
Ans:
The BRFplus decision table does not contain the appropriate condition.
33. What is difference between preventive mitigation controls and detective mitigation controls?
Ans:
Preventive mitigation control is used to reduce the impact of risk before it actually occurs. There are various activities that you can perform under preventive mitigation control
- Configuration
- User Exits
- Security
- Defining workflow
- Custom Objects
Detective Mitigation Controls
Detective mitigation control is used when an alert is received and a risk occurs. In this case the person who is responsible to initiate corrective measure to mitigate the risk.
There are various activities that you can perform under detective mitigation control
- Activity Reports
- Comparison of plan vs actual review
- Budget review
- Alerts
34. What is the use of Superuser privilege management in GRC?
Ans:
In SAP GRC 10.0 Superuser privilege management needs to be implemented in your organization to eliminate the excessive authorizations and risks that your company experiences with the current emergency user approach.
35. Is it possible that super user can act as Firefighter?
Ans:
Superuser can act as firefighter and have the following additional capabilities
- It can be used to perform tasks outside of their normal role or profile in an emergency situation.
- Only certain individuals (owners) can assign Firefighter IDs
- It allows an extended capability is provided to users while creating an auditing layer to monitor and record usage.
36. What is difference between Administrator and Owner standard role under Superuser Privilege?
Ans:
You can use following standard roles can be used for super user privilege management.
/VIRSA/Z_VFAT_ADMINISTRATOR
Ability to configure Firefighter
Assign Firefighter role owners and controllers to Firefighter IDs
Run Reports
/VIRSA/Z_VFAT_ID_OWNER
Assign Firefighter IDs to Firefighter users
Upload, download, and view Firefighter history log
37. How do you check Superuser logs?
Ans:
Use T-Code: Transaction: /n/VIRSA/ZVFAT_V01
38. What are the advantages of using Global Trade Services?
Ans:
Below are the key advantages of using Global Trade Services
- It helps in reducing the cost and effort of managing compliance for global trading.
- It can ease time-consuming manual tasks and helps in improving the productivity.
- Reduces the penalties for trade compliance violations
- It helps you to create and improve the brand and image and avoid trade with sanctioned or denied parties.
- Better Customer satisfaction and improve the quality of service.
- It fastens the inbound and outbound processes by performing customs clearance and also helps in removing unnecessary delays.
39. What is difference between single and derived roles?
Ans:
For Single role, you can add/delete Transaction codes while in derived roles you can’t add T-codes.
40. What do you understand by user buffers?
Ans:
User buffer stores all the authorization of a user.
41. What is the maximum number of Transaction codes that can be assigned to a user?
Ans:
You can assign 14000 transactions to a role.
42. How do you delete old security logs?
Ans:
Using SM18 Transaction Codes.
43. How do you implement firefighter’s id in SAP GRC system?
Ans:
Implementing firefighter ID’s consists of following steps
- Creating Firefighter ID’s for each business process area
- Next is to assign necessary roles and profiles to carry firefighting tasks.
- You shouldn’t assign profile SAP_ALL
44. What do you understand by ruleset? What is default rule set in GRC system?
Ans:
Collection of multiple rules is known as rule set. In GRC, we have default rule set known as Global rule set.
45. How do you perform Role modification in SAP system?
Ans:
Using PFCG_TIME_DEPENDANCY back ground job.
46. What is the landscape of GRC system?
Ans:
GRC landscape has 2 systems
SAP GRC Dev
SAP GRC PRD and there is no quality system.
47. What is the use of Segregation of duties in SAP system?
Ans:
SOD is implemented in SAP system to detect and monitor fraud in business transactions.
48. What is the table name to store illegal password details in SAP system?
Ans:
Table USR40 is used to store all illegal password details.
49. How do configure a user to login to SAP GRC system?
Ans:
You need to assign following roles to user to login to GRS system
- Portal authorization
- Applicable PFCG roles
- PFCG roles for access control, process control and risk management
50. What are the key capabilities that you can perform using Superuser privilege management?
Ans:
- You can allow Superuser to perform emergency activities within a controlled and auditable environment
- Using Superuser, you can report all the user activities accessing higher authorization privileges.
- You can generates an audit trail, which can be used to document reasons for using higher access privileges.
- This Audit trail can be used for SOX compliance
51. What is the rule set in GRC?
Ans:
Collection of rules is nothing but rule set. There is a default rule set in GRC called Global Rule Set.
52. What is the landscape of GRC?
Ans:
GRC Landscape is 2 system landscape,
SAP GRC DEV
SAP GRC PRD
in GRC there is no Quality system.
53. Explain about SPM?
Ans:
SPM can be used to maintain and monitor the super user access in an SAP system. This enables the super-users to perform emergency activities and critical transactions
within a completely auditable environment. The logs of the SPM user IDs help auditors in easily tracing the critical transactions that have been performed by the Business users
54. What is use of su56?
Ans:
Displays the current users Authorization Profiles available it the ID. Can also be used to reset their User buffer to pick up new roles and authorizations.
55. What is the use of RSECADMIN?
Ans:
IN SAP BI
Reporting Users – Analysis Authorization using transaction
RSECADMIN, to maintain authorizations for reporting users.
RSECADMIN – To maintain analysis authorization and role
assignment to user.
56. What is offline risk analysis?
Ans:
Offline Mode Risk Analysis process is performed with the help of Risk Identification and Remediation module in SAP GRC Access Control Suite. Offline mode Analysis helpos in identifying SOD Violations in an ERP System remotely. The data from system is exported to flat files and then it can be imported into the CC instance with the help of data extractor utility.
It can also be used to remotely analyze an ERP system which may be present in a different ERP Landscape.
57. How can find out whether CUA (Central User Administration) is configured on your sap system?
Ans:
Execute su01 You can find out a tab called system tab…. If system tab is not displayed there in su01 screen there is no CUA is configured.
58. How do we test security systems? What is the use of SU56?
Ans:
Through Tcode SU56, We will check the users buffer
59. How we Schedule and administering Background jobs?
Ans:
Scheduling and administrating of background jobs can be done by using tcodes sm36 and sm37
60. What are the Critical Tcodes and Authorization Objects in R/3?
Ans:
Just to say all the t-codes which can affect roles and user master records are critical ones. SU01, PFCG, RZ10, RZ11, SU21, SU03, Sm37 are some of critical t-codes.
Below are critical objects
S_TABU_DIS
S_USER_AGR
S_USER_AUT
S_USER_PRO
S_USER_GRP
61. How we Check if the PFCG_TIME_DEPENDENCY is running for user master reconciliations?
Ans:
Execute SM37 and search for PFCG_TIME_DEPENDENCY
62. What is ruleset? and how to update risk id in rule set?
Ans:
Also during indirect asssignment of roles to user using t codes Po13 and po10, we must to do user comparision, so that the roles get reflected in the SU01 record of user.
63. What is the difference between PFCG,PFCG_TIME_DEPENDENCY&PFUD?
Ans:
PFCG is used to create maintain and modify the roles.
PFCG_TIME_DEPENDENCY is a background job of PFUD.
PFUD is used for mass user comparison but the difference is if you set the background job daily basis it will do mass
user comparison automatically
64. What does user compare do?
Ans:
If you are also using the role to generate authorization profiles, then you should note that the generated profile is not entered in the user master record until the user master records have been compared. You can automate this by scheduling report FCG_TIME_DEPENDENCY on.
65. Does s_tabu_dis org level values in a master role gets reflected in the child role?
Ans:
If we do the adjusted derived role in the master role while updating the values in the master role thn values will be reflected in the child roles.
66. What is the T-code to get into RAR from R/3?
Ans:
/virsar/ZVRAT
67. How do I change the name of master / parent role keeping the name of derived/child role same? I would like to keep the name of derived /child role same and the profile associated with the child roles.
Ans:
First copy the master role using PFCG to a role with new name you wish to have. Then you must generate the role. Now open each derived role and delete the menu. Once the menus are removed it will let you put new inheritance. You can put the name of the new master role you created. This will help you keep the same derived role name and the same profile name. Once the new roles are done you can transport it. The transport automatically includes the Parent roles.
68. What is the difference between C (Check) and U (Unmentioned)?
Ans:
Background:
When defining authorizations using Profile Generator, the table USOBX_C defines which authorization checks should occur within a transaction and which authorization checks should be maintained in the PG. aeck Table for Table USOBT_C.
In USOBX_C there are 4 Check Indicators.
CM (Check/Maintain)
-An authority check is carried out against this object.
-The PG creates an authorization for this object and field values are displayed for changing.
-Default values for this authorization can be maintained.
C (Check)
-An authority check is carried out against this object.
-The PG does not create an authorization for this object, so field values are not displayed.
-No default values can be maintained for this authorization.
N (No check)
-The authority check against this object is disabled.
-The PG does not create an authorization for this object, so field values are not displayed.
-No default values can be maintained for this authorization.
U (Unmaintained)
-No check indicator is set.
-An authority check is always carried out against this object.
-The PG does not create an authorization for this object, so field values are not displayed.
-No default values can be maintained for this authorization.
69. Explain the Personalization tab within a role?
Ans:
Personalization is a way to save information that could be common to users, I meant to a user role… E.g. you can create SAP queries and manage authorizations by user groups. Now this information can be stored in the personalization tab of the role. (I supposed that it is a way for SAP to address his ambiguity of its concept of user group and roles: is “usergroup” a grouping of people sharing the same access or is it the role who is the grouping of people sharing the same access)
70. Is there a table for authorizations where I can quickly see the values entered in a group of fields?
Ans:
In particular I am looking to find the field values for P_ORGIN across a number of authorization profiles, without having to drill down on each profile and authorization.
AGR_1251 will give you some reasonable info.
71. How can I do a mass delete of the roles without deleting the new roles?
Ans:
There is a SAP delivered report that you can copy, remove the system type check and run. To do a landscape with delete, enter the roles to be deleted in a transport, run the delete program or manually delete and then release the transport and import them into all clients and systems.
It is called: AGR_DELETE_ALL_ACTIVITY_GROUPS.
To used it, you need to tweak/debug & replace the code as it has a check that ensure it is deleting SAP delivered roles only. Once you get past that little bit, it works well.
72. Someone has deleted users in our system, and I am eager to find out who. Is there a table where this is logged?
Ans:
Debug or use RSUSR100 to find the info’s.
Run transaction SUIM and down its Change documents.
73. How to insert missing authorization?
Ans:
su53 is the best transaction with which we can find the missing authorizations.and we can insert those missing authorization through pfcg
74. What is the difference between role and a profile?
Ans:
Role and profile go hand in hand. Profile is bought in by a role. Role is used as a template, where you can add T-codes, reports..Profile is one which gives the user authorization. When you create a role, a profile is automatically created.
75. What profile versions?
Ans:
Profile versions are nothing but when u modifies a profile parameter through a RZ10 and generates a new profile is created with a different version and it is stored in the database.
76. What is the use of role templates?
Ans:
User role templates are predefined activity groups in SAP consisting of transactions, reports and web addresses.
77. What is the different between single role & composite role?
Ans:
A role is a container that collects the transaction and generates the associated profile. A composite roles is a container which can collect several different roles
78. Is it possible to change role template? How?
Ans:
Yes, we can change a user role template. There are exactly three ways in which we can work with user role templates
1. we can use it as they are delivered in sap
2. we can modify them as per our needs through pfcg
3. we can create them from scratch.
79. What is the difference between USOBX_C and USOBT_C?
Ans:
The table USOBX_C defines which authorization checks are to be performed within a transaction and which not (despite authority-check command programmed ). This table also determines which authorization checks are maintained in the Profile Generator.
The table USOBT_C defines for each transaction and for each authorization object which default values an authorization created from the authorization object should have in the Profile Generator.
80. What authorization are required to create and maintain user master records?
Ans:
The following authorization objects are required to create and maintain user master records:
1. S_USER_GRP: User Master Maintenance: Assign user groups
2. S_USER_PRO: User Master Maintenance: Assign authorization profile
3. S_USER_AUT: User Master Maintenance: Create and maintain authorizations
81. List R/3 User Types
Ans:
1. Dialog users are used for individual user. Check for expired/initial passwords Possible to change your own password. Check for multiple dialog logon
2. A Service user – Only user administrators can change the password. No check for expired/initial passwords. Multiple logon permitted
3. System users are not capable of interaction and are used to perform certain system activities, such as background processing, ALE, Workflow, and so on.
4. A Reference user is, like a System user, a general, non-personally related, user. Additional authorizations can be assigned within the system using a reference user. A reference user for additional rights can be assigned for every user in the Roles tab.
82. What is a derived role?
Ans:
1. Derived roles refer to roles that already exist. The derived roles inherit the menu structure and the functions included (transactions, reports, Web links, and so on) from the role referenced. A role can only inherit menus and functions if no transaction codes have been assigned to it before.
2. The higher-level role passes on its authorizations to the derived role as default values which can be changed afterwards. Organizational level definitions are not passed on. They must be created anew in the inheriting role. User assignments are not passed on either.
3. Derived roles are an elegant way of maintaining roles that do not differ in their functionality (identical menus and identical transactions) but have different characteristics with regard to the organizational level.
83. What is a composite role?
Ans:
1. A composite role is a container which can collect several different roles. For reasons of clarity, it does not make sense and is therefore not allowed to add composite roles to composite roles. Composite roles are also called roles.
2. Composite roles do not contain authorization data. If you want to change the authorizations (that are represented by a composite role), you must maintain the data for each role of the composite role.
3. Creating composite roles makes sense if some of your employees need authorizations from several roles. Instead of adding each user separately to each role required, you can set up a composite role and assign the users to that group.
4. The users assigned to a composite role are automatically assigned to the corresponding (elementary) roles during comparison.
84. What does user compare do?
Ans:
If you are also using the role to generate authorization profiles, then you should note that the generated profile is not entered in the user master record until the user master records have been compared. You can automate this by scheduling report FCG_TIME_DEPENDENCY on.
85. How do I change the name of master / parent role keeping the name of derived/child role same? I would like to keep the name of derived /child role same and also the profile associated with the child roles.
Ans:
First copy the master role using PFCG to a role with new name you wish to have. Then you have to generate the role. Now open each derived role and delete the menu. Once the menus are removed it will let you put new inheritance. You can put the name of the new master role you created. This will help you keep the same derived role name and also the same profile name. Once the new roles are done you can transport it. The transport automatically includes the Parent roles.
86. What is the difference between C (Check) and U (Unmentioned)?
Ans:
Background: When defining authorizations using Profile Generator, the table USOBX_C defines which authorization checks should occur within a transaction and which authorization checks should be maintained in the PG. You determine the authorization checks that can be maintained in the PG using Check Indicators. It is a Check Table for Table USOBT_C.
In USOBX_C there are 4 Check Indicators.
1. CM (Check/Maintain)
-An authority check is carried out against this object.
-The PG creates an authorization for this object and field values are displayed for changing.
-Default values for this authorization can be maintained.
2. C (Check)
-An authority check is carried out against this object.
-The PG does not create an authorization for this object, so field values are not displayed.
-No default values can be maintained for this authorization.
3. N (No check)
-The authority check against this object is disabled.
-The PG does not create an authorization for this object, so field values are not displayed.
-No default values can be maintained for this authorization.
4. U (Unmaintained)
-No check indicator is set.
-An authority check is always carried out against this object.
-The PG does not create an authorization for this object, so field values are not displayed.
-No default values can be maintained for this authorization..
87. What does user compare do?
Ans:
Comparing the user master: This is basically updating profile information into user master record. So that users are allowed to execute the transactions contained in the menu tree of their roles, their user master record must contain the profile for the corresponding roles.
You can start the user compare process from within the Profile Generator (User tab and User compare pushbutton). As a result of the comparison, the profile generated by the Profile Generator is entered into the user master record. Never enter generated profiles directly into the user master record (using transaction SU01, for example)! During the automatic user compare process (with report pfcg_time_dependency, for example), generated profiles are removed from the user masters if they do not belong to the roles that are assigned to the user.
If you assign roles to users for a limited period of time only, you must perform a comparison at the beginning and at the end of the validity period. You are recommended to schedule the background job pfcg_time_dependency in such cases
88. Can wildcards be used in authorizations?
Ans:
Authorization values may contain wildcards; however, the system ignores everything after the wildcard. Therefore, A*B is the same as A*.
89. What does the PFCG_TIME_DEPENDENCY clean up?
Ans:
The ‘PFCG_TIME_DEPENDENCY’ background report only cleans up the profiles (that is, it does not clean up the roles in the system). Alternatively, you may use transaction ‘PFUD’.
90. What happens to change documents when they are transported to the production system?
Ans:
Change documents cannot be displayed in transaction ‘SUIM’ after they are transported to the production system because we do not have the ‘befor input’ method for the transport. This means that if changes are made, the ‘USR10? table is filled with the current values and writes the old values to the ‘USH10? table beforehand. The difference between both tables is then calculated and the value for the change documents is determined as a result. However, this does not work when change documents are transported to the production system. The ‘USR10? table is automatically filled with the current values for the transport and there is no option for filling the ‘USH10? table in advance (for the history) because we do not have a ‘befor input’ method to fill the ‘USH10? table in advance for the transport.
91. What is the difference between the table buffer and the user buffer?
Ans:
The table buffers are in the shared memory. Buffering the tables increases performance when accessing the data records contained in the table. Table buffers and table entries are ignored during startup. A user buffer is a buffer from which the data of a user master record is loaded when the user logs on. The user buffer has different setting options with regard to the ‘auth/new_buffering’ parameter.
92. What does the Profile Generator do?
Ans:
The Profile Generator creates roles. It is important that suitable user roles, and not profiles, are entered manually in transaction ‘SU01?. The system should enter the profiles for this user automatically.
93. How many authorizations fit into a profile?
Ans:
A maximum of 150 authorizations fit into a profile. If the number of authorizations exceeds this marker, the Profile Generator will automatically create more profiles for the role. A profile name consists of twelve (12) characters and the first ten (10) may be changed when generated for the first time.
94. How to create users?
Ans:
Execute transaction SU01 and fill in all the field. When creating a new user, you must enter an initial password for that user on the Logon data tab. All other data is optional. Click here for turotial on creating sap user id.
I’m impressed, I have to admit. Genuinely rarely should i encounter a weblog that’s both educative and entertaining, and let me tell you, you may have hit the nail about the head. Your idea is outstanding; the problem is an element that insufficient persons are speaking intelligently about. I am delighted we came across this during my look for something with this.