SAP BASIS and Security Administration
An Article From thespot4sap LTD

Contents
1.0 Introduction...............................................................................................................2 2.0 SAP Security Components – The Big Picture ............................................................2 2.1 SAP Authorization Concept...................................................................................3 2.2 Composite Profiles ................................................................................................4 2.3 User Ids.................................................................................................................4 2.4 Authorizations …ver más…

Figure 2 illustrates the hierarchical authorization concept in SAP.

Figure 2 © www.thespot4sap.com Page 3 of 9 independent.current.research

2.2 Composite Profiles Composite profiles refer to the various employee roles available in the corporation (for instance: Purchasing / Receiving Clerk or Accounts Agent). As the name suggests, composite profiles may contain multiple user IDs necessary to perform all the business operations associated with a particular role. A composite profile may encapsulate another composite profile(s). In practice, a model composite profile should be recognized for each possible role in the organization, which may be used to produce hybrid composite profiles. The overexistence of the hybrids can defy the very purpose of composite profiles and they should be created only when specific needs arise. 2.3 User Ids User ids allow access to SAP applications. Each user must have a corresponding profile specifically assigned. In many situations, multiple composite profiles can be assigned to a user ID, depending on the role(s) an individual user is responsible for, in the business processes. 2.4 Authorizations Authorizations are the key building blocks of SAP security. Authorization is the process of assigning values to fields present in authorization objects. In SAP, access to all system functionality is achieved through a complex array of authorizations. Sometimes users find that they