SU24 Archives

A Methodology for Managing Custom Developments in a Compliance Landscape

New custom developments are present in most SAP implementations. Sometimes they are small modifications or enhancements and sometimes they are more significant. It’s important to ensure that the custom developments are compliant with your security requisites and policy. It is essential to understand from a security and compliance point of view the roles and responsibilities...…
How to Detect BPC Risk in SAP Access Control

Discover how to detect cross-system risk between SAP ERP and SAP Business Planning and Consolidation (BPC). See how BPC task profiles map to business functions and understand how to create cross-system connector groups and assign appropriate connectors to that group. Key Concept Cross-system groups logically define what connectors are involved in cross-system risk analysis. Task...…
Update the SAP BusinessObjects Access Control Rule Set with Custom Transactions

Most of the custom transactions in an SAP system have to be manually added to the SAP BusinessObjects Access Control rule set. Therefore, the SAP implementation team must have a full understanding of the functionality of the custom transaction and how to identify the proper location to add the custom transaction. Follow these guidelines for...…
SAP Fiori Authorizations

SAP Fiori 3.0 replaces traditional user interfaces offered by SAP such as SAP GUI. With the upgraded interface, SAP provides applications using cards (formerly called tiles) that contain different business tasks. To access these applications end users must have the proper authorizations. This SAP Expert article written by a security and GRC professional explains how…
SAP Fiori Authorizations

The third generation of SAP Fiori is an exciting new user experience that becomes significantly more important when moving to SAP S/4HANA or SAP’s new cloud solutions. Find out more in our expert blogpost.
Use Authorization Trace to Track Checked Authorization Objects

The authorization trace feature in transaction ST01 can help you trace all authorization objects being checked at different levels. See an example showing how to use it and how it affects compliance issues in your system. Key Concept An authorization object is the key component in the SAP security process. Each authorization object defines what...…
Get Your System Clean with Risk Analysis and Remediation

Become and stay Sarbanes-Oxley compliant with Risk Analysis and Remediation. Learn about its main features, technical architecture, and setup. Key Concept SAP GRC Access Control delivers controls that identify and prevent access and authorization risks in cross-enterprise systems. The controls prevent fraud and reduce the cost of continuous compliance and control. SAP GRC Access Control...…
The Impact of SAP S/4HANA On-Premise Migration on SAP Roles and Authorizations

With the SAP-imposed deadline of 2027 looming for migrating to SAP S/4HANA, many of SAP’s customers are currently considering migrating their legacy ERP system to SAP S/4HANA. Resilient security is essential when moving forward with new technologies, and SAP software is no exception. SAP has made significant changes to the business suite’s data model in…
- SAP Identity Management
Efficient Optimization for License Management with Xiting

Reading time: 2 mins

SAP S/4HANA has transformed license management from transaction-based to user-determined permissions, complicating the process with new metrics and compliance needs, which necessitates continuous tracking and a clear authorization strategy, potentially aided by Xiting’s Authorizations Management Suite (XAMS) that offers tools like the Role Profiler and Role Designer for efficient license management.
Steps to Safely Define and Customize Business Roles and Authorizations in SAP CRM

See how to define a business role in customizing, assign it to a position in an organizational model, and then analyze its content. Key Concept Business roles and authorizations are prerequisites for SAP CRM upgrades or cutovers. This means that during the user acceptance test, users should test each business scenario using appropriate profiles and...…