Derived Role Creation

Derived role helps you to inherit menu structures from existing role to new role and it will be helpful to teams who are performing similar task but they differ with plant code.

Derived role inherits structures, menu, transaction, reports, etc.. from an existing role except org values, so you no need to do designing a role from the scratch.

Here we will see how to create a derived role step by step.

1. Go to PFCG/profile generator transaction and enter a new role which you would like to create it from an existing role and enter short description of the role as well as detailed description of the role in “Desciription” tab

2. Here I have a role called “ZTEST_ROLE2” which is having basis authorization

3. Enter the parent/master role name in the box “Derive from Role”  bottom of description tab or top right corner of description tab

4. Hit enter once you have given parent role name and it will ask you to confirm for deriving role structure from existing role and click continue in the screen

5. Click save and you can see “Menu” tab changed to green color and go to “Authorization” tab and click hand icon to create new profile name and click save button

6. Now click “Change Authorization Data” button and it will ask to maintain Org values

7. Once you have done maintaining org values click red color circle button to generate profile like below and click continue

8. Now we have done everything in child role and that’s it our derived role is ready for use

9. When there is a need for additional authorization required to add in parent role, you have to insert the same authorization to corresponding child role too and this can be achieved by clicking two down arrows in authorization menu next to profile generate button

10. By simply clicking insert button in the parent/master all new authorizations will be pushed to corresponding child roles like below screen

That’s it you have done creating derived role from an existing roles.

Give your comments whether this document is useful to you.

Click here for Single role creation

Click here for Composite role creation 

Please share if you like this post:)

SAP Composite Role Creation

Composite role is collection of single roles in simple words its like a container which is having collection of single roles

You will allowed to add a composite role within a composite role, so you can able to add single roles into composite roles only, it doesn’t have authorizations tab in the role menu in PFCG like other single roles but you will have Role tab instead.

Composite role gives you greater flexibility to hold number of roles can be added to one role and assigned to N number of users instead adding them individual.

Example there is a team which performing PO create/approve activities in that case as a basis security administrator need to design a role which will enable them to fulfill their daily jobs and all the roles created for particular responsibility can be combined into a single composite role.

Composite enable the users to have advantages of all single roles authorizations in their user master record.

Here we will see how to create a composite role

  1. Goto tcode PFCG and enter a role name for composite role and we have following 2 single role which we used it for creating composite role.

ZTEST_ROLE

ZTEST_ROLE2

2. Now click “Create Compo.role” button as highlighted in the above screen and give short description about your roles in the “Description” text box

Then you need to enter detailed description why this role is created and who created it and what are the authorization it has, so future administrators can able to understand about need of this role

3. Save the role and goto “Roles” tab to add single roles like shown in the below screen

4. Click save and finish composite role creation and that’s it you have done it.

Now you just need to assign this role to required user to test and move it to quality system

Click here to Single role creation

Step by Step Single Role Creation in SAP

1. Goto tcode PFCG and enter your role name as per your company naming convention and  click single role button along with short description

2. Enter detailed description for role in the description tab like below and save it

3. It should have details like who created and when its created and what are the authorizations are available in the role, so it will give clear idea about role purpose and it can be easily understandable by new security consultant

4. Goto Menu tab and enter the tcode which you need by clicking Transaction button

5. Click “Assign Transactions” button and now your Menu tab status will turn to green color

6. Now goto Authorizations tab and click Hand icon to create profile name automatically along with description

7. Now save the changes and click “Change authorization Data” option to get authorization mapping screen like below where you can add/maintain authorization objects/tcode/company codes etc.

8. Now click the circular button to generate the profile

9. Now your Authorizations tab status will turn to green color

10. Now we have successfully created a role and now assign the role to required users, once you assigned the role to users and “Users” Tab status will turn to green color

Do user master comparison if the status light is yellow color and will turn to green color

Hope this will be helpful for you.