SAP AS ABAP Administration · Authorization Concept & Roles (PFCG)

A new SAP role grants nothing for a transaction you forgot to include. A junior admin assumes 'no explicit deny means it's allowed.' Why is that wrong, and what does it imply for role design?

Answer locked. Get the free KnowCard app to reveal it — plus spaced-repetition review so it actually sticks.

This is one card from the KnowCard library — thousands more across SAP, Linux, Python and more. In the app you get the answer, AI explanations, and cards that come back right before you would forget them. Free to start on iOS, Android or the web.

More in Authorization Concept & Roles (PFCG)

You created a replacement super user to retire SAP*. Later a regular user administrator tries to modify that account and cannot. Why, and what governs it?

In PFCG settings you can pick simple maintenance, basic maintenance, or complete view. A team wants to assign roles to HR positions instead of named users. Which mode, and what is the precondition?

A junior admin treats the PFCG Menu tab as cosmetic navigation and plans to add every authorization by hand on the Authorizations tab. Why is skipping the menu the wrong move?

You transport a role from DEV and tick the option to include user assignments. The role already exists in PROD with its own assigned users. What happens to them?

An auditor asks 'which users can currently execute transaction SM59, and via which role?' What tool answers this, and what would report RSUSR070 give you instead?

After you build a role's menu in PFCG, the Authorizations tab is already pre-filled with proposed values. Where do those proposals come from, and which transaction changes them globally?

Start learning today

Free to start — download the app or use it in your browser.