Users, Roles & Authorizations

You assigned the Fiori app's front-end role and the user can launch the app, but every data action errors out. What role did you forget, and on which server do you assign it?

A user can open an analytical Fiori app but the KPI tiles show no data. The ABAP roles are all assigned. Where else must the app-specific role be granted, and to which user?

Which two ABAP transactions manage Fiori users and roles, and what does each do?

A Fiori user logged in fine but can't open one specific app. A colleague claims 'if login worked, access worked.' Why is that wrong?

The delivered transactional-app roles are assigned and the app opens, but users still can't work with the business data. The roles look intact. What's actually missing, and whose job is it to fix?

You activated a fresh OData service and want to add its start authorization to a role, but the service won't show up to be selected. What skipped step causes this?

Can you assign a delivered standard business role like SAP_SD_BCR_FIELDSALESREP_X1 directly to users? And if it technically works, why do real projects copy it first anyway?

You're adding an OData start authorization to a copied PFCG role. Walk the sequence — and which two values must you set so the service is recognized?

SAP delivers two role sets per Fiori app. Name both, what each grants, and what specifically fails if you assign only one.

What is the first step when building front-end roles from SAP's delivered templates, and which copy option do you pick?

Why are OData service start authorizations entered as 'TADIR services' (R3TR / IWSG) in PFCG rather than as a normal transaction-style authorization?

Fact sheet apps fail on search even though their OData start authorizations are assigned. Which extra authorization object distinguishes their auth setup from a normal transactional app?

A user sees an app's tile in the launchpad but the app fails to start. Which authorization layer is missing — and why does the visible tile mislead you here?

With all three classic Fiori app types in use, in which systems must each user exist — and what's the easy-to-miss requirement plus the tools that keep them in sync?

An admin activated an app but it doesn't appear in any user's launchpad. They assume more activation is needed. What actually drives whether a user sees the tile?

You see a delivered role named SAP_SD_BCR_FIELDSALESREP_X1. What does the BCR token tell you about its scope, and how does that change how you assign it?