Manage roles

Role assignments grant access. Check the selected accounts, role names, clients and validity dates before confirming a change.

Inspect current assignments

Use Roles → Role Assignment to compare selected users’ roles, read assignment dates and export the account-and-role list. View users’ role assignments explains the report columns, composite indicators and incomplete results.

Assign roles from the Global Role Table

Use Assign in the Global Role Table after selecting destination accounts and role rows. Assign roles from the Global Role Table explains client matching, validity dates, overwrite, results and stopping.

Add and remove assignments together

Use Roles → Update Role Assignment to add and remove roles for selected users across clients. Update role assignments explains common and client-specific changes, row actions, dates, clipboard input, results and stopping.

Remove expired assignments

Use Roles → Expired Roles to search clients for assignments ending before today or by a selected date. Find and remove expired role assignments explains the criteria, organizational assignments, whole-role removal, results and stopping.

Copy role assignments

Use the right-click Copy Roles from user and Paste Roles commands when existing accounts need another user’s roles. Copy role assignments between users explains destination selection, role filtering, validity dates, overwrite, source definitions and results.

To copy definitions without assigning roles to users, follow Copy roles between clients.

Use the Global Role Table

See Global Role Table: menu and tasks for Where Used, Assign and Export, and Search role content to find roles by authorizations or transactions.

The Global Role Table lists roles from connected clients. Filter its columns to narrow the selection.

• Where Used identifies users assigned to the selected roles. Check the returned system/client rows, including clients with no matching users. Export the report when needed.
• Assign applies the selected roles to the intended users in the Global User Table.
• PFCG opens the selected roles in separate SAP GUI windows. Double-click a role to open that role alone. See Open roles in PFCG for prerequisites, confirmation and the window limit.
• Export saves the current role view in an offered format for further analysis.

Before Assign, check both tables: the selected roles in the role table and the selected target users in the user table. Review client-specific results after the operation.

Check a failed assignment

Confirm that the role exists in the target client, that its validity dates are appropriate and that your SAP account is authorized to maintain assignments. Read the returned message before retrying. Repeating the whole selection can obscure which assignments already succeeded.