Audit

Which user performs an action?

Every request userXpress sends to SAP runs under the SAP user authenticated for that connection. With SNC single sign-on, this is the SAP user mapped to the sign-on identity. SAP records that account as the actor for changes that generate change documents.

Use each administrator’s own SAP account so that changes can be attributed to that person. If several people use the same SAP account, the SAP user name alone cannot distinguish them.

The Windows account and local userXpress passphrase do not replace the SAP identity in these records.

Find changes to users

1. Open SU01 in the SAP system and client where the change was made.
2. Choose Information → Change Documents for Users.
3. Enter the affected user and the relevant date/time range. To investigate one administrator’s work, also restrict the selection to that administrator’s SAP user where the selection screen offers it.
4. Execute the selection and open the relevant change documents. Compare the recorded actor, time and changed fields with the operation you are investigating.

User change documents can include account attributes, validity, user-group and assignment changes. Password-related changes can be recorded, but the password itself is not a readable audit value.

Available selections and document detail depend on the SAP release. See SAP’s SU01 documentation.

Find changes to roles

1. Open PFCG in the SAP system and client where the role is maintained.
2. Enter the role name, then choose Environment → Display Changes.
3. Restrict the selection by role, date and changed-by user as needed. Select the change-document categories relevant to the investigation and execute the selection.
4. Open the matching documents to inspect the recorded changes. Role content changes and user-assignment changes answer different questions. Include both categories when investigating a change in a user’s access.

The menu is described in SAP’s role administration reference.

SAP also provides the role change-document report through SUIM → Change Documents → For Roles. See Displaying Change Documents for Roles.

What these records establish

For logons, failed authorization checks or other security events, use your organization’s SAP security logging and tracing procedures.

If an expected change is absent, first confirm the SAP system, client, affected user or role, date range and connection account. Check the userXpress operation result to establish whether SAP accepted the change.

For an authorization failure, follow Diagnose a SAP authorization failure. Local application logs can help correlate an error, but do not replace SAP’s change documents or your SAP audit-retention policy.