Organization if You Are Using the Profile Generator

If you are using the profile generator and role maintenance, you can distribute the administration tasks within an area (such as a department, cost center, or other organizational unit) to the following administrator types:

· Authorization data administrator, who creates roles (transaction selection and authorization data), selects transactions, and maintains authorization data. However the authorization data administrator can only save data in the Profile Generator, since he or she is not authorized to generate the profile, He or she accepts the default profile name T_.... when doing this.

· Authorization profile administrator, who checks and approves the data, and generates the authorization profile. To do this, he or she choose ® All Roles in transaction SUPC, and then specifies the abbreviation of the role to be edited. On the following screen, he or she checks the data by choosing Display Profile.

· User administrator, who maintains the user data with the user maintenance transaction (SU01) and assigns roles to the users. This enters the approved profiles in the master records of the users.

These administrators of one or more areas are administered by superusers who set up their user master records, profiles, and authorizations. We recommend that you assign the superuser, the user administrator, and the authorization administrator the SUPER group. If you are using predefined user maintenance authorizations, this group assignment ensures that user administrators cannot change their own user master records or those of other administrators. Only administrators with the predefined profile S_A.SYSTEM can maintain users of the group SUPER.

The table in the section Setting Up Administrators shows the tasks that you should assign to individual administrators, tasks that you should not assign, and the templates that we have predefined for these tasks.

No authorization profile beginning with “T” may contain critical (S_USER* objects) authorization objects.