Big4Guy

Managing user access is critical in any IT environment. Companyies which have implemented SAP need to be aware of risks which inappropriate user access poses. Authorization objects like SAP_ALL which provide users with increased access should be removed. Similarly, IT personnel should never be allowed access to the production environment where they can change or delete business data. Though the profile generator is an excellent way of granting access, it should be complimented with periodic reviews of user access, and segregation of duties.

SAP comes with lots of pre-delivered roles however, these shipped roles do not in may cases meet the SOD requirements in wake of laws like the sarbanes oxley. One of the best ways for SAP user access management is to create strong processes for adding, changing and deleting users. This process should include communication of user access changes to HR also. User validity should be restricted by configuring validity periods. All said and done, one should keep the principal of least privileged and "need to know-do" while granting users' access.

Related Posts

SAP R/3 Inherent Controls
SAP R/3 Configurable Controls
Securing SAP* User ID
SAP IMG Implementation Guide