This lesson develops controlled execution of User Administration, Role Design, Authorization Concepts, and Segregation of Duties. The work is grounded in a governance and security team establishing consistent risk ownership, access controls, mitigating measures, and auditable compliance practices across an SAP landscape and contributes directly to defensible SAP GRC controls.
Using the scenario, the instructor demonstrates user lifecycle controls, role design principles, authorization objects, segregation-of-duties analysis and highlights object relationships, determination behavior, integration effects, and approval evidence. The demonstration deliberately introduces the exception where a composite role creates toxic access across incompatible business activities.
Complete a controlled activity covering user lifecycle controls, role design principles, authorization objects, segregation-of-duties analysis and preserve the result in access-risk and authorization evidence pack.
Start at the earliest point where expected behavior differs from the observed result. Review process sequence, relevant data, configuration, authorization, integration, and timing as separate hypotheses. Treat “a composite role creates toxic access across incompatible business activities” as unconfirmed until settings, documents, logs, reports, and focused retesting support the cause.
Learners can apply User Administration, Role Design, Authorization Concepts, and Segregation of Duties, explain the resulting SAP behavior, and defend the outcome through access-risk and authorization evidence pack.