ADM940 Authorization Concept for SAP S/4HANA and SAP Business Suite — Lesson 2: PFCG Roles, Organizational Levels, Derived Roles, Composite Roles, and Menus

Learning Objectives

• Explain the SAP structures, data, settings, roles, and dependencies governing PFCG role design.
• Perform and validate organizational and derived-role controls using reviewable system evidence.
• Evaluate the condition where a user receives excessive access after an organizational restriction is omitted from a derived role and select proportionate corrective action.

Detailed Topics

• PFCG Roles applied to the course scenario, expected SAP behavior, dependencies, and evidence.
• Organizational Levels applied to the course scenario, expected SAP behavior, dependencies, and evidence.
• Derived Roles applied to the course scenario, expected SAP behavior, dependencies, and evidence.
• Composite Roles applied to the course scenario, expected SAP behavior, dependencies, and evidence.
• and Menus applied to the course scenario, expected SAP behavior, dependencies, and evidence.

Instructor Demonstration

The instructor traces a security administration team redesigning roles to support least privilege and dependable business operations. The walkthrough connects navigation, configuration or process logic, system messages, and evidence captured in the authorization role, trace, and remediation evidence pack. It also tests the exception where a user receives excessive access after an organizational restriction is omitted from a derived role.

Hands-On Exercise

Complete a controlled SAP exercise covering PFCG Roles, Organizational Levels, Derived Roles, Composite Roles, and Menus and preserve the verified result in the authorization role, trace, and remediation evidence pack.

1. Confirm scope, prerequisites, master data, roles, dependencies, and acceptance criteria.
2. Execute the workflow while recording settings, transactions, outputs, and system messages.
3. Test normal behavior, one boundary condition, and the stated exception.
4. Document corrections, evidence, ownership, retest criteria, and handover actions.

Scenario Analysis

• Identify which object, rule, setting, or process step most strongly influences PFCG role design.
• Compare two defensible responses and explain business, technical, control, and support trade-offs.
• Determine how the authorization role, trace, and remediation evidence pack should be approved, retained, retested, and updated.

Troubleshooting Guidance

Start where expected SAP behavior first differs from the observed result. Check master data, configuration sequence, authorization, integration, status, and transaction evidence separately. Treat “a user receives excessive access after an organizational restriction is omitted from a derived role” as a hypothesis until system settings, logs, documents, and outcomes confirm the cause.

Validation Checklist

• Required SAP structures, master data, roles, settings, and dependencies are present.
• The authorization role, trace, and remediation evidence pack connects each conclusion to objective, reviewable evidence.
• Normal processing, the boundary condition, integration behavior, and exception were tested.
• Corrections, ownership, retest criteria, documentation, and operational handover are complete.

Lesson Outcome

Learners can apply PFCG Roles, Organizational Levels, Derived Roles, Composite Roles, and Menus, explain the resulting SAP behavior, and defend the outcome through the authorization role, trace, and remediation evidence pack.