ADM940 and ADM945 – Comprehensive Authorization Concepts for SAP S/4HANA and SAP Fiori — Lesson 2: PFCG Role Design, Derived and Composite Roles, Proposals, SU24, Traces, and Troubleshooting

Learning Objectives

• Explain the SAP structures, data, settings, roles, and dependencies governing PFCG role design and proposals.
• Perform and validate SU24 analysis and authorization traces using reviewable system evidence.
• Evaluate the condition where a user can launch a Fiori app but a business action fails because frontend content, backend services, authorization objects, and organizational values are inconsistent and select proportionate corrective action.

Detailed Topics

• PFCG Role Design applied to the course scenario, expected SAP behavior, dependencies, and evidence.
• Derived and Composite Roles applied to the course scenario, expected SAP behavior, dependencies, and evidence.
• Proposals applied to the course scenario, expected SAP behavior, dependencies, and evidence.
• SU24 applied to the course scenario, expected SAP behavior, dependencies, and evidence.
• Traces applied to the course scenario, expected SAP behavior, dependencies, and evidence.
• and Troubleshooting applied to the course scenario, expected SAP behavior, dependencies, and evidence.

Instructor Demonstration

The instructor traces a security team redesigning business roles for SAP S/4HANA and SAP Fiori while preserving segregation, supportability, and audit evidence. The walkthrough connects navigation, configuration or process logic, system messages, and evidence captured in the ADM940 and ADM945 authorization-role design, trace, and governance workbook. It also tests the exception where a user can launch a Fiori app but a business action fails because frontend content, backend services, authorization objects, and organizational values are inconsistent.

Hands-On Exercise

Complete a controlled SAP exercise covering PFCG Role Design, Derived and Composite Roles, Proposals, SU24, Traces, and Troubleshooting and preserve the verified result in the ADM940 and ADM945 authorization-role design, trace, and governance workbook.

1. Confirm scope, prerequisites, master data, roles, dependencies, and acceptance criteria.
2. Execute the workflow while recording settings, transactions, outputs, and system messages.
3. Test normal behavior, one boundary condition, and the stated exception.
4. Document corrections, evidence, ownership, retest criteria, and handover actions.

Scenario Analysis

• Identify which object, rule, setting, or process step most strongly influences PFCG role design and proposals.
• Compare two defensible responses and explain business, technical, control, and support trade-offs.
• Determine how the ADM940 and ADM945 authorization-role design, trace, and governance workbook should be approved, retained, retested, and updated.

Troubleshooting Guidance

Start where expected SAP behavior first differs from the observed result. Check master data, configuration sequence, authorization, integration, status, and transaction evidence separately. Treat “a user can launch a Fiori app but a business action fails because frontend content, backend services, authorization objects, and organizational values are inconsistent” as a hypothesis until system settings, logs, documents, and outcomes confirm the cause.

Validation Checklist

• Required SAP structures, master data, roles, settings, and dependencies are present.
• The ADM940 and ADM945 authorization-role design, trace, and governance workbook connects each conclusion to objective, reviewable evidence.
• Normal processing, the boundary condition, integration behavior, and exception were tested.
• Corrections, ownership, retest criteria, documentation, and operational handover are complete.

Lesson Outcome

Learners can apply PFCG Role Design, Derived and Composite Roles, Proposals, SU24, Traces, and Troubleshooting, explain the resulting SAP behavior, and defend the outcome through the ADM940 and ADM945 authorization-role design, trace, and governance workbook.