If you're looking for SAP GRC Interview Questions & Answers for Experienced & Freshers, you are in the right place. There are a lot of opportunities from many reputed companies in the world. According to research SAP GRC has a market share of about 2.2%. So, You still have the opportunity to move ahead in your career in SAP GRC. Mindmajix offers advanced SAP GRC Interview Questions 2021 that helps you in cracking your interview & acquire a dream career as SAP GRC Developer.
Personalization is a way to save information that could be common to users, I meant to a user role… E.g. you can create SAP queries and manage authorizations by user groups. Now this information can be stored in the personalization tab of the role. (I supposed that it is a way for SAP to address his ambiguity of its concept of user group and roles: is “user group” a grouping of people sharing the same access or is it the role who is the grouping of people sharing the same access)
In particular, I am looking to find the field values for P_ORGIN across a number of authorization profiles, without having to drill down on each profile and authorization.
AGR_1251 will give you some reasonable info.
There is an SAP delivered report that you can copy, remove the system type check and run. To do a landscape with delete, enter the roles to be deleted in a transport, run the delete program or manually delete and then release the transport and import them into all clients and systems.
It is called: AGR_DELETE_ALL_ACTIVITY_GROUPS.
To use it, you need to tweak/debug & replace the code as it has a check that ensures it is deleting SAP delivered roles only. Once you get past that little bit, it works well.
Debug or use RSUSR100 to find the Infos. Run transaction SUIM and down its Change documents.
su53 is the best transaction with which we can find the missing authorizations. and we can insert those missing authorization through pfcq.
Role and profile go hand in hand. The profile is bought in by a role. The role is used as a template, where you can add T-codes, reports. The profile is one that gives the user authorization. When you create a role, a profile is automatically created.
Profile versions are nothing but when u modifies a profile parameter through an RZ10 and generates a new profile is created with a different version and it is stored in the database.
User role templates are predefined activity groups in SAP consisting of transactions, reports, and web addresses.
A role is a container that collects the transaction and generates the associated profile. A composite role is a container that can collect several different roles
Yes, we can change a user role template. There are exactly three ways in which we can work with user role templates
Execute transaction SU01 and fill in all the fields. When creating a new user, you must enter an initial password for that user on the Logon data tab. All other data is optional. Click here for a tutorial on creating a sap user id.
USOBX_C: The table USOBX_C defines which authorization checks are to be performed within a transaction and which not (despite authority-check command programmed ). This table also determines which authorization checks are maintained in the Profile Generator.
USOBT_C: The table USOBT_C defines each transaction and for each authorization object which default values an authorization created from the authorization, the object should have in the Profile Generator.
The following authorization objects are required to create and maintain user master records:
Dialog users are used for individual users. Check for expired/initial passwords Possible to change your own password. Check for multiple dialog logon
If you are also using the role to generate authorization profiles, then you should note that the generated profile is not entered in the user master record until the user master records have been compared. You can automate this by scheduling report FCG_TIME_DEPENDENCY on.
First copy the master role using PFCG to a role with the new name you wish to have. Then you have to generate the role. Now open each derived role and delete the menu. Once the menus are removed it will let you put new inheritance. You can put the name of the new master role you created. This will help you keep the same derived role name and also the same profile name. Once the new roles are done you can transport them. The transport automatically includes the Parent roles.
Background: When defining authorizations using Profile Generator, the table USOBX_C defines which authorization checks should occur within a transaction and which authorization checks should be maintained in the PG. You determine the authorization checks that can be maintained in the PG using Check Indicators. It is a Check Table for Table USOBT_C.
In USOBX_C there are 4 Check Indicators.
1. CM (Check/Maintain)
2. C (Check)
3. N (No check)
4. U (Unmaintained)
Comparing the user master: This is basically updating profile information into the user master record. So that users are allowed to execute the transactions contained in the menu tree of their roles, their user master record must contain the profile for the corresponding roles.
You can start the user compare process from within the Profile Generator (User tab and User compare pushbutton). As a result of the comparison, the profile generated by the Profile Generator is entered into the user master record. Never enter generated profiles directly into the user master record (using transaction SU01, for example)! During the automatic user compare process (with report pfcg_time_dependency, for example), generated profiles are removed from the user masters if they do not belong to the roles that are assigned to the user.
If you assign roles to users for a limited period of time only, you must perform a comparison at the beginning and at the end of the validity period. You are recommended to schedule the background job pfcg_time_dependency in such cases
Authorization values may contain wildcards; however, the system ignores everything after the wildcard. Therefore, A*B is the same as A*.
The ‘PFCG_TIME_DEPENDENCY’ background report only cleans up the profiles (that is, it does not clean up the roles in the system). Alternatively, you may use transaction ‘PFUD’.
Change documents cannot be displayed in transaction ‘SUIM’ after they are transported to the production system because we do not have the ‘before input’ method for the transport. This means that if changes are made, the ‘USR10? the table is filled with the current values and writes the old values to the ‘USH10? table beforehand.
The difference between both tables is then calculated and the value for the change documents is determined as a result. However, this does not work when change documents are transported to the production system.
The ‘USR10? table is automatically filled with the current values for the transport and there is no option for filling the ‘USH10? a table in advance (for the history) because we do not have a ‘before input’ method to fill the ‘USH10? a table in advance for the transport.
The table buffers are in the shared memory. Buffering the tables increases performance when accessing the data records contained in the table. Table buffers and table entries are ignored during startup. A user buffer is a buffer from which the data of a user master record is loaded when the user logs on. The user buffer has different setting options with regard to the ‘auth/new_buffering’ parameter.
The Profile Generator creates roles. It is important that suitable user roles, and not profiles, are entered manually in transaction ‘SU01?. The system should enter the profiles for this user automatically.
A maximum of 150 authorizations fit into a profile. If the number of authorizations exceeds this marker, the Profile Generator will automatically create more profiles for the role. A profile name consists of twelve (12) characters and the first ten (10) may be changed when generated for the first time.
|Explore SAP GRC Sample Resumes! Download & Edit, Get Noticed by Top Employers!|
I am Ruchitha, working as a content writer for MindMajix technologies. My writings focus on the latest technical software, tutorials, and innovations. I am also into research about AI and Neuromarketing. I am a media post-graduate from BCU – Birmingham, UK. Before, my writings focused on business articles on digital marketing and social media. You can connect with me on LinkedIn.