sap standard authorization roles of personnel management

8/11/2019 SAP Standard Authorization Roles of Personnel Management

1/3

AuthorizationsPersonnel Managementuses the authorization provided by SAP Web Application Server.Therefore, therecommendations and guidelines for authorizations as described in the SAP Web AS Security Guide

ABAPand SAP Web AS Security Guide Javaalso apply to Personnel Management.The SAP Web Application Serverauthorization concept is based on assigning authorizations to usersbased on roles. For role maintenance, use the profile generator (transaction PFCG) on SAP Web ASABAP and the User Management Enginesuser management console for SAP Web AS Java.

Standard RolesThe following table shows the standard roles that are used by Personnel Management.

Standard Roles

Function Description

SAP_HR_BN* Roles assigned to component PA-BN(Benefits)

SAP_HR_CM* Roles assigned to component PA-CM(Compensation Management)

SAP_HR_CP* Roles assigned to component PA-CM-CP(Personnel Cost Planning)

SAP_ESSUSER_ERP05 Role with all non country-specific functionsforEmployee Self-Service.

For more information, see the Security Guide

for Self-Services.

SAP_EMPLOYEE_ERP05_xx Roles related to the Employee Self-Servicecountry versions

SAP_HR_OS* Roles assigned to component PA-OS(Organizational Management)

SAP_HR_PA_xx_* Roles related to international and countryversions of the component PA-PA (PersonnelAdministration)

SAP_HR_PA_XF* Roles assigned to the component CA-GTF-XF(SAP Expert Finder)

SAP_HR_PA_PF_xx_* Roles assigned to component PA-PF (PensionFund)

SAP_HR_PD* Roles assigned to component PA-PD(Personnel Development)

SAP_HR_RC* Roles assigned to component PA-RC(Recruitment)

SAP_HR_REPORTING Role for Human Resources Analyst
http://help.sap.com/saphelp_afs64/helpdata/en/38/cb9241471fae5fe10000000a1550b0/frameset.htmhttp://help.sap.com/saphelp_afs64/helpdata/en/38/cb9241471fae5fe10000000a1550b0/frameset.htmhttp://help.sap.com/saphelp_afs64/helpdata/en/38/cb9241471fae5fe10000000a1550b0/frameset.htmhttp://help.sap.com/saphelp_afs64/helpdata/en/38/cb9241471fae5fe10000000a1550b0/frameset.htmhttp://help.sap.com/saphelp_afs64/helpdata/en/7b/6f92413c3a2e7be10000000a1550b0/frameset.htmhttp://help.sap.com/saphelp_afs64/helpdata/en/38/cb9241471fae5fe10000000a1550b0/frameset.htmhttp://help.sap.com/saphelp_afs64/helpdata/en/7b/6f92413c3a2e7be10000000a1550b0/frameset.htmhttp://help.sap.com/saphelp_afs64/helpdata/en/38/cb9241471fae5fe10000000a1550b0/frameset.htm


2/3

SAP_AUDITOR_TAX_HR This role is relevant for Germany only.

Role HR-DE Steuerprfung 147 AO(Muster)assigned to the component PA-PA-DE (Personnel Administration Germany).

SAP_ASR_EMPLOYEE Enhancement of the role

SAP_ESSUSER_ERP05 for the employeesthat use the functions of the component PA-AS(HR Administrative Services)

SAP_ASR_MANAGER Enhancement of the roleSAP_ESSUSER_ERP05 with functions for thepersons with personnel responsibility that usethe functions of the component PA-AS (HRAdministrative Services)

SAP_ASR_ADMINISTRATOR Enhancement of the role SAP_HR_PA_xx_* forthe HR administrators that use the functions ofthe component PA-AS (HR AdministrativeServices)

For the roles marked with an asterisk (*), several roles exist for each of the components. For roles withxx, where xx represents the SAP country key, various roles exist for each of the country versions.

Standard Authorization ObjectsThe following table shows the most important central security-relevant authorization objects usedby Personnel Management.

For more information about Personnel Management authorizations, see SAP Library

under ERP Central ComponentHuman ResourcesPersonnel

ManagementPersonnel AdministrationTechnical Processes in Personnel

Administration Authorizations for Human Resources.

Most Important Standard Authorization Objects

Authorization Object Field Value Description

P_ORGIN HR Master Data Used when checkingauthorizations for HR infotypes.The check takes place when HRinfotypes are edited or read.

P_ORGINCON HR Master Data withContext

This authorization object consistsof the same fields as theauthorization object P_ORGIN,and also includes the field PROFL(structural profile). The check for

this object means that user-specificcontexts can be included in the HRmaster data.

P_ORGXX HR Master DataExtended Check

With this object you can determinewhether other fields are also to bechecked. You can determinewhether this check is to beperformed in addition to or insteadof the HR Master
http://help.sap.com/saphelp_afs64/helpdata/en/97/27973b3ea3eb0fe10000000a114084/frameset.htmhttp://help.sap.com/saphelp_afs64/helpdata/en/97/27973b3ea3eb0fe10000000a114084/frameset.htmhttp://help.sap.com/saphelp_afs64/helpdata/en/97/27973b3ea3eb0fe10000000a114084/frameset.htmhttp://help.sap.com/saphelp_afs64/helpdata/en/97/27973b3ea3eb0fe10000000a114084/frameset.htmhttp://help.sap.com/saphelp_afs64/helpdata/en/97/27973b3ea3eb0fe10000000a114084/frameset.htmhttp://help.sap.com/saphelp_afs64/helpdata/en/97/27973b3ea3eb0fe10000000a114084/frameset.htm


3/3

Dataauthorization check.

P_P_ORGXXCON HR Master DataExtended Check withContext

This authorization object consistsof the same fields as theauthorization object P_ORGXX,and also includes the field PROFL(structural profile). The check for

this object means that user-specificcontexts can be included in the HRmaster data.

P_TCODE HR: Transaction Code This authorization object checkscertain specific transactions in SAPHuman Resources Management.

PLOG Personnel Planning Used to indicate the types ofinformation processing a user isauthorized to perform.

PLOG_CON Personnel Planningwith Context

This authorization object consistsof the same fields as the object

PLOG, and also includes the fieldPROFL (structural profile). Thecheck for this object means thatuser-specific contexts can beincluded in the HR master data.

P_ASRCONT Authorization forProcess Content

The Authorization for ProcessContent object is used by theauthorization check for HRAdministrative Services. It checksthe authorization for access tovarious process contents and alsoruns through the authorizationobjects that you have specified in

Customizing in T77S0 (see notebelow). For more information,

see Authorization Concept ofHCM Processes and Forms.

In Customizing, you can determine whether specific authorization objects are to be checked.All central switches and settings for the Human Resourcesauthorization check are

summarized in table T77S0 in the Group for semantic short text for PD PlanAUTSW. Note

that changes to the settings severely affect your authorization concept.

For more information about changing the main authorization switch, see the Implementation

Guide (IMG) for Personnel Administrationunder Tools Authorization Management.
http://help.sap.com/saphelp_afs64/helpdata/en/43/3d8f8118391bcbe10000000a1553f7/frameset.htmhttp://help.sap.com/saphelp_afs64/helpdata/en/43/3d8f8118391bcbe10000000a1553f7/frameset.htmhttp://help.sap.com/saphelp_afs64/helpdata/en/43/3d8f8118391bcbe10000000a1553f7/frameset.htmhttp://help.sap.com/saphelp_afs64/helpdata/en/43/3d8f8118391bcbe10000000a1553f7/frameset.htmhttp://help.sap.com/saphelp_afs64/helpdata/en/43/3d8f8118391bcbe10000000a1553f7/frameset.htmhttp://help.sap.com/saphelp_afs64/helpdata/en/43/3d8f8118391bcbe10000000a1553f7/frameset.htmhttp://help.sap.com/saphelp_afs64/helpdata/en/43/3d8f8118391bcbe10000000a1553f7/frameset.htmhttp://help.sap.com/saphelp_afs64/helpdata/en/43/3d8f8118391bcbe10000000a1553f7/frameset.htm

sap standard authorization roles of personnel management

Documents