SU22 — Maintain SAP Authorization Default Data

display and, in development contexts, maintain SAP-delivered authorization default proposals used by the Profile Generator. The transaction is most valuable when used as part of an evidence chain rather than as a shortcut. Start from the exact business or technical incident, preserve its user, time, system and object context, and distinguish display/analysis functions from actions that can alter system state.

SU22 is typically used when developers or security architects analyze application authorization proposals and distinguish SAP defaults from customer-specific SU24 values. Consultants also use it during project testing and post-change validation because a repeatable selection gives objective evidence. In production, keep the initial scope narrow and widen it only after confirming that the first result matches the reported incident.

These are the most useful anchors for work in SU22. Capture them in incident notes or test evidence so another consultant can reproduce the same result.

Build a reproducible before-and-after proof. Capture the exact selection or object, record the status, log or result that demonstrates the issue, then apply one controlled correction and repeat the same check. Correlate with neighboring SAP logs, documents or repository objects where needed. A successful retry with changed input is not the same as proving the original root cause.

SAP documents SU22 as the delivered/development authorization-default layer and SU24 as the customer-maintained layer, including modern ABAP application types. Availability of a classic transaction does not automatically make it the preferred implementation pattern for new work; distinguish support compatibility from clean-core and cloud-oriented design guidance.

Primary ownership is usually with the SECURITY GRC team. Bring in Basis, Security, functional or development specialists only when the evidence crosses those boundaries. A high-quality escalation includes the exact transaction, selection or object, timestamp, expected result, actual result and checks already completed.

Use ERPClimb's related-object links to move to the neighboring monitor, configuration transaction or business document. Understanding that path is more valuable than memorizing SU22 alone, because most production incidents originate one step before the screen where they are first noticed.