SU01 — User Master Maintenance

SU01 is the single-user maintenance transaction for the user master record. It covers logon data (password, validity dates, user type), roles and profiles, parameters, defaults, and personal address data, all stored across several linked tables rather than one flat record. The structural fact that explains most confusion: a role assignment made here is not the same event as authorization becoming active. Assigning a role writes an entry with its own validity window; the actual authorization values only take effect once the role has been generated with the correct organizational levels and the user's buffer has picked up the change. A user record can look perfectly configured on the Roles tab and still fail every authorization check because generation or comparison never ran.

SU01 is reached for one-off requests: onboarding a single new hire, fixing a locked account, correcting a validity date, changing a user type, or checking exactly which roles and profiles a specific person carries right now. For bulk work — resetting passwords for a department, extending validity for a batch of contractors, assigning the same role to fifty users — SU10 is the correct tool; using SU01 repeatedly for that is a sign the wrong transaction was chosen. In S/4HANA landscapes with identity management or a cloud IAS/IPS setup, provisioning may originate outside SAP entirely, with SU01 reduced to a read-only verification step to confirm what actually landed in the system after the upstream process ran.

To confirm a lock or validity issue, pull USR02 by BNAME and check the lock indicator fields and the validity date range against today's date. To confirm a role assignment problem, pull AGR_USERS filtered on the user ID and compare the validity dates and the role name against what SU01's Roles tab displays; a role present in the table with an expired end date will still show on screen but will not authorize. Cross-check USH02 for the same user ID to see the sequence of changes, which quickly separates 'never assigned correctly' from 'assigned correctly, then someone changed it'.

SU01 exists unchanged in S/4HANA and remains the primary transaction for single-user maintenance in on-premise and private cloud systems. A Fiori app for user maintenance exists as a lighter alternative for simple changes, but SU01 is still the fuller tool for validity windows, parameters, and detailed role review. In public cloud or IAS/IPS-integrated landscapes, user creation and role assignment may originate outside the ABAP stack, with SU01 used mainly to verify the result rather than to originate the change.

This is security administration territory, not functional or ABAP. A functional consultant requests access through the standard access-request process rather than editing SU01 directly. A clean handover to security includes the user ID, the exact symptom (locked, missing authorization, wrong roles), the role name and org values expected, and whether the issue reproduces after a fresh logon; escalate to Basis only when the cause traces to a system-wide lock parameter or SSO/certificate configuration.

PFCG is the natural next stop since role content, generation, and organizational values live there, not in SU01. SU10 is the tool for the same maintenance across many users at once and should replace SU01 for anything touching more than a handful of accounts. SUIM answers 'who has this role or authorization' across the whole user base, which is faster than checking users one at a time in SU01. SU56 diagnoses the buffer-not-refreshed symptom directly. SM20 is the place to confirm whether a lock originated from repeated failed logon attempts, since that detail does not always surface cleanly inside SU01 itself.