USOBT_C table — Customer Table of SU24 Authorization Default Values

One row in USOBT_C represents a single proposed authorization field value for a specific combination of transaction code and authorization object, as maintained through SU24. When a security consultant runs SU24 against a transaction and decides that field ACTVT should default to activity 03 for object S_TABU_DIS, that decision is written here as a row (or several rows, one per field value range). PFCG reads this table when a transaction is added to a role's menu, using it to prefill the authorization tree with suggested values before the role is generated. USOBT_C is the customer version; USOBT is the SAP-delivered default shipped with the system and untouched by local Customizing. Anything a security team has changed, added or deleted in SU24 lives in USOBT_C, not USOBT.

The table is client-dependent Customizing, so always start with the client and then restrict on TCODE before touching OBJCT, since the same object appears under hundreds of transactions and a scan on OBJCT alone is expensive. Selection by TCODE plus OBJCT is the practical minimum for anything usable. FIELD narrows further when the question is about one specific authorization field such as ACTVT. Do not attempt to read this table to answer what a role currently grants; it only answers what SU24 proposes, which is a different question from what PFCG generated into the role's profile.

Symptom: a transaction was added to a role in PFCG but the expected authorization field never appears with a default value in the authorization tree. Select USOBT_C for TCODE equal to that transaction and OBJCT equal to the object in question. If no row exists, SU24 was never maintained for that combination, which is why nothing was proposed and the object has to be added manually. If a row exists but with an unexpected LOW or HIGH, someone changed the default in SU24 and MODIFIED will show it.

USOBT_C still exists in S/4HANA and the SU24 to PFCG mechanism it supports is unchanged for classic transaction-based roles. There is no CDS compatibility view replacing it; it remains a straightforward Customizing table maintained via SU24 and read by PFCG. For Fiori app authorizations built on catalogs and groups rather than direct transaction codes, this table plays a smaller role, since those objects are typically not driven by classic SU24 tcode checks in the same way, but the table itself has not been deprecated or restructured.

This is squarely a security or authorizations consultant's table, maintained through SU24 during role build or after an upgrade reconciliation step. Functional consultants raising a missing-authorization ticket should describe the transaction, object and expected behavior; deciding what belongs in USOBT_C and generating the affected roles afterward is the security team's task, not something to be patched by a functional or basis team member directly in the table.

USOBX_C carries the check indicator that determines whether an object is checked at all; USOBT is the SAP-delivered counterpart overwritten on upgrade; AGR_1251 holds what actually got generated into a role's authorization profile; AGR_TCODES records which transactions are assigned to which roles and triggers the SU24 read. SU24 is the transaction used to maintain USOBT_C; PFCG is the transaction that reads it when building or merging a role.