UST12 table — Classic authorization value ranges table

One row in UST12 is a single value range, a from/to pair or a single value, for one authorization field, inside one specific authorization object, inside one authorization name held in the AUTH field. It belongs to the classic pre-PFCG authorization concept, authorizations built by hand in transaction SU02 or SU03 and bundled into profiles through the older UST0x table family, rather than authorizations generated by the profile generator into AGR_1251. Because an authorization typically carries several fields, and a field can carry several value ranges, one authorization name spans many UST12 rows. The table still exists in every current system for backward compatibility and for any manually maintained authorization objects that were never migrated into a role-based profile.

Always restrict MANDT first, this is a client-dependent table and cross-client selection returns meaningless noise. AUTH by itself is not selective in a system that has accumulated years of custom authorizations, restrict by OBJCT and FIELD when hunting for a specific value such as a company code or plant. In a system built on PFCG from the start the table may be nearly empty, so a non-empty result is itself a finding worth chasing rather than background noise. VON and BIS are stored as text, not numbers, so range logic and sort order follow character comparison rules, not numeric ones, watch for leading zeros.

Symptom: a company code that should have been removed from access is still reachable through an old authorization. Select UST12 where OBJCT equals F_BKPF_BUK and FIELD equals BUKRS, check whether the VON to BIS range still covers the company code in question. Take the AUTH value from the matching row and trace it through UST04 to the profile, then through the user master to confirm who still carries that profile.

The table structure is unchanged and it is still present in S/4HANA, kept for backward compatibility. Practically all current authorization management runs through PFCG and stores its data in the AGR_* table family, so a clean S/4HANA implementation should show UST12 empty or nearly empty. A non-empty table on an S/4HANA system usually indicates either legacy custom authorization objects that were never converted, or artifacts carried over from a system copy of an older landscape. No SAP-delivered compatibility view is known for this table, and current SUIM-style reporting has largely moved to the AGR_* tables instead.

The security or GRC team owns interpretation of this table, specifically whoever still maintains or is cleaning up authorizations built with SU02/SU03. Basis teams rarely have a reason to touch it. Functional and application teams should never edit UST12 directly, any change belongs in the authorization maintenance transactions so the profile and authorization stay consistent.

UST04 holds the profile-level assignment that links a classic authorization to a profile and eventually to a user. USOBX_C and USOBT_C are the check tables against which an object and its default field values can be compared. AGR_1251 is the modern, role-based equivalent for any authorization built through PFCG rather than by hand. Transactions SU02 and SU03 write and maintain classic authorizations directly, PFCG is the transaction that replaced this workflow for new development.