SECURITY_GRCbeginner
SU24
SU24 is the SAP transaction used to maintain authorization defaults (the USOBT/USOBX relationship between transactions and authorization objects) that drive what appears in the PFCG role authorization proposal. Getting SU24 right is foundational to least-privilege role design, controlling authorization object check behavior, and reducing audit findings caused by over-generous or missing authorization proposals across ECC and S/4HANA.
Overview
SU24 is the SAP transaction used to maintain authorization defaults (the USOBT/USOBX relationship between transactions and authorization objects) that drive what appears in the PFCG role authorization proposal. Getting SU24 right is foundational to least-privilege role design, controlling authorization object check behavior, and reducing audit findings caused by over-generous or missing authorization proposals across ECC and S/4HANA.
Lessons in this topic
- SAP SU24 Tutorial (Part 1)Understand the business and technical purpose of SU24, how it links transactions to authorization objects, and why it is the backbone of PFCG role building.
- Maintaining Check Indicators and Role Menu Integration in SU24 (Part 2)Learn how to configure check indicators and default field values in SU24, how these settings flow into PFCG role menus, and how to safely change them without breaking existing roles.
- Maintaining Check Indicators and Default Values in SU24 (Part 3)Learn how to configure check indicators (Check/No Check/Unmaintained/Check with Template) and default field values for authorization objects assigned to a transaction in SU24, and how these settings drive PFCG proposals.
- Enterprise SU24 Governance: Landscape Consistency, Transport Strategy, and S/4HANA/Fiori Migration (Part 4)Design an enterprise-grade governance model for SU24 maintenance that keeps authorization defaults consistent across a multi-system, multi-track landscape, survives S/4HANA and Fiori transitions, and supports auditable, low-risk change management.
- Enterprise SU24 Governance: Mass Maintenance, Custom Transactions, and Cross-Landscape Consistency (Part 5)Explore advanced SU24 governance practices for large landscapes, including mass maintenance approaches, custom transaction onboarding, transport strategy, and keeping SU24 data consistent across ECC, S/4HANA, and multiple system tiers.
Interview questions covered
- What are the core concepts of SU24, and how would you explain them clearly in an SAP interview?
- How would you apply SU24 in a real SAP project? Walk through the design or implementation approach.
- A production issue is reported in SU24. What would you check first, and how would you troubleshoot it systematically?
- What are the most important design decisions, trade-offs, and best practices in SU24?
- Suppose you inherit an existing SU24 solution. How would you review it before making a change?
- Using this SAP project situation — During a green-field S/4HANA implementation, the security team noticed that after building the first wave of finance roles in PFCG, users could execute several sensitive transactions without any authorization restriction on company code — explain What SU24 Is and Why Authorization Defaults Matter. What should happen, which concepts or process steps matter, and what common mistake would you avoid?
- A project encounters this situation while working on Maintaining Check Indicators and Default Values in SU24: A security consultant is remediating a custom Z-transaction that wraps a standard FI posting function module. Walk through how you would analyze the requirement or issue, what you would validate, and how you would test the solution before release.
- Using this SAP project situation — A global manufacturer running a phased S/4HANA rollout across five regional production systems discovered that two regions had diverging authorization behavior for the same custom Fiori app: one region's users could see a supplier list app, the other could not, despite identical PFCG roles — explain Enterprise SU24 Governance: Landscape Consistency, Transport Strategy, and S/4HANA/Fiori Migration. What should happen, which concepts or process steps matter, and what common mistake would you avoid?
- A project encounters this situation while working on Maintaining Check Indicators and Role Menu Integration in SU24: A support team introduced a new Z-transaction for a custom procurement approval workflow. Walk through how you would analyze the requirement or issue, what you would validate, and how you would test the solution before release.
- You are the senior consultant/architect responsible for Enterprise SU24 Governance: Mass Maintenance, Custom Transactions, and Cross-Landscape Consistency. The project situation is: During an S/4HANA conversion project, the security architecture team discovers that hundreds of custom Z-transactions accumulated over 12 years on ECC have inconsistent or missing SU24 entries. How would you assess the design, identify the highest-risk failure modes, and define the evidence required before approving it for production?