Understand SAP roles and authorizations, from a "You are not authorized" refusal to the fix.
Without knowing how to read a role, an SAP refusal is a dead end. 17 short lessons to read the refusal, find the missing authorization and know what to change, in the right order.
A refusal screen shows up, and nobody knows what to fix.
In SAP, two colleagues do not see the same system: their roles decide what they can open and change. Sooner or later, a "You are not authorized" screen lands in front of you, whatever your module.
A refusal that does not say what to do
The message only says you are not authorized. Without knowing how to read the check that failed, you cannot tell which authorization is missing.
A role you cannot find
A system holds a lot of roles. Finding the one that gives the right authorization, without giving much more, takes knowing where to look.
A fix with no record
A role added without anyone knowing who did it, or when. The day something stops working, there is no way to trace it back to its origin.
This micro-training follows one case from start to finish, from the refusal to the fix.
Each tool is shown on screen on the same account, Sandrine's, up to the record of the fix.
Six things you will be able to do on an SAP system.
You do not become a security administrator: you can read a refusal, find the missing authorization and tell the SAP team what to change.
Explain access control
How SAP decides to allow or refuse an action: authorizations come from roles, and a single missing authorization is enough to block access.
Read a user master record
In SU01, you find the roles of an account, their start and end dates, and the validity period of the account itself.
Read a role in PFCG
Name, single or composite role, menu, User tab, authorization objects and their values: you know what a role grants, and to whom.
Analyze a refusal
SU53 shows the last failed check; the authorization trace records more. You note the object, the field and the value that are missing.
Find the role that fixes it
With SUIM, you search for the roles that hold the value, the accounts that have them and the places where a role is used. You keep the narrowest one.
Keep the evidence
Change Documents tell you who changed an account or a role, when, and with which transaction.
We would rather tell you honestly who it is for, and who it is not for.
This is an introductory course, with no programming. Check that it matches what you are looking for before you click.
This micro-training is for you if…
- You are a key user and want to understand why SAP refuses you access, and what to ask for to unblock it.
- You are an SAP consultant, whatever your module, and a user shows you a refusal screen.
- You are part of an SAP team and need to find the role that grants a specific authorization.
- You have never opened PFCG or SU01: the course starts from the concepts of role and authorization.
- You plan to move into SAP administration and security later, and want a first foundation.
This micro-training is not for you if…
- You already administer SAP security day to day: the course lays the foundations and does not go further.
- You want to build your company's complete authorization concept: here, you learn to read a refusal and find the right role, not to design everything.
- You have no access to an SAP system where you hold administration rights: the course shows everything on screen, but no system is provided, and PFCG, SU01 and SUIM require those rights.
- You want a complete SAP path, beyond roles and authorizations: look at the Expert Training Center instead.
Six chapters, seventeen lessons, from the refusal to the fix.
Each lesson opens with a short video. It is followed by an illustrated text (menu paths, step-by-step screens, diagrams, tables) that sums up what matters and flags the traps, then by a three-question quiz.
The goal of this micro-training
Start from a "You are not authorized" screen nobody can read, and end with a role assigned and a record of who changed it. Designing a complete authorization concept is not the goal here.
01 Introduction 2 lessons · 3 min +
02 User management 2 lessons · 13 min +
03 Role maintenance 5 lessons · 32 min +
04 Analyzing an authorization error 2 lessons · 19 min +
05 Solving an authorization error 5 lessons · 43 min +
06 Conclusion 1 lesson · 1 min +
Three simple principles, applied to every lesson.
You watch, then you redo it
The video shows the step on an SAP system. The text below goes over the transactions, screens and values from the video, so you can redo it yourself without scrubbing back.
The traps are written down
An asterisk that opens too many authorizations, a shared role changed to help a single person, a trace left on: each trap is flagged right where you run into it.
You check what you understood
Three questions at the end of each lesson. You know right away whether you can move on, or whether a point is worth another look.
Pierre teaches every lesson.
Pierre Balbinot
SAP consultant certified in PP and EAM · co-founder of Key User Training
Pierre is an engineer by training and an SAP functional consultant, certified in PP and EAM, with MES expertise. He is an SAP project manager at Vossloh, in the rail industry, and has been through several S/4HANA migrations on the client side.
His is the voice in the videos. He opens every transaction on screen, on Sandrine's account.
What our learners say about Key User Training.
A leap forward in my SAP practice
Already an SAP user across several modules for a few years, the Key User Training team really helped me take a leap forward and genuinely moved my SAP practice ahead. The professionalism and availability of the trainers are their main strengths.
Structured, progressive, concrete
Key User trainings take you by the hand. They are structured, progressive and combine theory with practice through demonstrations based on concrete situations encountered every day in companies.
Five trainings, same clear structure
Five trainings already with Key User Training. It is really the same structure whatever the course: theory and practice through concrete situations. The big plus is the responsiveness, the trainers getting back to you on questions or difficulties.
A complete path, to come back to when a refusal shows up.
You go through the course once, end to end, then come back to a tool the day an access refusal shows up.
SAP Roles and Authorizations micro-training
Read an authorization refusal, find the role that fixes it and keep a record of the fix.
Access control, the user master record, roles in PFCG, analyzing a refusal, searching in SUIM and Change Documents, in short lessons you follow at your own pace.
14-day money-back guarantee
If the micro-training isn't right for you, just send us an email within 14 days of buying it. You get a full refund and you don't need to give a reason.
The nine questions to ask yourself before you sign up.
Do I need an SAP system to follow the course?
To watch the lessons, no: everything is shown on screen. To redo the steps, you need an SAP system where you hold administration rights, because PFCG, SU01 and SUIM require them. SU53, on the other hand, is usually available with basic roles. No system comes with the micro-training.
What level do I need?
None in SAP security: the course starts from the concepts of role and authorization. Knowing how to run a transaction in SAP helps you follow the steps. No programming is required.
Is this a course to become a security administrator?
No. It is a good foundation before that specialization, but not training for an experienced administrator. You learn to read a refusal, find the role that fixes it and keep a record of the fix.
How long does it take to finish?
The 17 videos add up to 1 h 50. Plan for more with the texts and the quizzes, and more still if you redo each step on a system. You go at your own pace.
Is the course available in French?
Yes. This page is for the English version: videos in English with English subtitles. The French version has its own page, on the French site.
How long do I have access?
For life. You can come back to a lesson the day you need it. Access covers the course content, not an SAP system.
Can I ask a question while I follow the course?
Yes, by email: just reply to the email that gives you access. This micro-training includes no live session and no one-to-one coaching.
What if the course isn't right for me?
You have a 14-day money-back guarantee, counted from the day you buy. A simple email is enough, no justification required, and we refund you in full.
Can I get an invoice for my company?
Yes. Key User Training is a training company based in Luxembourg. Just email us after you pay and we will send you an invoice in your company's name. If you need a specific reference on it (such as a purchase order number), write to us before you buy.
One refusal, one path to fix it.
The next time SAP says "You are not authorized," you will know where to start. €49, at your own pace.