---
title: Is creating users by copying wrong?
description: "Is creating users by copying wrong? What are some ways to create the users? But then is going by copy wrong?

#AgleaSAPSEcurity"
image: https://www.aglea.com/hubfs/Aglea/Imported_Blog_Media/Copia%20utenti-Jun-14-2024-10-12-05-1924-AM.jpg
---

[linkedin](https://www.linkedin.com/company/292350?trk=vsrp_companies_res_name&trkInfo=VSRPsearchId%3A3373431891426179412478%2CVSRPtargetId%3A292350%2CVSRPcmpt%3Aprimary) [YouTube](https://www.youtube.com/c/AgleaSAPSecurity?sub_confirmation=1) [Twitter](https://twitter.com/AgleaItaly?lang=en)

[![Logo-Aglea-horsa-company](https://www.aglea.com/hubfs/Aglea/Aglea_November2018%20Theme/Images/Logo-Aglea-horsa-company.webp) ](https://www.aglea.com/en)

# Is creating users by copying wrong?

# Is creating users by copying wrong?

Posted by [Klea Duro](https://www.aglea.com/en/blog/author/klea-duro) on May 12, 2023 12:00:00 AM

- [Tweet](https://twitter.com/share)

How many times have we heard in the company when creating a new user, "give me a colleague as a reference," that is, in the process of defining a new user, we reason more by copy than by corporate trade.

![Copia utenti](https://www.aglea.com/hs-fs/hubfs/Aglea/Imported_Blog_Media/Copia%20utenti-Jun-14-2024-10-12-05-1924-AM.jpg?width=410&name=Copia%20utenti-Jun-14-2024-10-12-05-1924-AM.jpg)

 

But is this approach correct? Or does it present some possible problems?

 

## What are some ways to create the users?

There are several options here as well.

 

- Creating from scratch a user in its own system or in the n systems where it must be defined. Beware, it is one thing to create the user's master data another to know what entitlements to assign (in the case of SAP roles usually)
- Using a corporate identity management system
- Getting a reference of a colleague and going by copy, precisely
- Others less structured scenarios

 

Each of these has pros and cons. But today let's talk about user copying. It is always considered a "bad practice" because in the long run it leads to layering of entitlements and a loss of control of the system. But is this really the case?

 

## But then is going by copy wrong?

In identity management tools or in the SAP GRC Access Control system, there are specific starting features for creating a request based precisely on the user copy from.

 

Is it wrong? No. I find it absolutely useful and correct. If I have a new colleague from my own unit why couldn't I have to say, let's copy it from XY...

 

When in my opinion can this practice lead to a critical path start, and thus take a model "off the rails"? When, for example, you apply it and:

 

- **you do not have a process for **periodic user** re-validation** (e.g., User Access Review)
- **you do not have a process for approving roles **assigned to users

 

This last aspect is particularly important because while starting with user copy in these cases, where the role approval process is active, the user copy function is only a simplification in the construction of the request.

 

Once the user copy request is started, if the starting user has assigned five roles, they must be approved by the respective approver(s) in the new request.

 

This ensures or should limit the proliferation of role-by-copy assignments. And it is precisely this aspect that makes the difference. If I copy by default without asking myself any questions I may end up in a "dangerous" path, if I copy with control systems active, it may be entirely legitimate and even convenient!

 

 

Topics: [User Access Management](https://www.aglea.com/blog/tag/user-access-management), [userid](https://www.aglea.com/blog/tag/userid), [authorization concept](https://www.aglea.com/blog/tag/authorization-concept)

### Subscribe Here!

### Blog Aglea, cosa puoi trovare?

Ogni mercoledì pubblichiamo articoli, interviste e documenti relativi alla security SAP.

Cosa puoi trovare:

- Suggerimenti su come mettere in sicurezza i sistemi SAP
- Come fare a … (How To)
- Checklist
- Gli errori comuni che spesso vengono fatti in ambito Security SAP
- Interviste con esperti del settore
- Chi è AGLEA quale è la nostra vision security SAP

### Recent Posts

### Post By Topic

- [SAP Security (12)](https://www.aglea.com/en/blog/tag/sap-security)
- [SAP GRC (11)](https://www.aglea.com/en/blog/tag/sap-grc)
- [pfcg (8)](https://www.aglea.com/en/blog/tag/pfcg)
- [gdpr (7)](https://www.aglea.com/en/blog/tag/gdpr)
- [SAP GDPR (5)](https://www.aglea.com/en/blog/tag/sap-gdpr)
- [Segregation of duties (5)](https://www.aglea.com/en/blog/tag/segregation-of-duties)
- [governance (5)](https://www.aglea.com/en/blog/tag/governance)
- [sod (5)](https://www.aglea.com/en/blog/tag/sod)
- [SAP ECC (4)](https://www.aglea.com/en/blog/tag/sap-ecc)
- [audit sap (4)](https://www.aglea.com/en/blog/tag/audit-sap)
- [auditing (4)](https://www.aglea.com/en/blog/tag/auditing)
- [sap consulenza security (4)](https://www.aglea.com/en/blog/tag/sap-consulenza-security)
- [sap password (4)](https://www.aglea.com/en/blog/tag/sap-password)
- [HANA (3)](https://www.aglea.com/en/blog/tag/hana)
- [SAP HR (3)](https://www.aglea.com/en/blog/tag/sap-hr)
- [UI logging (3)](https://www.aglea.com/en/blog/tag/ui-logging)
- [rfc security (3)](https://www.aglea.com/en/blog/tag/rfc-security)
- [sap cyber security (3)](https://www.aglea.com/en/blog/tag/sap-cyber-security)
- [sap hana (3)](https://www.aglea.com/en/blog/tag/sap-hana)
- [sap_all (3)](https://www.aglea.com/en/blog/tag/sap_all)
- [security audit log (3)](https://www.aglea.com/en/blog/tag/security-audit-log)
- [sicurezza sap (3)](https://www.aglea.com/en/blog/tag/sicurezza-sap)
- [su53 (3)](https://www.aglea.com/en/blog/tag/su53)
- [HANA Security (2)](https://www.aglea.com/en/blog/tag/hana-security)
- [ISO (2)](https://www.aglea.com/en/blog/tag/iso)
- [Profiles (2)](https://www.aglea.com/en/blog/tag/profiles)
- [SAP FIORI Security (2)](https://www.aglea.com/en/blog/tag/sap-fiori-security)
- [SAP audit (2)](https://www.aglea.com/en/blog/tag/sap-audit)
- [Secure programming (2)](https://www.aglea.com/en/blog/tag/secure-programming)
- [UCON (2)](https://www.aglea.com/en/blog/tag/ucon)
- [UI Masking (2)](https://www.aglea.com/en/blog/tag/ui-masking)
- [access management (2)](https://www.aglea.com/en/blog/tag/access-management)
- [authorization concept (2)](https://www.aglea.com/en/blog/tag/authorization-concept)
- [autorizzazioni sap (2)](https://www.aglea.com/en/blog/tag/autorizzazioni-sap)
- [consulenti (2)](https://www.aglea.com/en/blog/tag/consulenti)
- [corso (2)](https://www.aglea.com/en/blog/tag/corso)
- [e-learning (2)](https://www.aglea.com/en/blog/tag/e-learning)
- [password policy (2)](https://www.aglea.com/en/blog/tag/password-policy)
- [patch (2)](https://www.aglea.com/en/blog/tag/patch)
- [programmazione sicura (2)](https://www.aglea.com/en/blog/tag/programmazione-sicura)
- [quality (2)](https://www.aglea.com/en/blog/tag/quality)
- [rfc (2)](https://www.aglea.com/en/blog/tag/rfc)
- [ruoli (2)](https://www.aglea.com/en/blog/tag/ruoli)
- [sap access control (2)](https://www.aglea.com/en/blog/tag/sap-access-control)
- [sap custom (2)](https://www.aglea.com/en/blog/tag/sap-custom)
- [sap etd (2)](https://www.aglea.com/en/blog/tag/sap-etd)
- [sap gui (2)](https://www.aglea.com/en/blog/tag/sap-gui)
- [sap query (2)](https://www.aglea.com/en/blog/tag/sap-query)
- [sap security guidelines (2)](https://www.aglea.com/en/blog/tag/sap-security-guidelines)
- [sap siem (2)](https://www.aglea.com/en/blog/tag/sap-siem)
- [sap standard role (2)](https://www.aglea.com/en/blog/tag/sap-standard-role)
- [sap super user (2)](https://www.aglea.com/en/blog/tag/sap-super-user)
- [sap vulnerability (2)](https://www.aglea.com/en/blog/tag/sap-vulnerability)
- [se16 (2)](https://www.aglea.com/en/blog/tag/se16)
- [security ams (2)](https://www.aglea.com/en/blog/tag/security-ams)
- [siem (2)](https://www.aglea.com/en/blog/tag/siem)
- [soar (2)](https://www.aglea.com/en/blog/tag/soar)
- [supporto sap ams (2)](https://www.aglea.com/en/blog/tag/supporto-sap-ams)
- [test system (2)](https://www.aglea.com/en/blog/tag/test-system)
- [threat detection (2)](https://www.aglea.com/en/blog/tag/threat-detection)
- [upgrade (2)](https://www.aglea.com/en/blog/tag/upgrade)
- [312 (1)](https://www.aglea.com/en/blog/tag/312)
- [ABAP (1)](https://www.aglea.com/en/blog/tag/abap)
- [AI (1)](https://www.aglea.com/en/blog/tag/ai)
- [CVA (1)](https://www.aglea.com/en/blog/tag/cva)
- [DPO (1)](https://www.aglea.com/en/blog/tag/dpo)
- [FIORI Security (1)](https://www.aglea.com/en/blog/tag/fiori-security)
- [HANA Roles (1)](https://www.aglea.com/en/blog/tag/hana-roles)
- [PFCG SAP transaction (1)](https://www.aglea.com/en/blog/tag/pfcg-sap-transaction)
- [SAP Cloud Security (1)](https://www.aglea.com/en/blog/tag/sap-cloud-security)
- [SAP Consulting (1)](https://www.aglea.com/en/blog/tag/sap-consulting)
- [SAP DLP (1)](https://www.aglea.com/en/blog/tag/sap-dlp)
- [SAP Fraud Management (1)](https://www.aglea.com/en/blog/tag/sap-fraud-management)
- [SAP IDM (1)](https://www.aglea.com/en/blog/tag/sap-idm)
- [SAP LOG (1)](https://www.aglea.com/en/blog/tag/sap-log)
- [SAP Security Documentation (1)](https://www.aglea.com/en/blog/tag/sap-security-documentation)
- [SAP Table (1)](https://www.aglea.com/en/blog/tag/sap-table)
- [SAP Transactions (1)](https://www.aglea.com/en/blog/tag/sap-transactions)
- [SPOOL (1)](https://www.aglea.com/en/blog/tag/spool)
- [Security Analyzer (1)](https://www.aglea.com/en/blog/tag/security-analyzer)
- [Statistiche security SAP (1)](https://www.aglea.com/en/blog/tag/statistiche-security-sap)
- [Trace autorizzazioni SAP (1)](https://www.aglea.com/en/blog/tag/trace-autorizzazioni-sap)
- [User Access Management (1)](https://www.aglea.com/en/blog/tag/user-access-management)
- [aglea (1)](https://www.aglea.com/en/blog/tag/aglea)
- [audit (1)](https://www.aglea.com/en/blog/tag/audit)
- [authorization model (1)](https://www.aglea.com/en/blog/tag/authorization-model)
- [biometric (1)](https://www.aglea.com/en/blog/tag/biometric)
- [chatGPT (1)](https://www.aglea.com/en/blog/tag/chatgpt)
- [codice sicuro SAP (1)](https://www.aglea.com/en/blog/tag/codice-sicuro-sap)
- [consulenti sap security (1)](https://www.aglea.com/en/blog/tag/consulenti-sap-security)
- [consulenza sap security (1)](https://www.aglea.com/en/blog/tag/consulenza-sap-security)
- [crittografia SAP (1)](https://www.aglea.com/en/blog/tag/crittografia-sap)
- [custom transactions (1)](https://www.aglea.com/en/blog/tag/custom-transactions)
- [cyber security (1)](https://www.aglea.com/en/blog/tag/cyber-security)
- [data loss prevention (1)](https://www.aglea.com/en/blog/tag/data-loss-prevention)
- [data privacy (1)](https://www.aglea.com/en/blog/tag/data-privacy)
- [documentazione sap security (1)](https://www.aglea.com/en/blog/tag/documentazione-sap-security)
- [emergency users (1)](https://www.aglea.com/en/blog/tag/emergency-users)
- [gxp (1)](https://www.aglea.com/en/blog/tag/gxp)
- [identity management system (1)](https://www.aglea.com/en/blog/tag/identity-management-system)
- [idm (1)](https://www.aglea.com/en/blog/tag/idm)
- [log sap (1)](https://www.aglea.com/en/blog/tag/log-sap)
- [mail security sap (1)](https://www.aglea.com/en/blog/tag/mail-security-sap)
- [microsoft (1)](https://www.aglea.com/en/blog/tag/microsoft)
- [parameter sap (1)](https://www.aglea.com/en/blog/tag/parameter-sap)
- [processi security (1)](https://www.aglea.com/en/blog/tag/processi-security)
- [profili (1)](https://www.aglea.com/en/blog/tag/profili)
- [profili sap (1)](https://www.aglea.com/en/blog/tag/profili-sap)
- [progetti security sap (1)](https://www.aglea.com/en/blog/tag/progetti-security-sap)
- [quotazione borsa (1)](https://www.aglea.com/en/blog/tag/quotazione-borsa)
- [rfc destination (1)](https://www.aglea.com/en/blog/tag/rfc-destination)
- [role translation (1)](https://www.aglea.com/en/blog/tag/role-translation)
- [s_tabu_dis (1)](https://www.aglea.com/en/blog/tag/s_tabu_dis)
- [s_tabu_nam (1)](https://www.aglea.com/en/blog/tag/s_tabu_nam)
- [s_tabu_rfc (1)](https://www.aglea.com/en/blog/tag/s_tabu_rfc)
- [sap FIORI (1)](https://www.aglea.com/en/blog/tag/sap-fiori)
- [sap btp (1)](https://www.aglea.com/en/blog/tag/sap-btp)
- [sap data masking (1)](https://www.aglea.com/en/blog/tag/sap-data-masking)
- [sap dati personali (1)](https://www.aglea.com/en/blog/tag/sap-dati-personali)
- [sap developer (1)](https://www.aglea.com/en/blog/tag/sap-developer)
- [sap earlywatch (1)](https://www.aglea.com/en/blog/tag/sap-earlywatch)
- [sap grc 12 (1)](https://www.aglea.com/en/blog/tag/sap-grc-12)
- [sap grc tables (1)](https://www.aglea.com/en/blog/tag/sap-grc-tables)
- [sap gui history (1)](https://www.aglea.com/en/blog/tag/sap-gui-history)
- [sap gui security (1)](https://www.aglea.com/en/blog/tag/sap-gui-security)
- [sap gxp compliance (1)](https://www.aglea.com/en/blog/tag/sap-gxp-compliance)
- [sap ilm gdpr (1)](https://www.aglea.com/en/blog/tag/sap-ilm-gdpr)
- [sap license auditing (1)](https://www.aglea.com/en/blog/tag/sap-license-auditing)
- [sap logon (1)](https://www.aglea.com/en/blog/tag/sap-logon)
- [sap patch (1)](https://www.aglea.com/en/blog/tag/sap-patch)
- [sap security blog (1)](https://www.aglea.com/en/blog/tag/sap-security-blog)
- [sap security teal (1)](https://www.aglea.com/en/blog/tag/sap-security-teal)
- [sap sos (1)](https://www.aglea.com/en/blog/tag/sap-sos)
- [sap splunk (1)](https://www.aglea.com/en/blog/tag/sap-splunk)
- [sap sso (1)](https://www.aglea.com/en/blog/tag/sap-sso)
- [sap tabelle custom (1)](https://www.aglea.com/en/blog/tag/sap-tabelle-custom)
- [sap tdms (1)](https://www.aglea.com/en/blog/tag/sap-tdms)
- [sap_all_only_view (1)](https://www.aglea.com/en/blog/tag/sap_all_only_view)
- [se16n (1)](https://www.aglea.com/en/blog/tag/se16n)
- [secpol (1)](https://www.aglea.com/en/blog/tag/secpol)
- [secure coding sap (1)](https://www.aglea.com/en/blog/tag/secure-coding-sap)
- [secure operation map (1)](https://www.aglea.com/en/blog/tag/secure-operation-map)
- [security awareness (1)](https://www.aglea.com/en/blog/tag/security-awareness)
- [security bridge (1)](https://www.aglea.com/en/blog/tag/security-bridge)
- [sentinel (1)](https://www.aglea.com/en/blog/tag/sentinel)
- [sicurezza codice ABAP (1)](https://www.aglea.com/en/blog/tag/sicurezza-codice-abap)
- [sicurezza dei dati sap (1)](https://www.aglea.com/en/blog/tag/sicurezza-dei-dati-sap)
- [slaw (1)](https://www.aglea.com/en/blog/tag/slaw)
- [social engineering (1)](https://www.aglea.com/en/blog/tag/social-engineering)
- [sost (1)](https://www.aglea.com/en/blog/tag/sost)
- [sql (1)](https://www.aglea.com/en/blog/tag/sql)
- [su25 (1)](https://www.aglea.com/en/blog/tag/su25)
- [super utenti sap (1)](https://www.aglea.com/en/blog/tag/super-utenti-sap)
- [system users (1)](https://www.aglea.com/en/blog/tag/system-users)
- [tabelle (1)](https://www.aglea.com/en/blog/tag/tabelle)
- [tabelle SAP grc access control (1)](https://www.aglea.com/en/blog/tag/tabelle-sap-grc-access-control)
- [ticket management system (1)](https://www.aglea.com/en/blog/tag/ticket-management-system)
- [training (1)](https://www.aglea.com/en/blog/tag/training)
- [transazioni sap (1)](https://www.aglea.com/en/blog/tag/transazioni-sap)
- [userid (1)](https://www.aglea.com/en/blog/tag/userid)
- [usmm (1)](https://www.aglea.com/en/blog/tag/usmm)
- [ust04 (1)](https://www.aglea.com/en/blog/tag/ust04)
- [zero trust security (1)](https://www.aglea.com/en/blog/tag/zero-trust-security)

[See all](https://www.aglea.com/en/blog/is-creating-users-by-copying-wrong#)

## [SAP Security Blog AGLEA RSS Feed](https://www.aglea.com/blog/rss.xml)

Aglea s.r.l. P. IVA: IT 03868780960 - 2026  | Copy | [Note legali](https://cdn2.hubspot.net/hubfs/4422290/Aglea_November2018%20Theme/Pdfs/Privacy-policy-AGLEA.pdf)

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Klea Duro",
    "url" : "https://www.aglea.com/en/blog/author/klea-duro"
  },
  "dateModified" : "2024-06-14T10:13:56.865Z",
  "datePublished" : "2023-05-11T22:00:00.000Z",
  "headline" : "Is creating users by copying wrong?",
  "image" : [ "https://www.aglea.com/hubfs/Aglea/Imported_Blog_Media/Copia%20utenti-Jun-14-2024-10-12-05-1924-AM.jpg" ],
  "mainEntityOfPage" : {
    "@id" : "https://www.aglea.com/en/blog/is-creating-users-by-copying-wrong",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject"
    },
    "name" : "Horsa S.p.A."
  }
}
```