--- title: SAP Authorization Manual description: "SU53 allow to find out authorization errors. How to suggest to use it in your company? Download our user manual!" image: https://www.aglea.com/hubfs/Aglea/Imported_Blog_Media/Help%20Desk%20AMS-Jun-14-2024-10-10-09-1121-AM.png --- [linkedin](https://www.linkedin.com/company/292350?trk=vsrp_companies_res_name&trkInfo=VSRPsearchId%3A3373431891426179412478%2CVSRPtargetId%3A292350%2CVSRPcmpt%3Aprimary) [YouTube](https://www.youtube.com/c/AgleaSAPSecurity?sub_confirmation=1) [Twitter](https://twitter.com/AgleaItaly?lang=en) [![Logo-Aglea-horsa-company](https://www.aglea.com/hubfs/Aglea/Aglea_November2018%20Theme/Images/Logo-Aglea-horsa-company.webp) ](https://www.aglea.com/en) # SAP Authorization Manual # SAP Authorization Manual Posted by [Marta Ortona](https://www.aglea.com/en/blog/author/marta-ortona) on Oct 21, 2022 12:00:00 AM - [Tweet](https://twitter.com/share)   During daily support users often have **to request some information**. By email or by corporate ticketing tool.   ![Help Desk AMS](https://www.aglea.com/hs-fs/hubfs/Aglea/Imported_Blog_Media/Help%20Desk%20AMS-Jun-14-2024-10-10-09-1121-AM.png?width=375&name=Help%20Desk%20AMS-Jun-14-2024-10-10-09-1121-AM.png)     What system are you on? What were you doing? What transactions were you using when you received the error and so on    To facilitate these requests, in the SAP authorizations field, we can define a **short user manual to publish, for example on the company intranet. **   ## How should the user report the authorization issues? Regarding the authorisation aspects the most useful information is that given by the **SU53 transaction**. This transaction allows to know all the necessary informations to solve the authorization problem.    ![SU53](https://www.aglea.com/hs-fs/hubfs/Aglea/Imported_Blog_Media/SU53-Jun-14-2024-10-10-07-3090-AM.png?width=600&name=SU53-Jun-14-2024-10-10-07-3090-AM.png)   Let’s see what they are: - The user who has the problem, in the form of technical name - The system and mandatory where the problem occurred - The last authorization error (and the history of the last three hours) - Stored Checks"(Shift+F5) - The chance to see the SU53 history (also on different application where the error occurred, once the authorization error has been saved (see OSS Note [1974803 - How to display failed authorization checks across application servers in SU53](https://launchpad.support.sap.com/#/notes/1974803)) - Failed checks since - Allows you to see not only the last authorization error but those of the last three hours (see OSS [Note 1671117 - SU53: Enhanced function and Web Dynpro suitability](https://launchpad.support.sap.com/#/notes/1671117)) ## Particular cases In some cases it is not possible to perform the SU53 transaction, or it is not immediate to identify the code of the transaction where you received the error.   Here are some examples:    - A transaction cover up the command field, how is it possible to perform SU53 transaction? - simply press the top left corner of the SAP GUI to open a new window "**generate session**" and perform the SU53 transaction in this new way.  ![SU53 COMMAND FIELD](https://www.aglea.com/hs-fs/hubfs/Aglea/Imported_Blog_Media/SU53%20COMMAND%20FIELD-Jun-14-2024-10-10-07-7835-AM.png?width=600&name=SU53%20COMMAND%20FIELD-Jun-14-2024-10-10-07-7835-AM.png) - **How to identify the SAP transaction code? ** - By clicking on the highlighted icon in the image below, in the bottom right of SAP GUI, is possible to identify the transaction used at the time of the error. This was especially useful when the SU53 did not show, directly in the log, the transactional code. In the most up-to-date systems this problem doesn't exist.  ![TCODE_SAP](https://www.aglea.com/hs-fs/hubfs/Aglea/Imported_Blog_Media/TCODE_SAP-Jun-14-2024-10-10-08-5027-AM.png?width=600&name=TCODE_SAP-Jun-14-2024-10-10-08-5027-AM.png) Look at the difference between SU53 from ten years ago and today. - In the old one you only see the last authorization error - In  the new one there is also the transaction code (except for S_TCODE objects which are directly reported in the field)    ![confronto su53](https://www.aglea.com/hs-fs/hubfs/Aglea/Imported_Blog_Media/confronto%20su53-Jun-14-2024-10-10-10-2904-AM.png?width=600&name=confronto%20su53-Jun-14-2024-10-10-10-2904-AM.png)   Attention! In SAP HR Systems, especially in the past, authorization errors had to be analyzed by transaction ST01 o STAUTHTRACE (see also [OSS 1916340 - Trace in ST01 instead of SU53 checking HR authorizations](https://launchpad.support.sap.com/#/notes/1916340)). In the most recent systems having a three-hour history this can be avoided   Here a short video to use in your company!     Also for SAP Fiori:   ## SU53 errors In some situations, the transaction **may report some authorization errors on technical and system objects**, for example: S_CTS_ADMI,  S_TRANSLAT, S_TCODE=PFCG, S_USER_AGR, etc.   Why does this happen?   It is explained in detail in the note OSS [1525134 - SU53 shows 'strange' results (for instance for S_CTS_ADMI, S_TRANSLAT,....)](https://launchpad.support.sap.com/#/notes/1525134) some functionalities that are checked at the start of transactions verify the presence of administrative functions. For this reason the objects above are checked. **Attention, these objects must never be inserted in the basic role.** [Read here what the basic role should contain and, above all, what should not.](https://www.aglea.com/blog/il-ruolo-di-base-cos%C3%A8-e-cosa-dovrebbe-contenere)   Is it correct that there are authorization errors even if everything is working properly? Yes, it can be correct because some objects have logic of hierarchical controls, for example the authorized objects for the tables' control S_TABU_DIS and S_TABU_NAM or the objects S_RFC o S_RFCACL see also OSS note [2656331 - S_RFC/S_RFCACL entries in authorization trace (SU53).](https://launchpad.support.sap.com/#/notes/2656331) ## A practical example During the AMS support we perform for our clients ([AMS Security SAP Service](https://www.aglea.com/sap-security-ams)) we prepared a document for end users, a presentation describing how to use the SU53, usually this document is published on the company intranet.   Download it now, customize it and spread it in your company!   Blog post originally translated from: [https://www.aglea.com/blog/manuale-autorizzazioni-sap](https://www.aglea.com/blog/manuale-autorizzazioni-sap)     Topics: [su53](https://www.aglea.com/en/blog/tag/su53), [sap consulenza security](https://www.aglea.com/en/blog/tag/sap-consulenza-security), [SAP Security](https://www.aglea.com/en/blog/tag/sap-security), [aglea](https://www.aglea.com/en/blog/tag/aglea) ### Subscribe Here! ### Blog Aglea, cosa puoi trovare? Ogni mercoledì pubblichiamo articoli, interviste e documenti relativi alla security SAP. Cosa puoi trovare: - Suggerimenti su come mettere in sicurezza i sistemi SAP - Come fare a … (How To) - Checklist - Gli errori comuni che spesso vengono fatti in ambito Security SAP - Interviste con esperti del settore - Chi è AGLEA quale è la nostra vision security SAP ### Recent Posts ### Post By Topic - [SAP Security (12)](https://www.aglea.com/en/blog/tag/sap-security) - [SAP GRC (11)](https://www.aglea.com/en/blog/tag/sap-grc) - [pfcg (8)](https://www.aglea.com/en/blog/tag/pfcg) - [gdpr (7)](https://www.aglea.com/en/blog/tag/gdpr) - [SAP GDPR (5)](https://www.aglea.com/en/blog/tag/sap-gdpr) - [Segregation of duties (5)](https://www.aglea.com/en/blog/tag/segregation-of-duties) - [governance (5)](https://www.aglea.com/en/blog/tag/governance) - [sod (5)](https://www.aglea.com/en/blog/tag/sod) - [SAP ECC (4)](https://www.aglea.com/en/blog/tag/sap-ecc) - [audit sap (4)](https://www.aglea.com/en/blog/tag/audit-sap) - [auditing (4)](https://www.aglea.com/en/blog/tag/auditing) - [sap consulenza security (4)](https://www.aglea.com/en/blog/tag/sap-consulenza-security) - [sap password (4)](https://www.aglea.com/en/blog/tag/sap-password) - [HANA (3)](https://www.aglea.com/en/blog/tag/hana) - [SAP HR (3)](https://www.aglea.com/en/blog/tag/sap-hr) - [UI logging (3)](https://www.aglea.com/en/blog/tag/ui-logging) - [rfc security (3)](https://www.aglea.com/en/blog/tag/rfc-security) - [sap cyber security (3)](https://www.aglea.com/en/blog/tag/sap-cyber-security) - [sap hana (3)](https://www.aglea.com/en/blog/tag/sap-hana) - [sap_all (3)](https://www.aglea.com/en/blog/tag/sap_all) - [security audit log (3)](https://www.aglea.com/en/blog/tag/security-audit-log) - [sicurezza sap (3)](https://www.aglea.com/en/blog/tag/sicurezza-sap) - [su53 (3)](https://www.aglea.com/en/blog/tag/su53) - [HANA Security (2)](https://www.aglea.com/en/blog/tag/hana-security) - [ISO (2)](https://www.aglea.com/en/blog/tag/iso) - [Profiles (2)](https://www.aglea.com/en/blog/tag/profiles) - [SAP FIORI Security (2)](https://www.aglea.com/en/blog/tag/sap-fiori-security) - [SAP audit (2)](https://www.aglea.com/en/blog/tag/sap-audit) - [Secure programming (2)](https://www.aglea.com/en/blog/tag/secure-programming) - [UCON (2)](https://www.aglea.com/en/blog/tag/ucon) - [UI Masking (2)](https://www.aglea.com/en/blog/tag/ui-masking) - [access management (2)](https://www.aglea.com/en/blog/tag/access-management) - [authorization concept (2)](https://www.aglea.com/en/blog/tag/authorization-concept) - [autorizzazioni sap (2)](https://www.aglea.com/en/blog/tag/autorizzazioni-sap) - [consulenti (2)](https://www.aglea.com/en/blog/tag/consulenti) - [corso (2)](https://www.aglea.com/en/blog/tag/corso) - [e-learning (2)](https://www.aglea.com/en/blog/tag/e-learning) - [password policy (2)](https://www.aglea.com/en/blog/tag/password-policy) - [patch (2)](https://www.aglea.com/en/blog/tag/patch) - [programmazione sicura (2)](https://www.aglea.com/en/blog/tag/programmazione-sicura) - [quality (2)](https://www.aglea.com/en/blog/tag/quality) - [rfc (2)](https://www.aglea.com/en/blog/tag/rfc) - [ruoli (2)](https://www.aglea.com/en/blog/tag/ruoli) - [sap access control (2)](https://www.aglea.com/en/blog/tag/sap-access-control) - [sap custom (2)](https://www.aglea.com/en/blog/tag/sap-custom) - [sap etd (2)](https://www.aglea.com/en/blog/tag/sap-etd) - [sap gui (2)](https://www.aglea.com/en/blog/tag/sap-gui) - [sap query (2)](https://www.aglea.com/en/blog/tag/sap-query) - [sap security guidelines (2)](https://www.aglea.com/en/blog/tag/sap-security-guidelines) - [sap siem (2)](https://www.aglea.com/en/blog/tag/sap-siem) - [sap standard role (2)](https://www.aglea.com/en/blog/tag/sap-standard-role) - [sap super user (2)](https://www.aglea.com/en/blog/tag/sap-super-user) - [sap vulnerability (2)](https://www.aglea.com/en/blog/tag/sap-vulnerability) - [se16 (2)](https://www.aglea.com/en/blog/tag/se16) - [security ams (2)](https://www.aglea.com/en/blog/tag/security-ams) - [siem (2)](https://www.aglea.com/en/blog/tag/siem) - [soar (2)](https://www.aglea.com/en/blog/tag/soar) - [supporto sap ams (2)](https://www.aglea.com/en/blog/tag/supporto-sap-ams) - [test system (2)](https://www.aglea.com/en/blog/tag/test-system) - [threat detection (2)](https://www.aglea.com/en/blog/tag/threat-detection) - [upgrade (2)](https://www.aglea.com/en/blog/tag/upgrade) - [312 (1)](https://www.aglea.com/en/blog/tag/312) - [ABAP (1)](https://www.aglea.com/en/blog/tag/abap) - [AI (1)](https://www.aglea.com/en/blog/tag/ai) - [CVA (1)](https://www.aglea.com/en/blog/tag/cva) - [DPO (1)](https://www.aglea.com/en/blog/tag/dpo) - [FIORI Security (1)](https://www.aglea.com/en/blog/tag/fiori-security) - [HANA Roles (1)](https://www.aglea.com/en/blog/tag/hana-roles) - [PFCG SAP transaction (1)](https://www.aglea.com/en/blog/tag/pfcg-sap-transaction) - [SAP Cloud Security (1)](https://www.aglea.com/en/blog/tag/sap-cloud-security) - [SAP Consulting (1)](https://www.aglea.com/en/blog/tag/sap-consulting) - [SAP DLP (1)](https://www.aglea.com/en/blog/tag/sap-dlp) - [SAP Fraud Management (1)](https://www.aglea.com/en/blog/tag/sap-fraud-management) - [SAP IDM (1)](https://www.aglea.com/en/blog/tag/sap-idm) - [SAP LOG (1)](https://www.aglea.com/en/blog/tag/sap-log) - [SAP Security Documentation (1)](https://www.aglea.com/en/blog/tag/sap-security-documentation) - [SAP Table (1)](https://www.aglea.com/en/blog/tag/sap-table) - [SAP Transactions (1)](https://www.aglea.com/en/blog/tag/sap-transactions) - [SPOOL (1)](https://www.aglea.com/en/blog/tag/spool) - [Security Analyzer (1)](https://www.aglea.com/en/blog/tag/security-analyzer) - [Statistiche security SAP (1)](https://www.aglea.com/en/blog/tag/statistiche-security-sap) - [Trace autorizzazioni SAP (1)](https://www.aglea.com/en/blog/tag/trace-autorizzazioni-sap) - [User Access Management (1)](https://www.aglea.com/en/blog/tag/user-access-management) - [aglea (1)](https://www.aglea.com/en/blog/tag/aglea) - [audit (1)](https://www.aglea.com/en/blog/tag/audit) - [authorization model (1)](https://www.aglea.com/en/blog/tag/authorization-model) - [biometric (1)](https://www.aglea.com/en/blog/tag/biometric) - [chatGPT (1)](https://www.aglea.com/en/blog/tag/chatgpt) - [codice sicuro SAP (1)](https://www.aglea.com/en/blog/tag/codice-sicuro-sap) - [consulenti sap security (1)](https://www.aglea.com/en/blog/tag/consulenti-sap-security) - [consulenza sap security (1)](https://www.aglea.com/en/blog/tag/consulenza-sap-security) - [crittografia SAP (1)](https://www.aglea.com/en/blog/tag/crittografia-sap) - [custom transactions (1)](https://www.aglea.com/en/blog/tag/custom-transactions) - [cyber security (1)](https://www.aglea.com/en/blog/tag/cyber-security) - [data loss prevention (1)](https://www.aglea.com/en/blog/tag/data-loss-prevention) - [data privacy (1)](https://www.aglea.com/en/blog/tag/data-privacy) - [documentazione sap security (1)](https://www.aglea.com/en/blog/tag/documentazione-sap-security) - [emergency users (1)](https://www.aglea.com/en/blog/tag/emergency-users) - [gxp (1)](https://www.aglea.com/en/blog/tag/gxp) - [identity management system (1)](https://www.aglea.com/en/blog/tag/identity-management-system) - [idm (1)](https://www.aglea.com/en/blog/tag/idm) - [log sap (1)](https://www.aglea.com/en/blog/tag/log-sap) - [mail security sap (1)](https://www.aglea.com/en/blog/tag/mail-security-sap) - [microsoft (1)](https://www.aglea.com/en/blog/tag/microsoft) - [parameter sap (1)](https://www.aglea.com/en/blog/tag/parameter-sap) - [processi security (1)](https://www.aglea.com/en/blog/tag/processi-security) - [profili (1)](https://www.aglea.com/en/blog/tag/profili) - [profili sap (1)](https://www.aglea.com/en/blog/tag/profili-sap) - [progetti security sap (1)](https://www.aglea.com/en/blog/tag/progetti-security-sap) - [quotazione borsa (1)](https://www.aglea.com/en/blog/tag/quotazione-borsa) - [rfc destination (1)](https://www.aglea.com/en/blog/tag/rfc-destination) - [role translation (1)](https://www.aglea.com/en/blog/tag/role-translation) - [s_tabu_dis (1)](https://www.aglea.com/en/blog/tag/s_tabu_dis) - [s_tabu_nam (1)](https://www.aglea.com/en/blog/tag/s_tabu_nam) - [s_tabu_rfc (1)](https://www.aglea.com/en/blog/tag/s_tabu_rfc) - [sap FIORI (1)](https://www.aglea.com/en/blog/tag/sap-fiori) - [sap btp (1)](https://www.aglea.com/en/blog/tag/sap-btp) - [sap data masking (1)](https://www.aglea.com/en/blog/tag/sap-data-masking) - [sap dati personali (1)](https://www.aglea.com/en/blog/tag/sap-dati-personali) - [sap developer (1)](https://www.aglea.com/en/blog/tag/sap-developer) - [sap earlywatch (1)](https://www.aglea.com/en/blog/tag/sap-earlywatch) - [sap grc 12 (1)](https://www.aglea.com/en/blog/tag/sap-grc-12) - [sap grc tables (1)](https://www.aglea.com/en/blog/tag/sap-grc-tables) - [sap gui history (1)](https://www.aglea.com/en/blog/tag/sap-gui-history) - [sap gui security (1)](https://www.aglea.com/en/blog/tag/sap-gui-security) - [sap gxp compliance (1)](https://www.aglea.com/en/blog/tag/sap-gxp-compliance) - [sap ilm gdpr (1)](https://www.aglea.com/en/blog/tag/sap-ilm-gdpr) - [sap license auditing (1)](https://www.aglea.com/en/blog/tag/sap-license-auditing) - [sap logon (1)](https://www.aglea.com/en/blog/tag/sap-logon) - [sap patch (1)](https://www.aglea.com/en/blog/tag/sap-patch) - [sap security blog (1)](https://www.aglea.com/en/blog/tag/sap-security-blog) - [sap security teal (1)](https://www.aglea.com/en/blog/tag/sap-security-teal) - [sap sos (1)](https://www.aglea.com/en/blog/tag/sap-sos) - [sap splunk (1)](https://www.aglea.com/en/blog/tag/sap-splunk) - [sap sso (1)](https://www.aglea.com/en/blog/tag/sap-sso) - [sap tabelle custom (1)](https://www.aglea.com/en/blog/tag/sap-tabelle-custom) - [sap tdms (1)](https://www.aglea.com/en/blog/tag/sap-tdms) - [sap_all_only_view (1)](https://www.aglea.com/en/blog/tag/sap_all_only_view) - [se16n (1)](https://www.aglea.com/en/blog/tag/se16n) - [secpol (1)](https://www.aglea.com/en/blog/tag/secpol) - [secure coding sap (1)](https://www.aglea.com/en/blog/tag/secure-coding-sap) - [secure operation map (1)](https://www.aglea.com/en/blog/tag/secure-operation-map) - [security awareness (1)](https://www.aglea.com/en/blog/tag/security-awareness) - [security bridge (1)](https://www.aglea.com/en/blog/tag/security-bridge) - [sentinel (1)](https://www.aglea.com/en/blog/tag/sentinel) - [sicurezza codice ABAP (1)](https://www.aglea.com/en/blog/tag/sicurezza-codice-abap) - [sicurezza dei dati sap (1)](https://www.aglea.com/en/blog/tag/sicurezza-dei-dati-sap) - [slaw (1)](https://www.aglea.com/en/blog/tag/slaw) - [social engineering (1)](https://www.aglea.com/en/blog/tag/social-engineering) - [sost (1)](https://www.aglea.com/en/blog/tag/sost) - [sql (1)](https://www.aglea.com/en/blog/tag/sql) - [su25 (1)](https://www.aglea.com/en/blog/tag/su25) - [super utenti sap (1)](https://www.aglea.com/en/blog/tag/super-utenti-sap) - [system users (1)](https://www.aglea.com/en/blog/tag/system-users) - [tabelle (1)](https://www.aglea.com/en/blog/tag/tabelle) - [tabelle SAP grc access control (1)](https://www.aglea.com/en/blog/tag/tabelle-sap-grc-access-control) - [ticket management system (1)](https://www.aglea.com/en/blog/tag/ticket-management-system) - [training (1)](https://www.aglea.com/en/blog/tag/training) - [transazioni sap (1)](https://www.aglea.com/en/blog/tag/transazioni-sap) - [userid (1)](https://www.aglea.com/en/blog/tag/userid) - [usmm (1)](https://www.aglea.com/en/blog/tag/usmm) - [ust04 (1)](https://www.aglea.com/en/blog/tag/ust04) - [zero trust security (1)](https://www.aglea.com/en/blog/tag/zero-trust-security) [See all](https://www.aglea.com/en/blog/manuale-autorizzazioni-sap-0#) ## [SAP Security Blog AGLEA RSS Feed](https://www.aglea.com/blog/rss.xml) Aglea s.r.l. P. IVA: IT 03868780960 - 2026 | Copy | [Note legali](https://cdn2.hubspot.net/hubfs/4422290/Aglea_November2018%20Theme/Pdfs/Privacy-policy-AGLEA.pdf) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Marta Ortona", "url" : "https://www.aglea.com/en/blog/author/marta-ortona" }, "dateModified" : "2024-06-14T10:13:21.132Z", "datePublished" : "2022-10-20T22:00:00.000Z", "headline" : "SAP Authorization Manual", "image" : [ "https://www.aglea.com/hubfs/Aglea/Imported_Blog_Media/Help%20Desk%20AMS-Jun-14-2024-10-10-09-1121-AM.png" ], "mainEntityOfPage" : { "@id" : "https://www.aglea.com/en/blog/manuale-autorizzazioni-sap-0", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject" }, "name" : "Horsa S.p.A." } } ```