--- title: WHAT ARE SAP HANA ROLES? description: "What are SAP HANA Roles? How to use it? #AgleaSAPSecurity" image: https://www.aglea.com/hubfs/Aglea/Imported_Blog_Media/SAP%20HANA%20ROLES-Jun-14-2024-10-10-17-5282-AM.jpg --- [linkedin](https://www.linkedin.com/company/292350?trk=vsrp_companies_res_name&trkInfo=VSRPsearchId%3A3373431891426179412478%2CVSRPtargetId%3A292350%2CVSRPcmpt%3Aprimary) [YouTube](https://www.youtube.com/c/AgleaSAPSecurity?sub_confirmation=1) [Twitter](https://twitter.com/AgleaItaly?lang=en) [![Logo-Aglea-horsa-company](https://www.aglea.com/hubfs/Aglea/Aglea_November2018%20Theme/Images/Logo-Aglea-horsa-company.webp) ](https://www.aglea.com/en) # WHAT ARE SAP HANA ROLES? # WHAT ARE SAP HANA ROLES? Posted by [Klea Duro](https://www.aglea.com/en/blog/author/klea-duro) on May 5, 2023 12:00:00 AM - [Tweet](https://twitter.com/share) Profiling also exists and can be implemented in the SAP HANA database.   ![SAP HANA ROLES](https://www.aglea.com/hs-fs/hubfs/Aglea/Imported_Blog_Media/SAP%20HANA%20ROLES-Jun-14-2024-10-10-17-5282-AM.jpg?width=521&name=SAP%20HANA%20ROLES-Jun-14-2024-10-10-17-5282-AM.jpg)   But not all roads lead to the same result. Some choices may not be ideal in the long run and in the management of authorizations in SAP HANA. What is important to know when defining SAP HANA roles?   This is not always done as this database is mainly used when using SAP applications. Such as S/4HANA.   ## What is the difference between SAP HANA and S/4HANA? SAP HANA (High Performance Analytic Appliance) is the database created by SAP. In this case it is reductive to define HANA only as a database, in fact it has many functions:   - It supports OLAP (Online Analytical Processing) and OLTP (Online transaction processing) modes at the same time. - Can be used in on-premises or on cloud mode - Contains native data manipulation capabilities from different sources (ETL Extract Transform and Load) - **Contains an application** part called SAP HANA Extended Application Server** (SAP HANA XSA)**     ## How to connect to HANA? There are two main ways at the moment. Via the SAP HANA Studio program (you can download it from the SAP support portal and install it on your PC) and via the SAP HANA Cockpit, a web feature that must be installed "server side".   Once SAP HANA Studio is installed, you can connect to the database.   ![SAP HANA STUDIO](https://www.aglea.com/hs-fs/hubfs/Aglea/Imported_Blog_Media/SAP%20HANA%20STUDIO-Jun-14-2024-10-10-16-8952-AM.png?width=529&name=SAP%20HANA%20STUDIO-Jun-14-2024-10-10-16-8952-AM.png)   However, SAP suggests using the SAP HANA Cockpit, for several reasons, for example: - It is the official tool that SAP suggests - You do not need to have a specific release to connect to HANA depending on the version. Indeed, some HANA functionality may not be available in certain versions of SAP HANA Studio (see also [OSS Note 2375176 - SAP HANA Revisions and Compatible SAP HANA Studio Versions](https://accounts.sap.com/saml2/idp/sso)) - There is no need to use a client   ## What are the special features of SAP HANA in the Cloud? In case HANA is managed in the cloud (SAP HANA Enterprise Cloud) what are the points of attention (SAP Cloud Security)?   - Infrastructure logs will be managed by the provider (firewall, network, virtual machine) - As well as system management basis activities, will be managed by the provider - Profiling and authorization activities will be managed directly by you   ## But is it necessary to create HANA roles? You may find yourself in two main scenarios:   1. You will **install only the S/4HANA application** in your SAP HANA installation. 2. You use SAP HANA **to develop proprietary applications** (not SAP then)   These scenarios are very different from each other. In the first case above, in most cases, you do not need to define many roles, except for system administrators.   While in the second case you may need to define many roles and use a variety of features to manage the HANA authorization concept.   ## So which users can you define in SAP HANA? [Download our tutorial here!](https://www.aglea.com/scarica-la-guida-su-come-creare-utenti-in-sap-hana)   ## What types of roles can you use in SAP HANA? There are two types of roles in SAP HANA: - SAP Run-time Role o **Catalog Role** - SAP Design-time Role o **Repository Role**   Depending on the situation and scenario, it is necessary to figure out which is the best type of role to use. As there may be a lot of overlap. In other words, the same "authorization" can be assigned through both Catalog Roles and Repository Roles. But how to figure out what to do and what type of HANA role to use?   Role Transport - Catalog Role: NO - Repository Role: SI   Version Management (Versioning) - Catalog Role: NO - Repository Role: SI   **Role Ownership** - Catalog Role: The ownership of who creates the roles is of the users who defined them - Repository Role: The technical user _SYS_REPO is used to avoid the very case above   **GRANT and REVOKE** - Catalog Role: if the user account of the person who created these roles is deleted, all entitlements are also revoked - Repository Role: the functionality above is not applied   [Here you can find how to create a Repository Role.](https://app.hubspot.com/blog/4422290/editor/28600766986/content)   You can recognize whether a HANA role is of type Repository Role by the fact that it is written in its definition. Unlike Catalog Roles that do not carry this definition, as shown in the image below.   ![REPOSITORY_ROLE_SAP_HANA](https://www.aglea.com/hs-fs/hubfs/Aglea/Imported_Blog_Media/REPOSITORY_ROLE_SAP_HANA-Jun-14-2024-10-10-15-8844-AM.png?width=517&name=REPOSITORY_ROLE_SAP_HANA-Jun-14-2024-10-10-15-8844-AM.png)   Repository Roles must be created through the definition of a project, where they are placed. Privileges (Privileges) must then be defined within them.   ![HANA_REPOSITORY_ROLE](https://www.aglea.com/hs-fs/hubfs/Aglea/Imported_Blog_Media/HANA_REPOSITORY_ROLE-Jun-14-2024-10-10-15-2796-AM.png?width=538&name=HANA_REPOSITORY_ROLE-Jun-14-2024-10-10-15-2796-AM.png)     ## Emergency users and PAM management in SAP HANA? It is possible through the [SAP GRC Access Control](https://www.aglea.com/en/sap-grc) in version 12.x where you can create super-users for access to the HANA database as well.   In this case, a procedure is defined for Privileged Access Management (PAM) where the super user ([firefighter](https://www.aglea.com/en/blog/per-gestire-una-super-user-in-sap-serve-sap-grc-0)) can access the HANA development environment.   ![SAP GRC EAM HANA REASON](https://www.aglea.com/hs-fs/hubfs/Aglea/Imported_Blog_Media/SAP%20GRC%20EAM%20HANA%20REASON-Jun-14-2024-10-10-14-7563-AM.png?width=494&name=SAP%20GRC%20EAM%20HANA%20REASON-Jun-14-2024-10-10-14-7563-AM.png)   More content like this above? Subscribe to our Blog, by using the link below:     Topics: [sap hana](https://www.aglea.com/blog/tag/sap-hana), [HANA Security](https://www.aglea.com/blog/tag/hana-security), [sap grc 12](https://www.aglea.com/blog/tag/sap-grc-12), [HANA Roles](https://www.aglea.com/blog/tag/hana-roles), [firefighter HANA](https://www.aglea.com/blog/tag/firefighter-hana) ### Subscribe Here! ### Blog Aglea, cosa puoi trovare? Ogni mercoledì pubblichiamo articoli, interviste e documenti relativi alla security SAP. Cosa puoi trovare: - Suggerimenti su come mettere in sicurezza i sistemi SAP - Come fare a … (How To) - Checklist - Gli errori comuni che spesso vengono fatti in ambito Security SAP - Interviste con esperti del settore - Chi è AGLEA quale è la nostra vision security SAP ### Recent Posts ### Post By Topic - [SAP Security (12)](https://www.aglea.com/en/blog/tag/sap-security) - [SAP GRC (11)](https://www.aglea.com/en/blog/tag/sap-grc) - [pfcg (8)](https://www.aglea.com/en/blog/tag/pfcg) - [gdpr (7)](https://www.aglea.com/en/blog/tag/gdpr) - [SAP GDPR (5)](https://www.aglea.com/en/blog/tag/sap-gdpr) - [Segregation of duties (5)](https://www.aglea.com/en/blog/tag/segregation-of-duties) - [governance (5)](https://www.aglea.com/en/blog/tag/governance) - [sod (5)](https://www.aglea.com/en/blog/tag/sod) - [SAP ECC (4)](https://www.aglea.com/en/blog/tag/sap-ecc) - [audit sap (4)](https://www.aglea.com/en/blog/tag/audit-sap) - [auditing (4)](https://www.aglea.com/en/blog/tag/auditing) - [sap consulenza security (4)](https://www.aglea.com/en/blog/tag/sap-consulenza-security) - [sap password (4)](https://www.aglea.com/en/blog/tag/sap-password) - [HANA (3)](https://www.aglea.com/en/blog/tag/hana) - [SAP HR (3)](https://www.aglea.com/en/blog/tag/sap-hr) - [UI logging (3)](https://www.aglea.com/en/blog/tag/ui-logging) - [rfc security (3)](https://www.aglea.com/en/blog/tag/rfc-security) - [sap cyber security (3)](https://www.aglea.com/en/blog/tag/sap-cyber-security) - [sap hana (3)](https://www.aglea.com/en/blog/tag/sap-hana) - [sap_all (3)](https://www.aglea.com/en/blog/tag/sap_all) - [security audit log (3)](https://www.aglea.com/en/blog/tag/security-audit-log) - [sicurezza sap (3)](https://www.aglea.com/en/blog/tag/sicurezza-sap) - [su53 (3)](https://www.aglea.com/en/blog/tag/su53) - [HANA Security (2)](https://www.aglea.com/en/blog/tag/hana-security) - [ISO (2)](https://www.aglea.com/en/blog/tag/iso) - [Profiles (2)](https://www.aglea.com/en/blog/tag/profiles) - [SAP FIORI Security (2)](https://www.aglea.com/en/blog/tag/sap-fiori-security) - [SAP audit (2)](https://www.aglea.com/en/blog/tag/sap-audit) - [Secure programming (2)](https://www.aglea.com/en/blog/tag/secure-programming) - [UCON (2)](https://www.aglea.com/en/blog/tag/ucon) - [UI Masking (2)](https://www.aglea.com/en/blog/tag/ui-masking) - [access management (2)](https://www.aglea.com/en/blog/tag/access-management) - [authorization concept (2)](https://www.aglea.com/en/blog/tag/authorization-concept) - [autorizzazioni sap (2)](https://www.aglea.com/en/blog/tag/autorizzazioni-sap) - [consulenti (2)](https://www.aglea.com/en/blog/tag/consulenti) - [corso (2)](https://www.aglea.com/en/blog/tag/corso) - [e-learning (2)](https://www.aglea.com/en/blog/tag/e-learning) - [password policy (2)](https://www.aglea.com/en/blog/tag/password-policy) - [patch (2)](https://www.aglea.com/en/blog/tag/patch) - [programmazione sicura (2)](https://www.aglea.com/en/blog/tag/programmazione-sicura) - [quality (2)](https://www.aglea.com/en/blog/tag/quality) - [rfc (2)](https://www.aglea.com/en/blog/tag/rfc) - [ruoli (2)](https://www.aglea.com/en/blog/tag/ruoli) - [sap access control (2)](https://www.aglea.com/en/blog/tag/sap-access-control) - [sap custom (2)](https://www.aglea.com/en/blog/tag/sap-custom) - [sap etd (2)](https://www.aglea.com/en/blog/tag/sap-etd) - [sap gui (2)](https://www.aglea.com/en/blog/tag/sap-gui) - [sap query (2)](https://www.aglea.com/en/blog/tag/sap-query) - [sap security guidelines (2)](https://www.aglea.com/en/blog/tag/sap-security-guidelines) - [sap siem (2)](https://www.aglea.com/en/blog/tag/sap-siem) - [sap standard role (2)](https://www.aglea.com/en/blog/tag/sap-standard-role) - [sap super user (2)](https://www.aglea.com/en/blog/tag/sap-super-user) - [sap vulnerability (2)](https://www.aglea.com/en/blog/tag/sap-vulnerability) - [se16 (2)](https://www.aglea.com/en/blog/tag/se16) - [security ams (2)](https://www.aglea.com/en/blog/tag/security-ams) - [siem (2)](https://www.aglea.com/en/blog/tag/siem) - [soar (2)](https://www.aglea.com/en/blog/tag/soar) - [supporto sap ams (2)](https://www.aglea.com/en/blog/tag/supporto-sap-ams) - [test system (2)](https://www.aglea.com/en/blog/tag/test-system) - [threat detection (2)](https://www.aglea.com/en/blog/tag/threat-detection) - [upgrade (2)](https://www.aglea.com/en/blog/tag/upgrade) - [312 (1)](https://www.aglea.com/en/blog/tag/312) - [ABAP (1)](https://www.aglea.com/en/blog/tag/abap) - [AI (1)](https://www.aglea.com/en/blog/tag/ai) - [CVA (1)](https://www.aglea.com/en/blog/tag/cva) - [DPO (1)](https://www.aglea.com/en/blog/tag/dpo) - [FIORI Security (1)](https://www.aglea.com/en/blog/tag/fiori-security) - [HANA Roles (1)](https://www.aglea.com/en/blog/tag/hana-roles) - [PFCG SAP transaction (1)](https://www.aglea.com/en/blog/tag/pfcg-sap-transaction) - [SAP Cloud Security (1)](https://www.aglea.com/en/blog/tag/sap-cloud-security) - [SAP Consulting (1)](https://www.aglea.com/en/blog/tag/sap-consulting) - [SAP DLP (1)](https://www.aglea.com/en/blog/tag/sap-dlp) - [SAP Fraud Management (1)](https://www.aglea.com/en/blog/tag/sap-fraud-management) - [SAP IDM (1)](https://www.aglea.com/en/blog/tag/sap-idm) - [SAP LOG (1)](https://www.aglea.com/en/blog/tag/sap-log) - [SAP Security Documentation (1)](https://www.aglea.com/en/blog/tag/sap-security-documentation) - [SAP Table (1)](https://www.aglea.com/en/blog/tag/sap-table) - [SAP Transactions (1)](https://www.aglea.com/en/blog/tag/sap-transactions) - [SPOOL (1)](https://www.aglea.com/en/blog/tag/spool) - [Security Analyzer (1)](https://www.aglea.com/en/blog/tag/security-analyzer) - [Statistiche security SAP (1)](https://www.aglea.com/en/blog/tag/statistiche-security-sap) - [Trace autorizzazioni SAP (1)](https://www.aglea.com/en/blog/tag/trace-autorizzazioni-sap) - [User Access Management (1)](https://www.aglea.com/en/blog/tag/user-access-management) - [aglea (1)](https://www.aglea.com/en/blog/tag/aglea) - [audit (1)](https://www.aglea.com/en/blog/tag/audit) - [authorization model (1)](https://www.aglea.com/en/blog/tag/authorization-model) - [biometric (1)](https://www.aglea.com/en/blog/tag/biometric) - [chatGPT (1)](https://www.aglea.com/en/blog/tag/chatgpt) - [codice sicuro SAP (1)](https://www.aglea.com/en/blog/tag/codice-sicuro-sap) - [consulenti sap security (1)](https://www.aglea.com/en/blog/tag/consulenti-sap-security) - [consulenza sap security (1)](https://www.aglea.com/en/blog/tag/consulenza-sap-security) - [crittografia SAP (1)](https://www.aglea.com/en/blog/tag/crittografia-sap) - [custom transactions (1)](https://www.aglea.com/en/blog/tag/custom-transactions) - [cyber security (1)](https://www.aglea.com/en/blog/tag/cyber-security) - [data loss prevention (1)](https://www.aglea.com/en/blog/tag/data-loss-prevention) - [data privacy (1)](https://www.aglea.com/en/blog/tag/data-privacy) - [documentazione sap security (1)](https://www.aglea.com/en/blog/tag/documentazione-sap-security) - [emergency users (1)](https://www.aglea.com/en/blog/tag/emergency-users) - [gxp (1)](https://www.aglea.com/en/blog/tag/gxp) - [identity management system (1)](https://www.aglea.com/en/blog/tag/identity-management-system) - [idm (1)](https://www.aglea.com/en/blog/tag/idm) - [log sap (1)](https://www.aglea.com/en/blog/tag/log-sap) - [mail security sap (1)](https://www.aglea.com/en/blog/tag/mail-security-sap) - [microsoft (1)](https://www.aglea.com/en/blog/tag/microsoft) - [parameter sap (1)](https://www.aglea.com/en/blog/tag/parameter-sap) - [processi security (1)](https://www.aglea.com/en/blog/tag/processi-security) - [profili (1)](https://www.aglea.com/en/blog/tag/profili) - [profili sap (1)](https://www.aglea.com/en/blog/tag/profili-sap) - [progetti security sap (1)](https://www.aglea.com/en/blog/tag/progetti-security-sap) - [quotazione borsa (1)](https://www.aglea.com/en/blog/tag/quotazione-borsa) - [rfc destination (1)](https://www.aglea.com/en/blog/tag/rfc-destination) - [role translation (1)](https://www.aglea.com/en/blog/tag/role-translation) - [s_tabu_dis (1)](https://www.aglea.com/en/blog/tag/s_tabu_dis) - [s_tabu_nam (1)](https://www.aglea.com/en/blog/tag/s_tabu_nam) - [s_tabu_rfc (1)](https://www.aglea.com/en/blog/tag/s_tabu_rfc) - [sap FIORI (1)](https://www.aglea.com/en/blog/tag/sap-fiori) - [sap btp (1)](https://www.aglea.com/en/blog/tag/sap-btp) - [sap data masking (1)](https://www.aglea.com/en/blog/tag/sap-data-masking) - [sap dati personali (1)](https://www.aglea.com/en/blog/tag/sap-dati-personali) - [sap developer (1)](https://www.aglea.com/en/blog/tag/sap-developer) - [sap earlywatch (1)](https://www.aglea.com/en/blog/tag/sap-earlywatch) - [sap grc 12 (1)](https://www.aglea.com/en/blog/tag/sap-grc-12) - [sap grc tables (1)](https://www.aglea.com/en/blog/tag/sap-grc-tables) - [sap gui history (1)](https://www.aglea.com/en/blog/tag/sap-gui-history) - [sap gui security (1)](https://www.aglea.com/en/blog/tag/sap-gui-security) - [sap gxp compliance (1)](https://www.aglea.com/en/blog/tag/sap-gxp-compliance) - [sap ilm gdpr (1)](https://www.aglea.com/en/blog/tag/sap-ilm-gdpr) - [sap license auditing (1)](https://www.aglea.com/en/blog/tag/sap-license-auditing) - [sap logon (1)](https://www.aglea.com/en/blog/tag/sap-logon) - [sap patch (1)](https://www.aglea.com/en/blog/tag/sap-patch) - [sap security blog (1)](https://www.aglea.com/en/blog/tag/sap-security-blog) - [sap security teal (1)](https://www.aglea.com/en/blog/tag/sap-security-teal) - [sap sos (1)](https://www.aglea.com/en/blog/tag/sap-sos) - [sap splunk (1)](https://www.aglea.com/en/blog/tag/sap-splunk) - [sap sso (1)](https://www.aglea.com/en/blog/tag/sap-sso) - [sap tabelle custom (1)](https://www.aglea.com/en/blog/tag/sap-tabelle-custom) - [sap tdms (1)](https://www.aglea.com/en/blog/tag/sap-tdms) - [sap_all_only_view (1)](https://www.aglea.com/en/blog/tag/sap_all_only_view) - [se16n (1)](https://www.aglea.com/en/blog/tag/se16n) - [secpol (1)](https://www.aglea.com/en/blog/tag/secpol) - [secure coding sap (1)](https://www.aglea.com/en/blog/tag/secure-coding-sap) - [secure operation map (1)](https://www.aglea.com/en/blog/tag/secure-operation-map) - [security awareness (1)](https://www.aglea.com/en/blog/tag/security-awareness) - [security bridge (1)](https://www.aglea.com/en/blog/tag/security-bridge) - [sentinel (1)](https://www.aglea.com/en/blog/tag/sentinel) - [sicurezza codice ABAP (1)](https://www.aglea.com/en/blog/tag/sicurezza-codice-abap) - [sicurezza dei dati sap (1)](https://www.aglea.com/en/blog/tag/sicurezza-dei-dati-sap) - [slaw (1)](https://www.aglea.com/en/blog/tag/slaw) - [social engineering (1)](https://www.aglea.com/en/blog/tag/social-engineering) - [sost (1)](https://www.aglea.com/en/blog/tag/sost) - [sql (1)](https://www.aglea.com/en/blog/tag/sql) - [su25 (1)](https://www.aglea.com/en/blog/tag/su25) - [super utenti sap (1)](https://www.aglea.com/en/blog/tag/super-utenti-sap) - [system users (1)](https://www.aglea.com/en/blog/tag/system-users) - [tabelle (1)](https://www.aglea.com/en/blog/tag/tabelle) - [tabelle SAP grc access control (1)](https://www.aglea.com/en/blog/tag/tabelle-sap-grc-access-control) - [ticket management system (1)](https://www.aglea.com/en/blog/tag/ticket-management-system) - [training (1)](https://www.aglea.com/en/blog/tag/training) - [transazioni sap (1)](https://www.aglea.com/en/blog/tag/transazioni-sap) - [userid (1)](https://www.aglea.com/en/blog/tag/userid) - [usmm (1)](https://www.aglea.com/en/blog/tag/usmm) - [ust04 (1)](https://www.aglea.com/en/blog/tag/ust04) - [zero trust security (1)](https://www.aglea.com/en/blog/tag/zero-trust-security) [See all](https://www.aglea.com/en/blog/what-are-sap-hana-roles#) ## [SAP Security Blog AGLEA RSS Feed](https://www.aglea.com/blog/rss.xml) Aglea s.r.l. P. IVA: IT 03868780960 - 2026 | Copy | [Note legali](https://cdn2.hubspot.net/hubfs/4422290/Aglea_November2018%20Theme/Pdfs/Privacy-policy-AGLEA.pdf) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Klea Duro", "url" : "https://www.aglea.com/en/blog/author/klea-duro" }, "dateModified" : "2024-06-14T10:13:16.179Z", "datePublished" : "2023-05-04T22:00:00.000Z", "headline" : "WHAT ARE SAP HANA ROLES?", "image" : [ "https://www.aglea.com/hubfs/Aglea/Imported_Blog_Media/SAP%20HANA%20ROLES-Jun-14-2024-10-10-17-5282-AM.jpg" ], "mainEntityOfPage" : { "@id" : "https://www.aglea.com/en/blog/what-are-sap-hana-roles", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject" }, "name" : "Horsa S.p.A." } } ```