SAP MM Related Authorization Objects How To Find Out and Assign
SAP MM Related Authorization Objects How To Find Out and Assign
This document explains the basic details of authorization object, how to find out and assign missing authorizations objects and what are the common
authorization objects used in Materials Management module. This document does not include creation of user roles, creation of custom authorization
objects, creation of authorization class etc.
Important Note:
Assigning authorization is a highly sensitive transaction, which has direct impact on your customer confidentiality and user authorizations. So, kindly
use this knowledge to work with your BASIS/Security team. Or, carry out the changes only with prior approval from your system administrator.
1. Authorization object:
Authorization object is an element of the authorization system. Authorizations are checked against objects in the system. Authorization objects enable
complex checks (linked to several conditions) of an authorization. For the authorization check to be successful, the user must pass the check for each
field contained in the object.
In authorization objects, authorization fields represent the values to be tested during authorization checks. For example, Movement type in material
movements, document type, plant etc in purchasing documents etc. An authorization object combines up to 10 authorization fields.
Here, make a note to drill down and get both authorization object and field name. This will make the job of Basis/Security consultants easy and they
can provide the required authorization correctly.
In SU53,
Here, Authorization object, fields and corresponding values will be displayed. This data is
sufficient to provide required authorizations.
Here, in SE16N, for table TOBJ, Enter the authorization class (Say MM_E for Materials Management: Purchasing).
You can see the list of authorization object and fields relevant for entered class.
1. Assigning missing Authorization objects:
Authorization objects are assigned to user roles. First, find out the user role in Transaction SU01.
Enter the user ID and click display.Click on Roles tab and copy the user specific role.
Go to Transaction PFCG.
Click on Find (or press CTRL+F) and enter the missing authorization object identified earlier. Enter the field also, if required.
System will take you to the respective Authorization object. Click on Edit and enter the required values. Click on
if authorization needs to be provided for all the possible values of a particular authorization field.