haven SAP Security
Browse knowledge
Knowledge base
AUTHASSIGN / SECURITY BASELINE

Role assignments and transports

Separate the transport of role definitions from granting access to individuals.

Risk

Transporting user assignments can grant unintended access in the target system.

ABAPBTP

Settings and priorities

Technology / priorityParameter or mechanismSetting and purpose
ABAP
Standard
PRGN_CUST · US_ASGM_TRANSPORTNO
Excludes user assignments when exporting roles.
ABAP
Standard
PRGN_CUST · USER_REL_IMPORTNO
Excludes user assignments when importing roles.
BTP
Standard
Neo · Java, HTML5 and subscriptionsAssignments through groups and roles
Avoids individual user-to-role assignments.

How to verify

  1. Check both PRGN_CUST settings.
  2. Test role export and import.
  3. Grant access through a separate approved process.
  4. In Neo, use managed groups instead of individual assignments.

Related topics

Roles and authorizations ↗

Baseline priorities and implementation ↗