Risk
Excessive authorizations can bypass normal business processes and control mechanisms.
ABAPHANAJavaBTP
Settings and priorities
| Technology / priority | Parameter or mechanism | Setting and purpose |
|---|---|---|
| ABAP Critical | SAP_ALL ; SAP_NEW | No routine use Emergency and upgrade exceptions require strict control. |
| ABAP Critical | S_TABU_DIS * ; S_TABU_NAM * ; S_TABU_SQL * | Restrict global access Review table display and maintenance privileges. |
| ABAP Critical | S_TCODE * ; S_SERVICE * ; S_START * ; S_PROGRAM * | Restrict arbitrary execution Replace broad access with the scope justified by the role. |
| ABAP Critical | S_DEVELOP DEBUG 01/02 ; S_DBG 02 | Strictly controlled debugging S_DBG depends on ABAP Platform 2022 / SAP_BASIS 7.57+. |
| ABAP Critical | S_DEVELOP FUGR/CLAS 16 ; S_RFC * | Restrict function and method execution Controls local testing and remote execution. |
| ABAP Critical | S_USER_GRP · 01, 02, 05, 06 | Restrict user administration Covers creation, changes, passwords, locking and deletion. |
| ABAP Critical | S_SPO_ACT ; S_RFC_ADM ; S_QUERY 23 ; S_DBCON 36 | Scope according to responsibilities Other users’ spool, destinations, queries and SQL Editor updates. |
| ABAP Standard | USR02, USH02, USRPWDHISTORY · SPWD | Assigned group and restricted read access Protects hashes through S_TABU_DIS and S_TABU_NAM. |
| HANA Critical | DATA ADMIN | Do not grant to users or roles Restricts an excessive system privilege. |
| Java Standard | Administrators ; SAP_J2EE_ADMIN | System administrators only Distinguish single-stack and dual-stack installations. |
| BTP Standard | Global Account/Directory/Subaccount Administrator | Minimum number of users Controls role collections. |
| BTP Standard | Org Manager ; Space Manager ; Space Developer | Minimum number of members Controls Cloud Foundry privileges. |
| BTP Critical | Neo · NonActiveApplicationPermission | Developer roles only Prevents business users accessing old application versions. |
| BTP Standard | Neo · Manage Authorization / Account Members / Audit Logs | Minimum OAuth client scope Controls administration APIs and audit retention. |
How to verify
- Review effective authorizations, not only role names.
- Restrict wildcards and broad profiles.
- Verify protection of password-hash tables.
- Apply expiry and monitoring to emergency exceptions.
Related topics
RFC · S_RFC and role maintenance ↗