# Infor XA User List Report: Users, Status and Access for an Audit

> Source: https://netray.co/erp-help/infor-xa-user-list-report-access-audit
> Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems.
> Section: ERP Help

## Short answer

Infor XA runs on IBM i, so a complete user list is built from two layers: the IBM i user profiles (who can sign on, status, last sign-on, group profiles, special authorities) and the XA application security tables (which menus, functions and facilities each user may run). Export the first with DSPUSRPRF or the QSYS2.USER_INFO view, add the second from your XA security setup, and join them by user ID.

## Kind

how-to

## System

infor-xa

## Erp

Infor XA (IBM i)

## Module

Security / User Administration

## Query

infor xa user list report

## Alternate Queries

- infor xa list of users and authorities
- infor xa user access report for audit
- ibm i user profile report for xa audit

## Applies To

Infor XA (formerly MAPICS XA) on IBM i. Commands apply to any supported IBM i release; the QSYS2.USER_INFO view needs IBM i 7.2 or later.

## Steps

### Produce the user list and access report

**Items:**

Sign on to the IBM i partition with a profile that has *ALLOBJ or *SECADM authority (or delegated audit authority) so every profile is visible.

Export all profiles to a file: DSPUSRPRF USRPRF(*ALL) TYPE(*BASIC) OUTPUT(*OUTFILE) OUTFILE(QTEMP/XAUSERS). This gives status, last sign-on, password-expired flag, group profile, user class and special authorities.

Alternatively query the view from STRSQL or a SQL client: SELECT AUTHORIZATION_NAME, STATUS, LAST_SIGNON_DATE, USER_CLASS_NAME, GROUP_PROFILE_NAME FROM QSYS2.USER_INFO ORDER BY AUTHORIZATION_NAME.

Filter to the XA population: keep only profiles that belong to your XA user group or that have authority to the XA production libraries (use DSPOBJAUT or the AUTHORIZATION_LIST views for the libraries).

Pull the XA-side access: export the XA user-to-function or user-to-menu security setup from the XA security maintenance tables in your environment, and join to the profile list by user ID.

Flag exceptions: *DISABLED profiles still holding XA access, profiles with no sign-on in 90 days, profiles with *ALLOBJ, and shared or generic IDs.

Save the output to Excel or CSV with the run date, system name and who ran it, and keep it with the audit evidence.

## Sections

### Why two layers of access exist

**Body:**

An auditor asking for the XA user list usually wants proof of who can do what in the ERP. On IBM i that answer lives in two places. The operating system decides who can sign on and which objects (libraries, files, programs) a profile can touch. XA then decides which application functions a signed-on user can run.

If you only report the IBM i layer you show who exists, not what they can do in order entry, purchasing or the general ledger. If you only report the XA layer you miss users with broad object authority who could bypass the application entirely. A credible report covers both and states which version of each it reflects.

### IBM i side: commands and SQL

**Body:**

DSPUSRPRF with OUTPUT(*OUTFILE) writes a database file you can query or download, which is more useful for an audit than a printed spool. DSPAUTUSR gives a compact list of profiles with their group and password status and also supports an outfile.

On IBM i 7.2 and later the QSYS2.USER_INFO view returns the same information in SQL, including last sign-on date and whether the profile is enabled, so you can run it from ACS Run SQL Scripts and export directly. Use it for repeatable quarterly reviews instead of ad hoc green-screen output.

**Code:**

- DSPUSRPRF USRPRF(*ALL) TYPE(*BASIC) OUTPUT(*OUTFILE) OUTFILE(QTEMP/XAUSERS)
- SELECT AUTHORIZATION_NAME, STATUS, LAST_SIGNON_DATE, USER_CLASS_NAME,
       GROUP_PROFILE_NAME, TEXT_DESCRIPTION
FROM QSYS2.USER_INFO
WHERE STATUS = '*ENABLED'
ORDER BY LAST_SIGNON_DATE

### XA application security side

**Body:**

XA maintains its own security definitions for menus and functions, set up through the XA security and user maintenance functions. The exact tables and screens depend on your XA release and whether you use the older menu-level security or finer function-level settings, so confirm with your XA administrator or the vendor documentation before promising an auditor a specific file name.

Treat the XA export as a join target: one row per user and function, then summarise to roles or groups for readability. Segregation-of-duties checks (same user can create and approve a purchase order, or enter and release a payment) are the findings auditors care most about.

## Pitfalls

- Reporting only IBM i profiles and calling it an application access report.
- Leaving former employees *ENABLED because the XA side was cleaned up but the operating system profile was not.
- Missing group profile inheritance: a user can gain object authority through a group profile that never shows on their own record.
- Running the report without *ALLOBJ or audit authority and silently getting an incomplete list.
- Treating generic or shared IDs (such as a shop floor terminal profile) as normal users instead of listing them as exceptions with a named owner.

## Ai Angle

An assistant grounded in your IBM i and XA data can answer the audit question directly, such as which enabled users have not signed on in 90 days and still hold purchasing approval, by running read-only queries over the profile and security files and showing the query it used. Netray's private AI layer runs on-prem next to the IBM i partition, so user and authority data never leaves your network.

## Faq

### How do I list all users in Infor XA?

**Answer:** Start at the IBM i layer: DSPUSRPRF USRPRF(*ALL) TYPE(*BASIC) OUTPUT(*OUTFILE) or the QSYS2.USER_INFO view lists every profile with status and last sign-on. Then add XA application security data and join by user ID so the report also shows which functions each user can run.

### Can I see when an XA user last signed on?

**Answer:** Yes at the operating system level. Both DSPUSRPRF and QSYS2.USER_INFO show the last sign-on date for each profile. That is system sign-on, not necessarily the last time the user ran a specific XA function, which would need job logs or journal data.

### What do auditors usually ask for besides the user list?

**Answer:** Typically the approval process for new and changed access, evidence that terminated users were disabled promptly, a list of users with powerful special authorities, and a segregation-of-duties review of finance and purchasing functions. Keep dated exports as evidence.

### Do I need a special tool to produce this?

**Answer:** No. Native IBM i commands and SQL are enough for the profile layer, and Excel handles the join and filtering. Third-party IBM i security tools add scheduling and richer reports, but they are not required for a basic audit extract.

## Search terms

infor xa user list report, infor xa user access report, ibm i user profile report, dspusrprf outfile, qsys2.user_info, xa security audit, infor xa segregation of duties, mapics xa users, ibm i audit user list, infor xa application security

---
Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json