SAPFree referencePDF, Excel, Word exportSAP ECC and S/4HANA

SAP Critical Authorization Objects: Searchable Reference With Key Fields

Auditors and GRC teams keep asking the same question: which authorization objects can really hurt us? This reference lists commonly reviewed SAP objects with their key fields and the risk each one carries, so you can build a critical access list without starting from a blank page.

Download:

Authorization object	Key fields	Area	Typical rating	Why it matters
S_TCODE	TCD	Basis	High	Controls which transactions a user may start; wildcard values open the whole system.
S_DEVELOP	DEVCLASS, OBJTYPE, OBJNAME, P_GROUP, ACTVT	Development	Critical	Create or change ABAP code; activity 02 or debug with change (ACTVT 02 on DEBUG) bypasses business controls.
S_TABU_DIS	DICBERCLS, ACTVT	Data access	Critical	Table maintenance by authorization group; display or change of business data via SE16, SM30.
S_TABU_NAM	TABLE, ACTVT	Data access	High	Table access by table name; used with newer table display tools.
S_TABU_CLI	CLIIDMAINT	Data access	High	Allows maintenance of client-independent tables.
S_USER_GRP	CLASS, ACTVT	User admin	Critical	Create, change, lock and delete users within user groups.
S_USER_AGR	ACT_GROUP, ACTVT	User admin	Critical	Maintain roles and assign them to users.
S_USER_PRO	PROFILE, ACTVT	User admin	Critical	Maintain and assign authorization profiles.
S_USER_AUT	OBJECT, AUTH, ACTVT	User admin	Critical	Maintain authorizations that roles reference.
S_USER_SAS	ACTVT, BNAME, CLASS	User admin	High	System-specific role assignment, including from a central system.
S_USER_SYS	ACTVT, SUBSYSTEM	User admin	Medium	Controls central user administration across systems.
S_RFC	RFC_TYPE, RFC_NAME, ACTVT	Basis	Critical	Calling function modules remotely; broad values let external callers run sensitive functions.
S_RFC_ADM	ACTVT, ICF_VALUE, RFCDEST, RFCTYPE	Basis	High	Maintain RFC destinations in SM59.
S_ADMI_FCD	S_ADMI_FCD	Basis	High	System administration functions such as system trace and memory access.
S_BTCH_ADM	BTCADMIN	Batch	High	Value Y allows management of all batch jobs, including other users' jobs.
S_BTCH_JOB	JOBACTION, JOBGROUP	Batch	High	Schedule, release, delete and display jobs by job group.
S_BTCH_NAM	BTCUNAME	Batch	Critical	Run background steps under another user name, which can mask who did what.
S_PROGRAM	P_ACTION, P_GROUP	Development	High	Execute or schedule programs by authorization group.
S_DATASET	PROGRAM, ACTVT, FILENAME	Basis	High	Read and write files on the application server file system.
S_C_FUNCT	CFUNCNAME, PROGRAM, ACTVT	Basis	Critical	Call C functions from ABAP, including operating system commands.
S_LOG_COM	COMMAND, OPSYSTEM, HOST	Basis	Critical	Run external operating system commands defined in SM69.
S_CTS_ADMI	CTS_ADMFCT	Transport	High	Transport administration functions, including import and system change option.
S_TRANSPRT	TTYPE, ACTVT	Transport	High	Create, change and release transport requests by type.
S_RZL_ADM	ACTVT	Basis	High	Computing center management, such as operation modes and profiles.
S_SPO_ACT	SPOACTION, SPOAUTH	Basis	Medium	Access to other users' spool requests.
S_QUERY	ACTVT, QUERY	Data access	Medium	SAP Query authoring and execution that can expose data across tables.
S_SERVICE	SRV_NAME, SRV_TYPE	Basis	Medium	Start external services for Web Dynpro and similar applications.
F_BKPF_BUK	BUKRS, ACTVT	Finance	High	Post and change accounting documents by company code.
F_LFA1_BUK	BUKRS, ACTVT	Finance	High	Maintain vendor master records by company code.
F_KNA1_BUK	BUKRS, ACTVT	Finance	High	Maintain customer master records by company code.
M_BEST_EKO	EKORG, ACTVT	Logistics	High	Create and change purchase orders by purchasing organization.
M_BEST_BSA	BSART, ACTVT	Logistics	Medium	Purchase document types allowed to the user.
M_MSEG_BWA	BWART, ACTVT	Logistics	Medium	Movement types a user may post in material documents.
V_VBAK_VKO	VKORG, VTWEG, SPART, ACTVT	Logistics	High	Sales order access by sales organization, channel and division.

Ratings are typical starting points used in many audit programs, not an SAP classification. Your own risk policy decides which objects count as critical. Verify field lists in SU21 for your release.

Critical access scan over your own data

Optional: see how role and authorization tables can be queried in plain language, privately, without sending data out.

Optional. The tool and every export work without this. No spam.

How to use the reference

Use the search box to filter by object name, field or risk. Start with the Critical and High ratings, then check which roles in your system contain them using the user information system (SUIM) or the where-used function for authorization objects. Export the filtered table to Excel to use as the base for your critical access policy or as a reviewer's input list. Pair each object with the values that make it dangerous, such as full activity or a wildcard in a restricting field. An object with a tightly restricted value is often acceptable, so the object name alone is never the finding.

Filter first, then export
Check the field values, not only the object
Record accepted exceptions with an owner

Why these objects matter

Most are risky because they sit above the business process. S_DEVELOP lets someone change code. S_TABU_DIS and S_TABU_NAM let someone read or change tables directly. S_USER_GRP, S_USER_AGR and S_USER_PRO let someone change who can do what. S_RFC and S_LOG_COM open paths into function modules and the operating system. The finance and logistics objects, such as F_BKPF_BUK and M_BEST_EKO, are not technical, but their combinations feed segregation of duties rules. Grouping by area makes it easier to assign each family to a control owner.

Technical objects: S_DEVELOP, S_C_FUNCT, S_LOG_COM
Identity objects: S_USER_GRP, S_USER_AGR, S_USER_PRO
Business objects: F_BKPF_BUK, M_BEST_EKO

Reading and applying the ratings

Treat the ratings as a starting point. A Critical rating means a single holder with broad values can bypass controls, so it should be limited to named, monitored users or firefighter access. High means review in every access review. Medium means review when combined with another risk. Always read the right-hand side column for the specific danger. For instance S_BTCH_NAM is critical because it allows a job to run as another user, which can erase the audit trail even when the user themselves has little business access.

Critical: restrict to named users and log use
High: include in every periodic review
Medium: review in combination with other access

Common mistakes

The usual mistake is to build a list of objects and stop there. The risk is in the field values, so a list without values generates noise. A second mistake is ignoring the role-level wildcard in S_TCODE, which can silently grant everything. A third is leaving the list unmaintained: new releases, add-ons and S/4HANA apps bring new objects. Review the list yearly, and note the SAP release it was last checked against. Finally, do not forget non-dialog access such as RFC users and batch users, which often hold broad authorizations.

Include values, not only names
Check technical and service users too
Re-review after each upgrade

Frequently Asked Questions

What are SAP critical authorizations?

They are authorizations that let a user bypass normal business controls, for example changing code (S_DEVELOP), reading or changing tables directly (S_TABU_DIS), administering users (S_USER_GRP) or calling remote functions (S_RFC). Each organization defines its own list based on its risk policy.

How do I find which roles contain a specific authorization object?

Use the user information system (SUIM) and its search for roles by authorization object, or the where-used list for the object. You can then filter by field values such as full activity or wildcards to focus on the roles that are actually risky.

Is S_TCODE with an asterisk always a finding?

It is almost always a finding for business users, because it allows any transaction to start. The actual access still depends on other objects checked inside each transaction, but the control at the entry point is gone. Technical administrators may have a documented exception.

Does SAP publish an official list of critical objects?

SAP documents the objects but does not publish one universal critical list. Audit firms and GRC tools publish their own rule sets, and this reference is a practical starting list. Always adapt it to your release, add-ons and policy.

If you want to query roles, users and authorization data in plain language, Netray can set that up over your own SAP data, read-only and inside your network.

Talk to an Expert Explore More Free Tools

Related Tools

SAP

More SAP tools

See all

Back to All Tools