SAPFree referencePDF, Excel, Word exportSAP ECC and S/4HANA

SAP User Types and Default Users Reference

Auditors and GRC analysts ask the same questions in every SAP review: what user types exist, who uses SAP*, and are the standard users locked down? This reference gives you the answers in a form you can search, export and attach to a workpaper.

Download:

Item	Type	What it is	Audit and hardening guidance
Dialog (A)	User type	Interactive person using SAP GUI or a browser; subject to password rules and expiry	Use for named individuals only; no sharing of IDs; enforce password policy and inactivity review
System (B)	User type	Non-interactive user for background processing and internal system communication	Cannot log on interactively; password is not subject to expiry; keep authorizations minimal and review owners
Communication (C)	User type	Dialog free user for external RFC and similar calls	Use for RFC integration; restrict with S_RFC and avoid broad roles such as SAP_ALL
Service (S)	User type	Dialog user for an anonymous or larger group of users, such as for ICF services	Assign only to services that need anonymous access; password changes are controlled by administrators; minimise authorizations
Reference (L)	User type	No logon; used only to give additional authorizations to other users via reference user assignment	Use sparingly; reference user assignments are hard to see in role reviews, so include them in SUIM reviews
SAP*	Default user	Delivered super user in the standard clients	Lock it, set a strong password, keep login/no_automatic_user_sapstar active, and monitor any use in the Security Audit Log
DDIC	Default user	ABAP Dictionary and software logistics user delivered in the standard clients	Needed for upgrades and some tasks; change the initial password, restrict logon and review usage
TMSADM	Default user	Transport Management System communication user, created when TMS is configured	Communication type; change the default password and do not give dialog privileges
SAPCPIC	Default user	Legacy CPI-C user in the standard clients	Change the initial password or lock if CPI-C is not used
EARLYWATCH	Default user	Legacy EarlyWatch service user in the service client	Change the password or lock if not used for SAP service sessions
Client 000	Client	SAP delivered reference client used as a copy source and for some Basis tasks	Do not use for business data; restrict access to Basis staff; secure SAP* and DDIC
Client 001	Client	Delivered client in some installations, typically a copy of 000	Do not use for business data if present; lock or delete unused clients according to your policy
Client 066	Client	Legacy EarlyWatch client in older releases	Delete it or lock its users if you do not use it
SAP_ALL	Profile	Composite profile granting all authorizations in the system	Never assign permanently to business users; if used for emergency access, control and log it with firefighter processes
SAP_NEW	Profile	Composite profile that adds authorization checks introduced by upgrades	Use only temporarily after an upgrade while roles are adjusted; then remove it
S_A.SYSTEM	Profile	Delivered profile for system administrators	Restrict to the Basis team; review who holds it regularly
S_A.DEVELOP	Profile	Delivered profile for developers	Avoid in production; development authority should not exist in production clients

Delivered users and clients vary by release and installation. Verify what exists in your system with SUIM or table USR02 and the client list in SCC4 before applying any recommendation.

SAP user review support

Optional: talk to us about automating user and role extracts for your access reviews.

Optional. The tool and every export work without this. No spam.

How to use the reference

Search for a user type or user name, then read the guidance column as the control you would expect to see evidence for. During a user access review, filter your USR02 extract by USTYP and compare it with the Type column here. During hardening, work down the default users and clients rows and tick off each one. Export to Excel to attach it to a controls matrix.

Pull user types from USR02 (field USTYP) or SUIM
Check each default user in each client, not only the one you log on to
Record the evidence you gathered next to each row after export

Why user types matter

User type controls how an ID can log on and how its password behaves. A System or Communication user cannot be used for interactive logon, so it is the right choice for interfaces, but its password does not expire, so it needs ownership and periodic review. A Service user is shared and anonymous by design, so it should only exist for tightly scoped services. A dialog user is a named person. Many audit findings come from dialog users used as interface IDs.

Common mistakes

The usual findings are SAP* or DDIC with an initial password in a forgotten client, SAP_ALL assigned to a support user without expiry, and interface IDs set to dialog type. Another recurring issue is reference users that quietly add authorizations that never show up in the user's own role list. Check the full authorization picture in SUIM, not only PFCG.

Lock SAP* and verify the profile parameter that disables hardcoded SAP*
Set an end date on emergency assignments of broad profiles
Convert interface dialog users to system or communication users

Frequently Asked Questions

What is the difference between a system user and a communication user?

Both cannot log on interactively. A system user is for background processing and internal communication, a communication user is for external calls such as RFC. Both have password rules that differ from dialog users, so each needs an owner and review.

Should SAP* be deleted?

Deleting it can re-enable hardcoded fallback behaviour unless the profile parameter that disables it is set. The usual approach is to lock the user, set a strong password, set the parameter and monitor any use.

Where do I see user types in the system?

In SU01 on the Logon Data tab, in SUIM user reports, or in table USR02 field USTYP. For audits an extract of USR02 per client is the common evidence.

Is SAP_NEW safe to leave assigned?

No. It exists to avoid authorization failures right after an upgrade. It grants broad access to newly checked objects, so remove it once your roles have been updated through SU25 and PFCG.

If you review SAP users across several systems each quarter, we can help build a repeatable extract and review workflow that stays inside your network.

Talk to an Expert Explore More Free Tools

Related Tools

SAP

More SAP tools

See all

Back to All Tools