The critical authorizations can be defined with or without S_tcode value. If the rule set is defined correctly, the report will give the overview of users having access to critical authorizations. The Definition of SoD conflicts is only using AND logic.ДЇigure 5: Results of critical combinations user level Once again, a detailed analysis how a user gets the authorizations is not possible with this report and the information if a user did really use the transactions of the SoD conflict is missing (Figure 5). A critical combination (SoD conflict) is one or more critical authorizations combined with AND logic (figure 4).ДЇigure 4: Definition of critical combinations in report RSUSR008_009_NEWДЄfter the rule set with critical combinations is defined, the report runs and the users are shown. To report the SoD conflicts, you have to define the critical authorizations first, followed by the critical combinations. The report shows the assignment of the critical authorizations and does not show you the SoD conflicts. The information that shows if the transaction was executed by the user is also missing.ДЇigure 3: Results of critical authorizations user level A drill down functionality to see how the user gets the access to the critical authorizations is unfortunately not possible (Figure 3). The transaction and corresponding authorizations are defined (Figure 2).ДЇigure 2: Set up of critical authorizations in report RSUSR008_008_NEWДЄfter the critical authorizations are defined, the report can be run and the results (users/roles having access to the defined critical authorizations) are shown on the screen. In this example I will create a simple rule set for the critical authorizations to maintain customer master data finance view. When this is done, you can define the critical combinations. The critical authorizations must be defined. The rule set contains critical authorizations and critical combinations. Before you can run the report, you need to define the rule set first. With this report is it possible to get an overview of users/roles having access to critical authorizations and/or critical combinations (SoD conflicts). It is possible to use the standard report RSUSR008_009_NEW to set up a basic SoD analysis in the SAP system (Figure 1). The first one is using the standard SAP report RSUSR008_009_NEW and the second one is using CSI Authorization Auditor. This blog describes how you can set up the Segregation of duties (SoD) analysis for the SAP security concept.

Sap authorizations made easy ecc6