Installation/upgrade of SAP systems based on HANA Platform
SM20 Evaluation of the Security Auditlog
Finally, the presentation layer contains software components for the graphical presentation of the application. It thus forms the interface to the users (GUI).
I recommend that you schedule the background job PFCG_TIME_DEPENDENCY with the report RHAUTUPD_NEW. Scheduling the RHAUTUPD_NEW report with two variants has proven to be a best practice: Once a day before users log on for the first time (e.g. midnight or very early in the morning). This way the users are synchronized once a day. Once a month (or even once a week) with the option "Perform cleanup", so that obsolete profiles and user mappings are regularly cleaned up. Also handy: If the naming conventions of your roles allow it, you can also align the report according to different time zones. For example, I have a customer who runs the user synchronization for his users in the USA and Asia at different times, so that the daily business of the respective users is not disturbed.
Rights-based workflows in accounting
In order to demonstrate the necessary open spaces and capacities and also to demonstrate the innovative power of the SAP basis, regular reporting to the CIO or the management is recommended. If a product or technology is successfully evaluated, this can also be published as a success story within the framework of SAPBasis marketing (see chapter 7.4 in the Master's thesis) within the company.
The default permissions to open and use a launchpad are the SAP_UI2_USER_700. The role for the administration is SAP_UI2_ADMIN_700. In the administration interface, the launchpad can be customised, so this permission should only be released to a few users for administration.
Tools such as "Shortcut for SAP Systems" complement missing functions in the SAP basis area.
Trust is good, control is better In order to avoid employees being entitled beyond your area of competence, user data and permissions must be continuously adjusted to the current requirements.
Therefore, they should be deactivated / set to inactive as soon as possible, as soon as the system operation is ensured.