What authorization object can be used to restrict which users a security administrator is authorized to maintain?

Question

Options

• AS_USER_GRP
• BS_USER_SAS
• CS_USER_GRD
• DS USER AUT

• A
  74% (14)
• B
  5% (1)
• C
  5% (1)
• D
  16% (3)

Explanation

S_USER_GRP is the correct authorization object because it controls access to user maintenance transactions (like SU01) by user group. Administrators can only create, modify, or display users who belong to the user groups specified in their S_USER_GRP authorization - making it the standard mechanism to segregate administrative duties by user population.

Why the distractors are wrong:

• S_USER_SAS is not a standard SAP authorization object; it does not exist in the authorization framework for user administration.
• S_USER_GRD is similarly not a recognized SAP authorization object - a plausible-looking but fabricated option.
• S_USER_AUT (note the space, suggesting a typo/distractor) is not a valid object; it may be confused with S_USER_AUTH, which controls authorization object maintenance, not user record maintenance by administrator scope.

Memory tip: Think GRP = GRouP - S_USER_GRP restricts which user groups an admin can touch, effectively partitioning who can manage whom.

No community discussion yet for this question.