What authorization object can be used to authorize an administrator to create specific authorizations in roles?

Question

Options

• AS_USER_VAL
• BS_USER_TCD
• CS_USER_AGR
• DS_USER_AUT

• B
  6% (2)
• C
  3% (1)
• D
  91% (29)

Explanation

S_USER_AUT is correct because it is specifically designed to control which authorization objects and field values an administrator is permitted to create or maintain when building roles in SAP. It enforces the "no more than yourself" principle - admins can only grant authorization values they themselves possess, preventing privilege escalation.

Why the distractors are wrong:

• A (S_USER_VAL) deals with restricting specific field values in user master records, not with creating authorizations inside roles.
• B (S_USER_TCD) governs which transaction codes can be assigned to roles - it's about transactions, not authorization object values.
• C (S_USER_AGR) controls access to role maintenance itself (who can open/edit roles in PFCG), but not which specific authorization values they can insert into those roles.

Memory tip: Think AUT = AUThorizations - S_USER_AUT is the gatekeeper for what authorization values an admin can actually author into a role. If you remember that AGR = "agreements" (roles/profiles) and AUT = the actual authorization values within those roles, the distinction becomes clear.

No community discussion yet for this question.