SAP roles and authorisations
RoleDesk
Request, approve and review SAP access with segregation-of-duties checks — for S/4HANA on-premise and in the cloud.
Access request for A. Raman (Accounts payable)
Z_FI_AP_CLERKPost and pay vendor invoicesZ_MM_VENDOR_MAINTCreate and change vendorsRoleDesk gives security teams one place to run SAP access: requests with approvals, SoD risk checks before anything reaches SAP, periodic access reviews, emergency access with sign-off, and a clear view of who can do what. It works with or without SAP GRC.
RoleDesk reads users, roles and authorisations from your SAP systems and keeps them in sync. Every request is checked against your segregation-of-duties rules — down to authorisation object and field values — before it is approved, and provisioning only changes what SAP does not already show.
What it does
Access requests with approvals
Single or bulk requests for joiners, movers and leavers, routed to role owners, with delegation and ageing.
Segregation of duties
Risks defined on transactions and authorisation values; conflicts are shown before approval with mitigation on record.
Periodic reviews
Managers confirm or remove access, with usage data showing which roles a person actually uses.
Emergency access
Time-limited firefighter access that is revoked automatically and signed off afterwards.
Who can do what
Per-user view of roles, transactions, org levels and authorisations, and a "who can" search across systems.
Works with SAP GRC
Use RoleDesk's own risk analysis, send requests to GRC Access Request Management, or both.
Modules
S/4HANA on-premise
Connected over RFC for user, role and authorisation data and provisioning.
S/4HANA Cloud
Connected through the SCIM identity interface.
Role design
Role mining into business roles, role comparison and controlled changes to role content.
Evidence for audit
Exports of approvals, reviews and emergency sessions for auditors.
Questions
Do we need SAP GRC?
No. RoleDesk has its own rule engine. If you have GRC, RoleDesk can use it for risk analysis and access requests.
See RoleDesk with your own data
A 45-minute walkthrough with someone who has run these projects, using examples from your industry.