Xiting SAP Security Blog

Changes and Challenges with S/4HANA Part III


In the previous articles about the migration to S/4HANA, we talked about the changes in transactions and the difficulties that come with them. One more of a general problem is the question “Where do I start?” No matter if you just want to see what changes might have to be done to your roles or if you are already migrating to S/4HANA. The Role Designer, part of the Xiting Authorizations Management Suite (XAMS), is the right place for you to get started.

How the Role Designer works with S/4HANA

In a nutshell, Role Designer imports ST03N data from the SAP system into a virtual project. You can choose for which users and which period you want to load the data. You can virtually design new roles from scratch, load existing roles into the project or use the templates that Xiting delivers. Note, that everything you do in the Role Designer is just virtual, there are no real roles build in PFCG or changes done to your ST03N.

Changes and Challenges with S/4HANA Part III
Role Designer Design View

This is the main window of the Design-Mode in the Role Designer. On the left hand, you can see the users and which transactions they have used. In the middle are your virtually designed roles. They do not exist in PFCG and contain the transactions you plan to put in these roles. The Role Designer works via Drag & Drop, that means you choose a transaction from the left side, drop it into a role in the middle and in the end, you assign a role via Drag & Drop to a user on the right side.

In the case that you are migrating to S/4HANA and you want to take your old roles with you, you could load the existing assigned roles along with the data from the ST03N and virtually migrate your roles to S/4HANA. If you want to start on a green field, you can choose to load the ST03N data without the roles.

The Business Modelling Mode

The essential functions for the migration lie behind the button for the “Business Modelling Mode.”

Changes and Challenges with S/4HANA Part III
Migration Mode in Role Designer

This function takes all the transactions that are in the project and compares them to the data stored in our solution for replacements. This data comes from the Simplification List issued by SAP and enriched by our experience from previous projects. You can also upload your replacement data via a CSV-file in the next step.

Changes and Challenges with S/4HANA Part III
Choosing the type of Migration Data

Here you can choose whether you want to use the data we provide or if you want to use your CSV template. We provide data for S/4HANA and S/4HANA Finance.

An Example

In this example, we choose the S/4HANA migration data. Now you can see which transaction will be replaced by other transactions or simply won’t be available in S/4HANA (indicated by the trash can icon). When a transaction is replaced by another, you can choose if you want to replace the transaction as mentioned in our data. Alternatively, you can just append the new transaction to the role. This has the advantage that the users can still use the old tcodes if something should go wrong with the new transactions. You can see that this report does not only cover the transactions, but also Fiori or Webdynpro replacements.

Changes and Challenges with S/4HANA Part III
Migrate Usage Data to S4

By selecting lines and clicking on big the trashcan-icon in the upper left, you can exclude lines from the migration. These transactions will not be considered in this migration run. They will appear again the next time you run the report.

When you have checked the checkbox and clicked on “Enter,” the virtual migration of the roles will begin. When you click on the info button, you can get details on the migration. The result should look like this:

Changes and Challenges with S/4HANA Part III
Migrate Usage Data

Now you can see, that the usage data and transactions in the roles have changed. E.g. the BP transaction is now in the role.

Changes and Challenges with S/4HANA Part III
Role Designer Design View

When you are happy with your migrated roles, you can also generate them in PFCG by clicking on the generate-icon in the “Reports” section. The system will build the roles with the menu items; you’ll only have to fill in the values for the authorization objects.

Changes and Challenges with S/4HANA Part III
Role Designer Report View generate roles


With the Role Designer, you can see how the processes in your company will change with the migration to S/4HANA. Also, if you are already migrating, it helps you to build your roles for S/4HANA. Whether you want to use your old roles or start from scratch, the Role Designer can show you what has been used and what can be used in the future.

Related Content to S/4HANA

Mario Taubert

Mario is a SAP Security Consultant at Xiting GmbH in Germany with a strong focus on S/4HANA Migration with the help of the Xiting Authorizations Management Suite (XAMS).