Lesson 3: Introduction: From authorization configuration to authorization behavior

In this episode of the SAP Security Expert Learning Hub, explore how the SAP authorization model works, from authorization objects, fields, and generated profiles to runtime authorization checks. Using a practical purchase order scenario, learn why assigning a transaction code does not automatically grant complete access, how user comparison fits into the authorization lifecycle, and how multiple roles can expand a user's effective access through the Union Principle. We also discuss bolt-on roles, Segregation of Duties (SoD) risks, and the importance of following the Principle of Least Authorization (POLA). Whether you're starting your journey in SAP Security or strengthening your fundamentals, this episode will help you understand how authorization design translates into real-world access control. In this episode, you'll learn: How SAP authorization data is structured and maintained. How authorization profiles and user assignments work together. How SAP evaluates authorization checks at runtime. How multiple roles can broaden a user's effective access. Why least-privilege access is essential for reducing security and SoD risks. Listen to the episode and strengthen your understanding of SAP Security fundamentals. Explore more expert articles, learning resources, and podcasts at SAP Security Expert.