Skip to content
ERP Preflight

Safe Decommission Preflight

Decommission preflight for users, technical / service / communication / job-step users and RFC destinations: jobs, job steps, RFC logons, scheduled integrations, workflows, roles, ownership and usage

Content reviewed September 26, 2026

Engine
SAFE_DECOMMISSION_PREFLIGHT
Domain
Operations
Version
2.1.0
Target releases
S4H_2022, S4H_2023, S4HANA_CLOUD_2402, S4HANA_CLOUD_2408
Accepted formats
JSON, CSV, TEXT

Input contract

Decommissioning extract: JSON {'target_type' (USER | TECHNICAL_USER | SERVICE_USER | COMMUNICATION_USER | JOB_STEP_USER | RFC_DESTINATION), 'target_user' or 'target_destination', 'evaluation_date', 'usr02': [...], 'tbtco': [...], 'tbtcp': [...], 'rfcdes': [...], 'swwwihead': [...], 'agr_users': [...], 'sm20': [...], 'scheduled_integrations': [...], 'ownership': [...]} or a sectioned CSV ([TARGET], [USR02], [TBTCO], [TBTCP], [AGR_USERS], [INTEGRATIONS], [OWNERSHIP], ...). Time-based rules require 'evaluation_date' (extract date); it is never taken from the system clock.

Required input

  • target_user or target_destination
  • per target type: USR02, TBTCO, RFCDES, SWWWIHEAD (users); + TBTCP (technical / job-step users); RFCDES + scheduled integration inventory (service / communication users, RFC destinations)
  • evaluation_date for recency rules
  • Optional inputs: AGR_USERS role assignments, TBTCP job steps, a scheduled integration inventory (name, type, technical_user, destination, active, last_run) and a technical ownership inventory (object_type, object_name, owner, backup_owner).

Finding codes

Finding codes (13)

  • DECOM_ACTIVE_RFC_DEPENDENCYDefault severity: CriticalCategory: DECOMMISSION_PREFLIGHT

    RFC destinations log on with the user

    Remediation: In SM59 switch the listed destinations to a dedicated communication user with least-privilege roles before deactivation.

  • DECOM_JOB_STEP_USER_DEPENDENCYDefault severity: CriticalCategory: DECOMMISSION_PREFLIGHT

    Background job steps run under the target user (TBTCP)

    Remediation: In SM37 open each listed job, change the step user (AUTHCKNAM) of the listed steps to a dedicated system-type batch user with the required roles, and release the job again before locking the target.

  • DECOM_LOCKED_USER_CALL_FLOODDefault severity: CriticalCategory: DECOMMISSION_PREFLIGHT

    Locked user still receives logon attempts

    Remediation: Identify the calling system from SM20/SM21 (terminal / RFC caller) and update its credentials or disable the interface before archiving.

  • DECOM_SCHEDULED_INTEGRATION_DEPENDENCYDefault severity: CriticalCategory: DECOMMISSION_PREFLIGHT

    Scheduled integrations depend on the target

    Remediation: Switch the listed interfaces (IDoc / RFC / HTTP / SOAP / OData / CPI) to a replacement technical user or destination - communication arrangement, SM59, SOAMANAGER or the integration flow - and run one scheduled cycle successfully before decommissioning.

  • DECOM_SCHEDULED_JOB_DEPENDENCYDefault severity: CriticalCategory: DECOMMISSION_PREFLIGHT

    Background jobs run under the user

    Remediation: In SM37 change the step user of the listed jobs to a technical (system-type) user before locking the account; released periodic jobs fail otherwise.

  • DECOM_TARGET_NOT_FOUNDDefault severity: CriticalCategory: DECOMMISSION_PREFLIGHT

    RFC destination to decommission absent from RFCDES

    Remediation: Check the destination name and client; export the complete RFCDES (SM59 destinations) and re-run.

  • DECOM_USER_NOT_FOUNDDefault severity: CriticalCategory: DECOMMISSION_PREFLIGHT

    Candidate user absent from USR02

    Remediation: Check the user ID and client; export the complete USR02 for the client and re-run.

  • DECOM_OWNERSHIP_TRANSFER_REQUIREDDefault severity: MajorCategory: DECOMMISSION_PREFLIGHT

    Target user is the recorded technical owner of objects

    Remediation: Assign a new owner (and backup owner) to every listed object in the ownership inventory before the user leaves; otherwise incidents and changes on these objects have no accountable contact.

  • DECOM_RECENT_ACTIVITY_DETECTEDDefault severity: MajorCategory: DECOMMISSION_PREFLIGHT

    User active within the grace period

    Remediation: Lock dialog logon and observe for 14–30 days (SM20 / ST03N) before deleting or archiving.

  • DECOM_WORKFLOW_AGENT_DEPENDENCYDefault severity: MajorCategory: DECOMMISSION_PREFLIGHT

    Open workflow items assigned to the user

    Remediation: Forward the open work items in SWIA / SBWP and update agent determination (rules / org assignment).

  • DECOM_ROLE_ASSIGNMENTS_ACTIVEDefault severity: MinorCategory: DECOMMISSION_PREFLIGHT

    Role assignments of the target still valid (AGR_USERS)

    Remediation: Remove or delimit the listed role assignments (SU01 / PFCG user comparison); for technical users first confirm that no interface relies on the authorizations they grant.

  • DECOM_TARGET_OWNER_MISSINGDefault severity: MinorCategory: DECOMMISSION_PREFLIGHT

    No technical owner recorded for the technical target

    Remediation: Record the responsible owner of the technical user / destination in the ownership inventory and obtain the owner's sign-off before decommissioning.

  • DECOM_SAFE_FOR_ARCHIVINGDefault severity: InfoCategory: DECOMMISSION_PREFLIGHT

    No dependencies found in the supplied extracts

    Remediation: Follow the decommissioning runbook: lock in SU01, set validity end, remove roles, archive with SARA. The verdict is limited to the supplied USR02/TBTCO/RFCDES/SWWWIHEAD extracts and evaluation date.

Input validation codes (5)

  • DECOM_ARCHIVE_REJECTEDDefault severity: MajorCategory: INPUT_VALIDATION

    Archive rejected by ingestion safety limits

    Remediation: The archive exceeded the 100:1 expansion ratio, 500 MB total size, entry-count or 2-level nesting limit, or contained path traversal / encrypted members. Upload a flat, unencrypted archive of the export files. No verdict was produced. Re-export the artifact in one of the formats accepted by Safe Decommission Preflight (JSON, CSV, TEXT) and re-run the analysis.

  • DECOM_INVALID_INPUTDefault severity: MajorCategory: INPUT_VALIDATION

    Artifact does not match the engine input contract

    Remediation: Provide the artifact type documented for this engine; unrelated or structurally invalid documents are rejected. No verdict was produced. Re-export the artifact in one of the formats accepted by Safe Decommission Preflight (JSON, CSV, TEXT) and re-run the analysis.

  • DECOM_PARSE_ERRORDefault severity: MajorCategory: INPUT_VALIDATION

    Artifact could not be parsed

    Remediation: Fix the syntax error at the reported line/column (or re-export the file unmodified from SAP). No verdict was produced. Re-export the artifact in one of the formats accepted by Safe Decommission Preflight (JSON, CSV, TEXT) and re-run the analysis.

  • DECOM_PAYLOAD_TOO_LARGEDefault severity: MajorCategory: INPUT_VALIDATION

    Artifact exceeds the size limit

    Remediation: Split the export (e.g. per package, company code or date range) so each upload stays under the service payload limit. No verdict was produced. Re-export the artifact in one of the formats accepted by Safe Decommission Preflight (JSON, CSV, TEXT) and re-run the analysis.

  • DECOM_INSUFFICIENT_INPUTDefault severity: InfoCategory: INPUT_VALIDATION

    Required input missing

    Remediation: Supply every input the engine's contract marks as required (see the engine catalog entry). No verdict was produced. Re-export the artifact in one of the formats accepted by Safe Decommission Preflight (JSON, CSV, TEXT) and re-run the analysis.

Back to the documentation
Safe Decommission Preflight — ERP Preflight Docs