PFCG role
PFCG role (authorization role)
Also known as: business role
A role maintained in transaction PFCG that bundles launchpad content, such as business catalogs, with the authorizations users need.
A role combines launchpad content — catalogs, spaces and pages — with authorization objects and field values. Users receive access through role assignments.
In SAP S/4HANA Cloud, business roles are maintained in the Maintain Business Roles app and combine business catalogs. The apps a role contains can determine the license tier of the users assigned to it.
In ERP Preflight
IAM Cost Optimizer finds apps that raise a role’s license tier, redundant catalogs, unused critical authorizations and emergency roles without an end date; Fiori 403 Root-Cause Doctor finds the missing authorization behind a 403.
Problems that involve PFCG role
- CriticalAuthorization check failed (SU53)
- MajorCatalog fully contained in another catalog of the role
- MinorRole assignments of the target still valid (AGR_USERS)
- BlockerICF service node inactive (SICF)
- CriticalBTP destination rejected by or not authenticating to the backend
- CriticalDenied by SAP Cloud Connector
- CriticalCSRF token missing or invalid on modifying request
- CriticalGateway service not registered / no system alias
Related terms
Free tools
- Fiori 403 decision tree
Guided questions to the likely cause category of a Fiori “not authorized” error — and what evidence to collect.
Background articles
- Troubleshooting HTTP 403 Forbidden in SAP Fiori appsThe usual causes of a 403 error when a Fiori app loads or calls its OData service — missing service authorizations, incomplete roles, inactive ICF services — and a systematic way to find the one that applies.
Written for ERP Preflight · reviewed September 27, 2026
All glossary termsERP Preflight is independent and not affiliated with SAP SE. SAP, ABAP, Fiori and S/4HANA are trademarks of SAP SE.