Operations
SAP role problems: license tiers, redundant catalogs, emergency access
IAM Cost Optimizer analyses role composition and assignments and reports role content that raises license tiers or grants more access than is used.
Detected by:IAM Cost Optimizer
Documented problems
- CriticalEmergency role assigned without end date
IAM_PERMANENT_EMERGENCY_ROLE
- MajorSingle app raises the role's license tier
IAM_LICENSE_TIER_INFLATION_DRIVER
- MajorCatalog fully contained in another catalog of the role
IAM_REDUNDANT_CATALOG_DETECTED
- MajorRole carries more risk than an equivalent role granting the same apps
IAM_ROLE_RISK_ELEVATED
- MajorCritical authorization never used
IAM_UNUSED_CRITICAL_AUTHORIZATION
- MinorSmaller catalog composition covers all used apps
IAM_ALTERNATIVE_ROLE_COMPOSITION
- MinorChange app never used although a read-only alternative exists
IAM_READ_ONLY_ALTERNATIVE_AVAILABLE
Terms used in this area
Background articles
- Troubleshooting HTTP 403 Forbidden in SAP Fiori appsThe usual causes of a 403 error when a Fiori app loads or calls its OData service — missing service authorizations, incomplete roles, inactive ICF services — and a systematic way to find the one that applies.
ERP Preflight is independent and not affiliated with SAP SE. SAP, ABAP, Fiori and S/4HANA are trademarks of SAP SE.