Roles & licensing · IAM Cost Optimizer
Smaller catalog composition covers all used apps
- Default severity
- Minor
- Finding code:
- IAM_ALTERNATIVE_ROLE_COMPOSITION
- Engine version:
- 1.2.0
What this finding means
IAM Cost Optimizer reports this finding with the default severity “Minor”.
About the engine: Fiori catalog over-licensing & authorization license tier minimizer
How to fix it
Rebuild the role from the proposed catalogs (the dropped catalogs contribute no app the assigned users executed); validate the proposal with the role owner over a full business cycle before removing catalogs.
How ERP Preflight detects it
The analysis is deterministic: the same exported files and the same knowledge snapshot always produce the same findings. No SAP system connection is required — you upload exports.
- Engine
- IAM Cost Optimizer
- Accepted formats
- JSON, CSV
- What to export
Role composition and assignments: JSON {'roles': [{role_name, catalogs, authorizations, assigned_users}], 'users': [...], 'catalogs': [...], 'price_categories': {...}, 'usage_records': [...], 'read_only_alternatives': {app_id: read_only_app_id}} or CSV exports AGR_USERS (UNAME, AGR_NAME), AGR_1251 (AGR_NAME, OBJECT, FIELD, LOW), catalog/app, ST03N usage and read-only alternatives (APP_ID, READ_ONLY_APP_ID).
- Required input
- business roles or user role assignments
- Evidence
- Each finding points to the artifact path, line and column, the code snippet and the SHA-256 of the uploaded file. Findings without such a pointer are demoted to confidence UNKNOWN.
- Confidence
- Each finding names the knowledge it relies on () and is capped by that source’s verification status.
- Target releases of the engine
- S4H_2022, S4H_2023, S4HANA_CLOUD_2402, S4HANA_CLOUD_2408
Related findings
- MajorCatalog fully contained in another catalog of the role
- CriticalEmergency role assigned without end date
- MajorSingle app raises the role's license tier
- MajorRole carries more risk than an equivalent role granting the same apps
- MajorCritical authorization never used
- MinorChange app never used although a read-only alternative exists
Terms used on this page
Background reading
- Troubleshooting HTTP 403 Forbidden in SAP Fiori appsThe usual causes of a 403 error when a Fiori app loads or calls its OData service — missing service authorizations, incomplete roles, inactive ICF services — and a systematic way to find the one that applies.