Knowledge base / Data and connections
SAP extracts
Transaction SE16N (or SE16) displays each table. Set the maximum number of hits to blank, then use the spreadsheet export. Note the row count SAP shows: you enter it on the Audit tab to prove the file is complete.
Required
| Dataset | Table | Fields | Tips |
|---|---|---|---|
| Role authorizations | AGR_1251 | AGR_NAME, AUTH, OBJECT, FIELD, LOW, HIGH | Filter DELETED = blank. The largest table: export in parts by role name range if SE16N limits the hits. |
| User assignments | AGR_USERS | AGR_NAME, UNAME, FROM_DAT, TO_DAT | Include all rows, also expired ones; the as-of date handles them. |
| SoD ruleset | GRC or your own | RISK_ID, LEVEL, FUNCTION_ID, ACTION, OBJECT, FIELD, VALUE | From SAP GRC: Setup → Access Rule Maintenance → export functions and risks. Or start from the template. See Rulesets. |
Recommended
| Dataset | Table | Fields | Why |
|---|---|---|---|
| Composite roles | AGR_AGRS | AGR_NAME, CHILD_AGR | ClearDuty looks inside composites. |
| User master | USR02 | BNAME, USTYP, UFLAG, GLTGV, GLTGB | Leaves out locked and expired users. |
| Profile assignments | UST04 | BNAME, PROFILE | Catches SAP_ALL and other directly assigned profiles. |
| Role org levels | AGR_1252 | AGR_NAME, VARBL, LOW, HIGH | Resolves $ placeholders in derived roles. |
| T-code usage | ST03N or STAD | User, transaction, dialog steps | Shows which findings were really exercised. See Usage. |
Optional
| Dataset | Source | Fields | Why |
|---|---|---|---|
| Role t-codes | AGR_TCODES | AGR_NAME, TCODE | Only if the authorization export has no S_TCODE rows. |
| Transaction catalog | TSTCT | SPRSL = E, TCODE, TTEXT | The complete list of transactions for your release, including support-package additions. About 100,000 rows; re-export after upgrades. |
| Fiori app catalog | SAP Fiori apps reference library | APP_ID, APP_NAME, TCODE, BUSINESS_ROLE, CATALOG | Lets Access lookup and Role designer work with app names. |
| GRC risk analysis | SAP GRC | User, risk ID, role | Access Management → Access Risk Analysis → user level, all users. Used for the reconciliation. |
| Mitigating controls | Your control register | UNAME, RISK_ID, CONTROL, OWNER, VALID_TO | A user of * applies the control to everyone holding that risk. |
Templates with the exact column names are on the Data tab, next to each dataset. If you would rather not export by hand, the ClearDuty Connector reads the same tables directly.
Still stuck? Ask us — we answer within one working day.