---
sourceDocument: Australia Asset Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/it-asset-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Asset Management

ft:clusterId :

    - itam

bundleId :

    - itam

workflow :

    - Technology


---

# Configure roles for the OAuth user

# Configure roles and authorizations for the OAuth user {#ariaid-title1}

* Release version: Australia
* 
* Updated May 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

Create a role in SAP and assign the required authorization objects to the OAuth system user to support OData service access and background job execution for integration with the Software Asset Management application.

## Before you begin

The OAuth client must be configured in SAP before assigning roles to the OAuth user. See [Configure an OAuth client in SAP](https://servicenow-prod.fluidtopics.net/Bc25sX_xp5AhCf_yBQLazQ "Register and configure an OAuth 2.0 client in SAP using the system user created for OAuth authentication, to enable secure data exchange with your ServiceNow instance.").

SAP Role required: SAP Basis administrator

## About this task

Use transaction code PFCG to create a role and assign the authorization objects that grant the OAuth user access to OData services, background job
scheduling, and OAuth scope management.{#configure-roles-auth-oauth-user__configure-roles-auth-oauth-user-context-1}

## Procedure

1. Open transaction code PFCG in your SAP system.
2. Enter a role name in the Role field and select Create Single Role.  
   For example, <kbd class="ph userinput">OAUTH_ROLE</kbd>.
3. Add authorization object <kbd class="ph userinput">S_SERVICE</kbd> and select the external service name <kbd class="ph userinput">TADIR Service</kbd> in the Type field.  
4. Add authorization object <kbd class="ph userinput">S_BTCH_ADM</kbd> and select the N (No Administrator Authorization) option in the Activities field.  
5. Add authorization object <kbd class="ph userinput">S_BTCH_JOB</kbd>, select RELE (Release Jobs) in the Activities field, and leave the JOBGROUP field empty.  
6. Add authorization object <kbd class="ph userinput">S_SCOPE</kbd> and enter \* in the Activities field.  
7. Add authorization object <kbd class="ph userinput">S_PROGNAM</kbd> and the following values in the corresponding fields.  
   * P_ACTION --- <kbd class="ph userinput">BTCSUBMIT</kbd>
   * P_PROGNAM --- <kbd class="ph userinput">/NOW/SAMP_USER_PROG_BCKJOB_RUN</kbd>

   {#configure-roles-auth-oauth-user__ul_uh4_mlr_hjc}

8. Save the role and assign it to the OAuth system user.  
   For example, `OAUTH_USER`.

## Result

The OAuth user has the required authorizations to access OData services, run background jobs, and manage OAuth scopes for the integration.

## What to do next

Create an OAuth 2.0 SAP connection on your ServiceNow instance. For more information, see [Establish an SAP connection using OAuth 2.0](https://servicenow-prod.fluidtopics.net/AwgruQk098qbWxW_ge9RdA "Create a connection profile to establish a connection between your SAP system and your ServiceNow instance using OAuth 2.0 authentication.").