---
sourceDocument: Australia Asset Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/it-asset-management
Release :
- australia
ft:locale :
- en-US
ft:publication_title :
- Australia Asset Management
ft:clusterId :
- itam
bundleId :
- itam
workflow :
- Technology
---
# Create SAP users, roles, and authorizations
# Create SAP users, roles, and authorizations {#ariaid-title1}
* Release version: Australia
*
* Updated May 12, 2026
*
*  3 minutes to read
Create the SAP user, roles, and authorization objects required for the Software Asset Management integration with the central and satellite SAP systems.
## Before you begin
The SAP transport files must be imported into the central system before configuring users and roles.
Role required: SAP Basis administrator
## About this task
The Software Asset Management integration requires a dedicated SAP user with separate roles for the central system and each satellite system. Central system roles control background job scheduling and service access. Satellite system roles control RFC execution and
table display access.{#create-sap-users-roles-auth__create-sap-users-roles-auth-context-1}
## Procedure
1. Create a user ID `S_SERVICENOW` in your SAP system.
If the user already exists, remove the current authorizations and set up new authorizations with central and satellite system permissions.
2. Create a central system role.
1. Navigate to transaction code PFCG.
2. On the Role Maintenance page, enter a role name in the Role field.
For example, Z_SNOW_CTR.
3. In the Description field, enter a brief description of the role and save.
4. Add authorization object S_SERVICE and add external service name /NOW/SAMP//NOW/SAMP_USER_DETAILS_WSDL.
5. Add authorization object S_BTCH_ADM and select the N (No administrator authorization) option in the Activities field.
6. Add authorization object S_BTCH_JOB, select RELE (Release Jobs) in the Activities field, and leave the JOBGROUP field empty.
7. **Optional:** If the central system is a SAP S/4HANA system, add authorization object S_PROGNAM and the following values in the corresponding fields.
* P_ACTION --- BTCSUBMIT
* P_PROGNAM --- /NOW/SAMP_USER_PROG_BCKJOB_RUN
{#create-sap-users-roles-auth__ul_uh4_mlr_hjc}
{#create-sap-users-roles-auth__substeps_sfx_nvh_hjc}
3. Create a satellite system role.
1. Navigate to transaction code PFCG.
2. On the Role Maintenance page, enter a role name in the Role field.
For example, Z_SNOW_CLT.
3. In the Description field, enter a brief description of the role and save.
4. Add authorization object S_RFC and fill in the following values for the fields.
{#create-sap-users-roles-auth__table_twp_rzh_hjc__entry__2}
| Field | Value |
|-|-|
| Activity | 16 This code refers to Execute. |
| RFC_NAME | /OSP/CORE, /OSP/PRGN_GET_ALL_AGRS, BAPI_USER_GETLIST, BAPI_USER_GET_DETAIL, MENU_READ_TSTC, RFC_READ_TABLE, RFCPING, SCSM_COLLECTOR, SDTX, SMNV_MIGRATION, STR9, SU_USER, SWNC_COLLECTOR_GET_AGGREGATES, SYSU, TR_SYS_PARAMS, /NOW/SAMP, /NOW/SAMP_HANADB |
| RFC_TYPE | FUGR and FUNC Here, FUGR is the Function Group and FUNC is the Function Module. |
[Table 1. Field values for authorization object S_RFC]
{#create-sap-users-roles-auth__table_twp_rzh_hjc}
5. Add authorization object S_TABU_DIS and enter 03 in the Activity and &NC&, SS in the Table Authorization Group field.
6. Add authorization object S_TABU_NAM and fill in the following values for the fields.
{#create-sap-users-roles-auth__table_hzj_1w3_hjc__entry__2}
| Field | Value |
|-|-|
| Activity | 03 This code refers to Display. |
| Table Name | AGR_FLAGS, AGR_TEXTS, TSTCT, TUPL, TUPLT, TUREP, TUTYPA, TUTYPNOW, TUTYPPL, USR41_MLD, T000 |
[Table 2. Field values for authorization object S_TABU_NAM]
{#create-sap-users-roles-auth__table_hzj_1w3_hjc}
7. Add authorization object S_TOOLS_EX and enter S_TOOLS_EX_A in the Authorization name in user master main field.
8. Add authorization object S_BTCH_ADM and select the N (No administrator authorization) option in the Activities field.
9. Add authorization object S_BTCH_JOB, select RELE (Release Jobs) in the Activities field, and leave the JOBGROUP field empty.
10. Add authorization object S_RZL_ADM and enter 01 in the Activity field.
11. Add authorization object S_USER_GRP and enter 03 in the Activity field and SUPER in the User group in user master main field.
{#create-sap-users-roles-auth__substeps_km5_zyh_hjc}
4. Assign the central system role to the `S_SERVICENOW` user in the central system, and the satellite system role to the same user in each satellite system.
{#create-sap-users-roles-auth__table_tyj_xgj_hjc__entry__2}
| Authorization object | Description |
|-|-|
| S_RFC | Verifies that the called RFC user is authorized to execute RFC function modules. |
| S_SERVICE | Verifies the start of your external services. |
| S_TCODE | Initiates an SAP transaction from the command box or menu. |
| S_BTCH_ADM | Manages background processing. |
| S_BTCH_JOB | Manages background jobs. |
| S_RZL_ADM | Maintains external system commands. |
| S_TABU_DIS | Controls table access to users. |
| S_TABU_NAM | Provides authorizations for tables based on the table name instead of the table authorization group. |
| S_TOOLS_EX | Monitors tool performance. |
| S_USR_GRP | Performs user maintenance for several transactions. |
[Table 3. Authorization objects and their descriptions]
{#create-sap-users-roles-auth__table_tyj_xgj_hjc}
## What to do next
Select the Remote Function Call (RFC) connections that the SAP ABAP program uses to import data from your SAP clients. For details, see [Select SAP clients to import data](https://servicenow-prod.fluidtopics.net/NmbWBL1coWE6uVl9B_uIPg "Select the Remote Function Call (RFC) connections that the SAP ABAP program uses to import data from your SAP clients into the central system and then into your ServiceNow instance.").