Steps To Delete Expired Roles

Those expired profiles can be deleted with PFCG_TIME_DEPENDENCY, but what can I do for roles with no valid date range in the user master data? 

You may want to review notes 312943, 504412, and 313587 to see if there is any helpful information. 

Below is some documentation that may be helpful for others. We are also having a few issues with role deletion. 

First, the report PFCG_TIME_DEPENDENCY is functioning as designed. It was not designed to remove activity groups. 

Second, in transaction SU10 you must have the "Valid From" and "Valid To" fields filled in with the actual dates (e.g. 04/08/2011) in order to remove the invalid activity group. You need to be sure that the "Remove User" radio button is set in the role tab. In the profile tab, the "Add User" radio button is selected by default. What you have to do is go to the profile tab and select the "Remove User" radio button. You have to make sure both role and profile have the same radio button selected (i.e. remove from users). Only then when you click save, will it allow you to delete the role from user. 

In transaction SU10, you need to complete the following steps: 

1. Click on the Authorization data button. 

2. Entry the users name, latimerc. 

3. Click on the execute button. 

4. Put a check in front of the users name. 

5. Click on the transfer button. 

6. Now highlight the user. 

7. Click on the pencil button. 

8. Click on the Activity Groups tab. 

9. Enter the profile name (PM_NOTIFICATION_PROCESSOR). 

10. Enter the valid from and valid to dates (04/08/2011). 

11. Change the radio buttons to remove user from both the Activity Group and Profile Tabs. 

12. Click on the trash can. 

In another customer message the following was provided by development: 

There is no regular functionality for mass deletion of roles. But, if you want to avoid the deletion by hand or with an own created report, I would suggest the following: 

The report ZDELETE_RY_T_AGRS can delete all roles with names like 'T_....' or 'RY....'. The report gives you a list of all these roles and then deletes the selected ones. 

You can modify the report to get all your roles in the selection list. Therefore, you have to change the following: 

SELECT * FROM AGR_FLAGS INTO TABLE L_AGR_FLAGS 

WHERE FLAG_TYPE = 'COLL_AGR' 

AND FLAG_VALUE = 'X'. 

SORT L_AGR_FLAGS BY AGR_NAME. 

LOOP AT SINGLE_ACTGROUPS WHERE AGR_NAME+11 <> SPACE AND <<< delete 

( AGR_NAME(2) = 'T_' OR AGR_NAME(2) = 'RY' ). <<< delete 

LOOP AT SINGLE_ACTGROUPS WHERE AGR_NAME+11 <> SPACE. <<< insert 

READ TABLE L_AGR_FLAGS WITH KEY AGR_NAME = SINGLE_ACTGROUPS-AGR_NAME 

BINARY SEARCH. 

Text from an additional customer message offers further help: 

1. Go on role tab. 

2. Select remove from user. 

3. Enter ZR.PRD.GENERIC and date : 06/04/2011 to 12/31/9999. 

4. Go to profile tab. 

5. Select remove from user. 

6. Save. 

7. Do the same for ZR:HR:ESS from 01/01/2011 to 12/31/9999 and worked from date for testid was 01/01/2011 and testid2 02/01/2011.  In this case, the two assignments were deleted, and the roles were also removed from the two UMR. 

SAP BC Tips

Read also
How To Control Layout Authorization

Get help for your Basis problems
Do you have a SAP Basis Question?

SAP Basis Admin Books
SAP System Administration, Security, Authorization, ALE, Performance Tuning Reference Books

SAP Basis Tips
SAP BC Tips and Basis Components Discussion Forum

Administration In SAP - Sapgui, Unix, SAP ITS, Router, Client Copy and IDES 

Main Index
SAP ERP Modules, Basis, ABAP and Other IMG Stuff

All the site contents are Copyright © www.erpgreat.com and the content authors. All rights reserved.
All product names are trademarks of their respective companies.  The site www.erpgreat.com is in no way affiliated with SAP AG. 
Every effort is made to ensure the content integrity.  Information used on this site is at your own risk. 
 The content on this site may not be reproduced or redistributed without the express written permission of 
www.erpgreat.com or the content authors.