# Integrating SailPoint with SAP Direct > [!NOTE] > > **Integration** > > This is an integration and requires additional licensing or subscriptions to utilize it. For more information, contact your customer success manager. This document is designed to give specific information about the requirements and field definitions needed to get a working instance of a SAP Direct connector in SailPoint. SAP Enterprise Resource Planning software solution is an integrated software solution that incorporates the key business functions of the organization. SailPoint for SAP ERP aggregates and provisions all the users along with their roles/profiles of the SAP system. SailPoint for SAP ERP supports provisioning to a standalone SAP system as well as SAP Central User Administration (CUA) system. > [!NOTE] > > The RFC\_READ\_TABLE integration function module has been deprecated, and replaced with the ABAP Function module. For more information on configuration, refer to [SailPoint Add-On to replace the use of RFC\_READ\_TABLE](). > [!NOTE] > > To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes]() page. ## Supported Features The SAP Direct connector supports the following features: > [!NOTE] > > Before you can use any item marked with an asterisk (\*), SailPoint must activate the feature for your site. - Manages SAP users as Accounts - Aggregation, Delta Aggregation (to sync changes from SAP Direct), Refresh Accounts - Create, Update, and Delete - Enable, Disable, and Unlock - \*Password Management - Add and Remove Entitlements - Entitlements are Roles (for user), Profiles (for user), ContractualUserType (Licenses of the use)., UserGroup (User group of the user), and User Groups (for user). - Add and Remove Contractual User Type ID - Read and update the [SAP UUID (Global User ID)](<#sap-uuid-global-user-id>) associated with SAP Direct Accounts. - Add and Remove the EmployeeID assigned to an Account - Manage the Indirect Roles assigned to the accounts via Organization Data. For more information, refer to [Configuring Indirect Role Assignment](). > [!NOTE] > > - UserGroup (User group of the user) is managed as an entitlement account attribute only. > - SAP recommends to assign only one user group in single request. For more information on features, refer to [Source Features](). The SAP Direct connector supports following group and entitlement objects: | SAP Direct Source Object | Supported Operation | | --- | --- | | Roles as group object | Read | | ContractualUserType (Licenses for user) | Add and Remove Entitlement | | Entitlement objects
\- Roles (for user)
\- Profiles (for user) | Add and Remove Entitlements | The SAP Direct connector displays the parent child relationship between composite role and child roles on the connector UI as Parent and Child Entitlements. > [!NOTE] > > When performing group aggregation in a SAP Central User Administration (CUA) environment, the connector does not fetch `child roles` or `child profiles` of any composite role or profile. This is due to the fact that the CUA system does not maintain child level roles or profile details for child subsystems. This works in a similar way, where the attribute `ID` does not fetch attributes like `TCodes assigned through Menus`, `TCodes assigned directly` and `Other Menu Items` or `Generated Profiles` for the group object type. The following lists the details of the supported features: | Feature | Users | | --- | --- | | Create | ✔ | | Aggregate | ✔ | | Enable and Disable | ✔ | | Delta Aggregation | ✔ | | Password Management | ✔ | | Group Entitlements (Read, Request, Revoke, and Access Certifications) | ✔ Roles | | Entitlements (Read, Request, Revoke, and Access Certifications) | ✔ (Profiles, UserGroups, and ContractualUserType) | ### Group Entitlements Group entitlements are the entitlement types for which SailPoint provides the ability to aggregate additional details of these entitlement types from the managed system. These objects have a separate schema defining list of attributes that the aggregation task fetches as additional details when aggregation is run for that group entitlement type. | Feature | Groups | | --- | --- | | Aggregation | ✔ | | Read group hierarchy | ✔ | ### Notes The following table lists the special considerations of certain supported features: | Supported Features | Notes | | --- | --- | | Pass Through Authentication | If Pass-Through authentication is enabled, the user can login through SailPoint using the user name and password without any authorization required. | | Aggregation | SailPoint for SAP Direct aggregates Generated Profile associated to Role as a part of Account-Group Aggregation. | | Change Password | \- For "Change password in Permanent Mode" ensure that the SNC is configured on SAP server. The log on session during which a productive password is set must be secured using Secure Network Communications (SNC).
\- SAP recommends that setting of productive passwords is more risky than setting an initial one, therefore additional security checks must be applied as follows:
\- The log on session during which a productive password is set must be secured using Secure Network Communications (SNC).
\- The user needs an additional authorization to set a productive password (authorization object: S\_USER\_GRP, activity: 'PP' - Set Productive)

For more information, refer to SAP note [https://service.sap.com/sap/support/notes/1287410]() (SAP Service marketplace login required). | | Manages SAP Profiles as Account-Groups | A few system composite profiles might have child profiles which are not present in SAP system. For example, for each release composite profile `SAP_NEW` contains a single profile `SAP_NEW_`, (for example, `SAP_NEW_21D`). This profiles holds its release status. Profiles like `SAP_NEW_` may not be aggregated. | | Account - Group Aggregation | In Account-Group aggregation for SAP Central User Administration (CUA) environment, the connector does not fetch `child roles` or `child profiles` of any composite role or profile. This is due to the fact that the CUA system does not maintain child level roles or profile details for child subsystems. This works in a similar way, where the attribute `ID` does not fetch attributes like `TCodes assigned through Menus`, `TCodes assigned directly` and `Other Menu Items` or `Generated Profiles` for the group object type. | ### SAP UUID (Global User ID) In order to enable this functionality, following attributes needs to be added manually in account schema: - SAP User UUID - SAP User UUID History > [!NOTE] > > SAP User UUID History attribute has read only support. #### Additional Permission for UUID (Global User ID) | Authorization Objects | Field Name | Field Description | Field Value | | --- | --- | --- | --- | | S\_USER\_UID | ACTVT | Activity | Display | | S\_USER\_UID | CLASS | User group | Specify the Group you want to assign for the user.
For example: `SUPER` | | S\_USER\_UID | EXTUID\_TYP | Type of the External User ID (UID) | Global User ID | #### Additional Permission for Adding and Removing UUID (Global User ID) | Authorization Objects | Field Name | Field Description | Field Value | | --- | --- | --- | --- | | S\_USER\_UID | ACTVT | Activity | Enter, Include, and Assign | | S\_USER\_UID | CLASS | User group | Specify the Group you want to assign for the user.
For example: `SUPER` | | S\_USER\_UID | EXTUID\_TYP | Type of the External User ID (UID) | Global User ID | ### Enabling PD Profiles This topic describes how to use the PD Profile functionality for SAP Direct connector by adding required attributes to the account/entitlement schema and configuring necessary permissions. #### Fetching Directly Assigned PD Profiles ##### Adding Attributes To fetch PD Profiles assigned directly to users, manually add the following attributes to the Account Schema: - `PDProfiles` This attribute stores the PD profiles assigned directly to the user. - `PDProfile Details` This attribute stores the associated PD profiles with their start and end dates. PD profile details are displayed in the following format: `PDProfileName#Startdate(YYYYMMDD)#EndDate(YYYYMMDD)` ##### Configuring Direct Assignment Permissions To fetch PD Profiles assigned directly to users, ensure to provide following permissions for T77UA table. T77UA table stores the PD profile assignments for users. | Authorization Objects | Field Name | Field Description | Field Value | | --- | --- | --- | --- | | S\_TABU\_NAM (To aggregate PD Profiles directly assigned to User) | Activity: 03, Table Name | Table affected by the operation | T77UA | The tables below list the permissions required for the service account. For more information on service account permissions, refer to [Configuration Table for SAP Direct](). | SERVICE\_ACCOUNT | NAME | COLUMNNAME | ENTITY\_TYPE | COLUMN\_DNAME | COLUMN\_DTYPE | COLUMN\_LENGTH | | --- | --- | --- | --- | --- | --- | --- | | \\\ | T77UA | BEGDA | TABLE | PD\_BEGDA | D | 8 | | \\\ | T77UA | ENDDA | TABLE | PD\_ENDDA | D | 8 | | \\\ | T77UA | GEN\_FLAG | TABLE | FLAG | C | 1 | | \\\ | T77UA | PROFL | TABLE | PROFL | C | 12 | | \\\ | T77UA | UNAME | TABLE | USRNAME | C | 12 | #### Fetching Indirectly Assigned PD Profiles ##### Adding Attributes To fetch PD Profiles assigned indirectly to users via jobs, positions, or orgainizational units, manually add the following attributes: - Add a new schema attribute `PDProfiles` under the `organizationdata` ([Group Attributes for Organization Data]()) in the Entitlement Schema. - Add a new schema attribute `Organization Data` in the Account Schema ([Account Attributes for Organization Data]()). ##### Configuring Indirect Assignment Permissions To fetch PD Profiles assigned indirectly to users via jobs, positions, or orgainizational units, ensure to provide following permissions for HRP1000 and HRV1017A table. HRP1000 stores object types (such as, organizational units, positions, jobs), whereas HRV1017A provides information about PD profiles. | Authorization Objects | Field Name | Field Description | Field Value | | --- | --- | --- | --- | | S\_TABU\_NAM (To aggregate PD Profiles directly assigned to User) | Activity: 03, Table Name | Table affected by the operation | HRP1000, HRV1017A | The tables below list the permissions required for the service account. For more information on service account permissions, refer to [Configuration Table for SAP Direct](). | SERVICE\_ACCOUNT | NAME | COLUMNNAME | ENTITY\_TYPE | COLUMN\_DNAME | COLUMN\_DTYPE | COLUMN\_LENGTH | | --- | --- | --- | --- | --- | --- | --- | | \\\ | HRP1000 | ENDDA | TABLE | ENDDATUM | D | 8 | | \\\ | HRP1000 | LANGU | TABLE | LANGU | C | 2 | | \\\ | HRP1000 | OBJID | TABLE | HROBJID | N | 8 | | \\\ | HRP1000 | OTYPE | TABLE | OTYPE | C | 2 | | \\\ | HRP1000 | PLVAR | TABLE | PLVAR | C | 2 | | \\\ | HRV1017A | OBJID | TABLE | OBJID | N | 8 | | \\\ | HRV1017A | PROFL | TABLE | PROFL | C | 12 | > [!NOTE] > > PD Profile assigned via a Role in the SAP Direct managed system can be viewed under the `Authorization Objects` attribute of the group in the Entitlement Schema. ### Privilege Classification SailPoint Privilege Classification helps organizations systematically categorize and manage the privilege levels of entitlements within their sources. By classifying entitlements as high, medium, or low, administrators can better understand the potential risk and impact associated with specific access rights. This allows automatic assignment of privilege levels based on system recommendations, custom-defined criteria, or a same level across all entitlements. | Privilege Level | Description | | --- | --- | | High | Administrative level access to accounts | | Medium | Administrative level access for a specific role or function | | Low | Only basic access of data | > [!NOTE] > > To manage Privilege Classification, users must have administrative roles such as Org Admin, Source Admin or Source Sub-Admin. For more information, refer to [Managing Privilege Classification](). > [!NOTE] > > **Example** > > [![Privilege Classification example]()]() ## Supported Managed Systems The SailPoint SAP Direct connector supports the managed system versions listed on this page. > [!NOTE] > > SailPoint for SAP ERP manages ABAP users. For more information, refer to [Supported Features](<#supported-features>). - SAP NetWeaver 7.51 and above - SAP Enterprise Resource Planning (ERP) Central Component (ECC) 6.0 with EHP8 (Enhancement package 8) - SAP S/4HANA (On-premises) - Version 2021 up to FP/SP Stack 05 - Version 2022 up to FP/SP Stack 04 - Version 2023 up to FP/SP Stack 03 - Version 2025 Initial Shipment Stack - SAP Business Warehouse - SAP Customer Relationship Management (CRM) - SAP Process Integration (PI) - SAP Supply Chain Management (SCM) - SAP Advanced Planning and Optimization (SAP APO) - SAP\_MARKETING (Hybris Marketing) > [!NOTE] > > SAP GRC connector works with SAP private cloud environments and supports SAP RISE solutions. ## Prerequisites > [!IMPORTANT] > > SailPoint strongly recommends installing the SAP-certified add-on in the SAP environment and then using /SAILPOIN/SAIL\_READ\_TABLE instead of RFC\_READ\_TABLE. - Configure at least one virtual appliance cluster and successfully test the connection. For instructions, refer to the [Virtual Appliance Reference Guide](). - The JCO libraries (JCO Release 3.1.X) must be downloaded from the SAP website by going to the customer service marketplace and downloading the Java Integration Module. SAP JCO version 3.1.X libraries, `libsapjco3.so` (on UNIX), must be present in the `java.library.path` (*WEB-INF/lib*) directory on the VA host. Upload these `.jar` and `.so` files on the Basic Configuration page. For more information on downloading the `.jar` files, refer to [Obtaining the Custom Connector Files](). Ensure these jar files are compatible with the VA. - The following ports must be open on the SAP system: > **Note** > > "" represents the system number. | Port Name | Service in `etc/services` | Default | Range | Rule | | --- | --- | --- | --- | --- | | SAP Dispatcher | sapdp | 3200 | 3200-3299 | 32 | | Gateway | sapgw | 3300 | 3300-3399 | 33 | | Gateway secured | sapgws | 4800 | 4800-4899 | 48 | ## Required Permissions This document describes the permissions required for users to perform operations on the SAP Direct source. For the SAP Direct source, the service account is an administrative account. The following tables list the permissions associated with different operations on SAP authorization objects. The tables include the SAP fields used to specify the permissions. > [!NOTE] > > The RFC\_READ\_TABLE integration function module has been deprecated, and replaced with the ABAP Function module. For more information on configuration, refer to [SailPoint Add-On to replace the use of RFC\_READ\_TABLE](). The following table lists the required permissions for specific operations: > [!NOTE] > > There are additional permissions for change password with Secure Network Communication (SNC) below. | Operation | Required Permissions | | --- | --- | | Test Connection | Test Connection | | Account Aggregation | Test Connection and Account Aggregation. For Account Aggregation of CUA systems, additional permissions must be executed as specified in the Account Aggregation section.

For information on Additional Permissions for SAP UUID (Global User ID) and Additional Permissions to update the SAP UUID (Global User ID) for a user, refer to [SAP UUID (Global User ID)](<#sap-uuid-global-user-id>). | | Entitlement Aggregation | Test Connection and Entitlement Aggregation. For Group Aggregation in CUA systems, additional permissions must be executed as specified in the Entitlement Aggregation section. | | Delta Aggregation | Test Connection, Account Aggregation and Delta Aggregation | | Create Account | Test Connection, Account Aggregation and Create Account. For Create Account in CUA systems or a SNC network, additional permissions must be executed as specified in the Create Account section. | | Enable/Disable/Unlock Account | Enable/Disable/Unlock Account, Account Aggregation and Enable/Disable/Unlock Account | | Delete Account | Test Connection, Account Aggregation and Delete Account | | Add/Remove Entitlement | Test Connection, Account Aggregation and Add/Remove Entitlements | | Change Password | Test Connection, Account Aggregation and Change Password. For Change Password in a SNC network, additional permissions must be executed as specified in the Add/Remove Entitlements and Change Password sections. | > [!NOTE] > > **Test Connection** > > | Authorization Object | Field Name | Field Description | Field Value | > | --- | --- | --- | --- | > | S\_RFC | ACTVT | Activity | `16 - Execute` | > | S\_RFC | RFC\_NAME | Name of RFC object | RFCPING | > | S\_RFC | RFC\_TYPE | Type of RFC object | FUGR, FUNC | > [!NOTE] > > **Account Aggregation** > > > **Note** > > > > To open a profile object with blank text when aggregating accounts from SAP Direct version 750 and earlier, you can use the new `USR11` admin permission field value in the Table Name field of the S\_TABU\_NAM Authorization Object. > > | Authorization Objects | Field Name | Field Description | Field Value | > | --- | --- | --- | --- | > | S\_RFC | Activity: 16, RFC\_NAME | Name of RFC object | Add the following:
**Function Modules (FUNC):**
`BAPI_USER_GETLIST`
`BAPI_USER_GET_DETAIL`
`DDIF_FIELDINFO_GET`
`RFC_METADATA_GET`
**Function Groups (FUGR):**
`SDTX`
`SMSSDATA1`
`SU_USER`
Based on the options configured in the UI, select one of the three options below:
\- Add this permission: `RFC_READ_TABLE`. Note: SailPoint will continue to support the RFC\_READ\_TABLE in accordance with our depreciation policies. SailPoint recommends that you start planning to move to use SailPoint's Function Module.
\- Add this permission to use SailPoint's Function Module instead of RFC\_READ\_TABLE if your SAP\_BASIS version is 740, Support Package 08, up to BASIS 750: `/SAILPOIN/SAIL_READ_TABLE_LEG`
\- Add this permission to use SailPoint's Function Module instead of `RFC_READ_TABLE` if your SAP\_BASIS version is 751 and later: `/SAILPOIN/SAIL_READ_TABLE`. Note: If you configure the permissions for SailPoint's function module then remove RFC\_READ\_TABLE value from S\_RFC authorization object.

To aggregate Organization Data, add the following:
**For FUNC:** `BAPI_EMPLOYEE_GETDATA`
**For FUGR:** `RFC_METADATA` | > | S\_TABU\_NAM | ACTVT | Activity | `03 - Display` | > | S\_TABU\_NAM | Activity: 03, Table Name | Table affected by the operation | Add the following:
`USR11`, `USR06`, `USR02`, `TUTYP`, `TUTYPA`, `CVERS`, `PRDVERS`

To aggregate Organization Data, add the following:
`PA0105` | > | S\_USER\_GRP | ACTVT | Activity | `03 - Display` | > | S\_USER\_GRP | CLASS | User group in user master maintenance | \* or specify the Group you want to assign for the user. For example: `SUPER` | > | P\_Orgin (To aggregate Organization data) | AUTH | Authorization Level | R | > | P\_Orgin (To aggregate Organization data) | INFTY | INFOTYPE | 0001 | > | P\_Orgin (To aggregate Organization data) | PERSA | Personal area | \* | > | P\_Orgin (To aggregate Organization data) | PERSG | Employee group | \* | > | P\_Orgin (To aggregate Organization data) | SUBTYPE | SUBTY | \* | > | P\_Orgin (To aggregate Organization data) | PERSK | Employee subgroup | \* | > | P\_Orgin (To aggregate Organization data) | VDSK1 | Organization Key | \* | > [!NOTE] > > **Additional Permissions for Central User Administration (CUA) Systems** > > | Authorization Objects | Field Name | Field Description | Field Value | > | --- | --- | --- | --- | > | S\_RFC | RFC\_NAME | Name of RFC object | Add the following:
**Function Modules (FUNC):**
`BAPI_USER_LOCACTGROUPS_READ`
`BAPI_USER_LOCPROFILES_READ` | > [!NOTE] > > **Entitlement Aggregation** > > | Authorization Objects | Field Name | Field Description | Field Value | > | --- | --- | --- | --- | > | S\_RFC | ACTVT | Activity | `16-Execute` | > | S\_RFC | Activity: 16, RFC\_NAME | Name of RFC object | Add the following:
**Function Modules (FUNC):**
`BAPI_HELPVALUES_GET`
`PRGN_ACTIVITY_GROUPS_LOAD_RFC`
`PRGN_EXCHANGE`
`COLL_ACTGROUPS_GET_ACTGROUPS`
`DDIF_FIELDINFO_GET`
`MSS_GET_SY_DATE_TIME`
`RFC_GET_FUNCTION_INTERFACE`
**Function Groups (FUGR):**
`PRGN_COLLECTIVE_ACTGROUPS`
`SDTX`
`SMSSDATA1`
Based on the options configured in the UI, select one of the three options below:
\- Add this permission: `RFC_READ_TABLE`. Note: SailPoint will continue to support the `RFC_READ_TABLE` in accordance with our deprecation policies. SailPoint recommends that you start planning to move to use SailPoint's Function Module.
\- Add this permission if your SAP\_BASIS version is 740 Support Package 08 or later: `/SAILPOIN/SAIL_READ_TABLE_LEG`
\- Add this permission to use SailPoint's Function Module instead of `RFC_READ_TABLE` if your SAP\_BASIS version is 751 and later: `/SAILPOIN/SAIL_READ_TABLE`. Note: If you configure the permissions for SailPoint's Function Module, then remove the `RFC_READ_TABLE` value from the S\_RFC authorization object. | > | S\_TABU\_NAM | Table Name | Table | Roles: `AGR_FLAGS, AGR_PROF, AGR_TCODES, AGR_TEXTS,USGRP,USGRPT`
Profiles: `AGR_DEFINE, USR11, UST10C, UST10S`

To aggregate Authorization Objects associated with a role: `AGR_1251, AGR_1252`. Note: If you do not want to aggregate Authorization Objects AGR\_1251 and AGR\_1252, omit the permissions and remove them from schema.

To aggregate Organization Data and Indirect Roles, add the following: `HRP1000`, `HRP1001` | > > > **Note** > > > > Group aggregation specific to Authorization Objects are not supported for the SAP CUA system. > [!NOTE] > > **Additional Permissions for CUA Systems** > > | Authorization Objects | Field Name | Field Description | Field Value | > | --- | --- | --- | --- | > | S\_TABU\_NAM | Table Name | Table | Profiles
`USRSYSPRF`
`USRSYSPRFT`
Roles
`USRSYSACTT`
`USRSYSACT` | > [!NOTE] > > **Delta Aggregation** > > | Authorization Objects | Field Name | Field Description | Field Value | > | --- | --- | --- | --- | > | S\_RFC | RFC\_NAME | Name of RFC object | Add the following: `/SAILPOIN/USR_CHANGE_DOC_USERS`, `/SAILPOIN/IDENTITYIQ_FUGR`, `/SAILPOIN/USR_CHANGE_DOC_ROLES` | > | S\_TABU\_NAM | Table Name | Table affected by the operation | `USBAPILINK` | > | S\_USER\_GRP | ACTVT | Activity | `08 - Display change document` | > [!NOTE] > > **Create Account** > > Create user with assigned role and profiles. > > | Authorization Objects | Field Name | Field Description | Field Value | > | --- | --- | --- | --- | > | S\_USER\_GRP | ACTVT | Activity | `01 - Create or generate` | > | S\_RFC | RFC\_NAME | Name of RFC object | **Function Modules (FUNC):**
`BAPI_USER_ACTGROUPS_ASSIGN`
**Function Groups (FUGR):**
`SDIFRUNTIME` | > | S\_USER\_SAS | ACTVT | Activity | Add the following: `22 - Enter`, `Include`, `Assign`, `01 - Create` | > | S\_USER\_SAS | ACT\_GROUP | Role name | \* or you can specify role name for which you have assigned | > | S\_USER\_SAS | CLASS | User group in user master maintenance | \* or specify the Group you want to assign for the user. For example `SUPER` | > | S\_USER\_SAS | PROFILE | Auth. profile in user master maintenance | \* or you can specify Profile for which you have assigned | > | S\_USER\_SAS | SUBSYSTEM | Receiving system for central user administration | \* or specify the system you are targeting | > [!NOTE] > > **Enable/Disable/Unlock Account** > > | Authorization Objects | Field Name | Field Description | Field Value | > | --- | --- | --- | --- | > | S\_USER\_GRP | ACTVT | Activity | `05 - Lock` | > [!NOTE] > > **Delete Account** > > | Authorization Objects | Field Name | Field Description | Field Value | > | --- | --- | --- | --- | > | S\_USER\_GRP | ACTVT | Activity | `06 - Delete` | > [!NOTE] > > **Add/Remove Entitlements** > > | Authorization Objects | Field Name | Field Description | Field Value | > | --- | --- | --- | --- | > | S\_RFC | RFC\_NAME | Name of RFC object | **Function Groups (FUGR):** `SDIFRUNTIME` | > | S\_USER\_SAS | ACTVT | Activity | Add the following: `22 - Enter`, `Include`, `Assign` | > | S\_USER\_SAS | ACT\_GROUP | Role name | \* or you can specify role name for which you have assigned | > | S\_USER\_SAS | CLASS | User group in user master maintenance | \* or specify the Group you want to assign for the user. For example: `SUPER` | > | S\_USER\_SAS | PROFILE | Authentication profile in user master maintenance | \* or you can specify Profile for which you have assigned | > | S\_USER\_SAS | SUBSYSTEM | Receiving system for central user administration | \* or specify the system you are targeting | > | S\_USER\_AGR | ACTVT | Activity | `02-change` | > | S\_USER\_AGR | ACT\_GROUP | Role Name | \* or you can specify role name for which you want to provide access | > | S\_USER\_PRO | ACTVT | Activity | Add the following: `22 - Enter`, `Include`, `Assign` | > | S\_USER\_PRO | PROFILE | Auth. profile | \* or you can specify profile name for which you want to provide access | > | S\_USER\_GRP | ACTVT | Activity | Add the following: `22 - Enter`, `Include`, `Assign`, `78 - Assign` | > | S\_USER\_GRP | CLASS | User group in user master maintenance | \* or specify the group you want to assign or remove for the user | > [!NOTE] > > **Change Password** > > | Authorization Objects | Field Name | Field Description | Field Value | > | --- | --- | --- | --- | > | S\_USER\_GRP | ACTVT | Activity | Add the following: `02 - Change`, `05 - Lock`, `78 - Assign` | > [!NOTE] > > **(For Change Password only) For SNC (Secure Network Communication)** > > | Authorization Objects | Field Name | Field Description | Field Value | > | --- | --- | --- | --- | > | S\_USER\_GRP | ACTVT | Activity | `PP - Set Productive` | > [!NOTE] > > **Provision EmployeeID (Link username with the System user name for SAP HR)** > > For more information on table-level permissions, refer to [Configuration Table for SAP Direct](). > > | Authorization Objects | Field Name | Field Description | Field Value | > | --- | --- | --- | --- | > | S\_RFC | ACTVT | Activity | `16-Execute` | > | S\_RFC | RFC\_NAME | Name of RFC object | Add the following:
**Function Modules (FUNC):**
`BAPI_EMPLCOMM_CHANGE`
`BAPI_EMPLCOMM_CREATE`
`BAPI_EMPLOYEE_ENQUEUE`
`BAPI_EMPLOYEE_DEQUEUE`
`BAPI_EMPLOYEE_GETDATA`
`BAPI_EMPLOYEE_CHECKEXISTENCE`
`BAPI_EMPLCOMM_GETDETAILEDLIST` | > | P\_Orgin | AUTHC | Authorization Level | Add the following: `E`, `S`, `W` | > | P\_Orgin | INFTY | INFOTYPE | `0105` | > | P\_Orgin | PERSA | Personal area | \* | > | P\_Orgin | PERSG | Employee group | \* | > | P\_Orgin | SUBTYPE | SUBTY | \* | > | P\_Orgin | PERSK | Employee subgroup | \* | > | P\_Orgin | VDSK1 | Organization Key | \* | > | S\_USER\_GROUP | ACTIVITY | Activity | `03` | > | S\_USER\_GROUP | CLASS | User group in user master maintenance | \* | > [!NOTE] > > **Permissions for Organization Data Aggregation** > > Refer to the following for information about configuring permissions to aggregate Organization Data: > > - Account Aggregation > - Entitlement Aggregation > - [Required Service Account Permissions for Organization Data]()