SAP User & Client Administration: SU01, PFCG, SCC4, SCCL & SCC9 Complete BASIS Guide
SAP BASIS | User Administration | Role Management | Client Administration | Client Copy | Interview Preparation
SAP User and Client Administration is one of the most important areas for every SAP BASIS administrator.
Whether you are working on SAP ECC, SAP S/4HANA, SAP NetWeaver or S/4HANA Private Cloud, understanding users, roles, authorizations, clients and client-copy procedures is essential for day-to-day administration and production support.
In this guide, we will cover:
SU01 – SAP User Administration
PFCG – Role and Authorization Management
SAP User Types
User Lock/Unlock Troubleshooting
SCC4 – Client Administration
SCCL – Local Client Copy
SCC9/SCC9N – Remote Client Copy
Client Copy Profiles
Client Deletion Considerations
Local vs Remote Client Copy
Practical BASIS troubleshooting scenarios
SAP BASIS interview questions
BASIS Tip: Don't memorize only transaction codes. In real projects, interviewers and clients are more interested in understanding why and when you use each transaction.
1. SAP User Administration – SU01
SU01 is the primary SAP transaction used for maintaining user master records.
SAP documentation describes SU01 as a user administration tool for creating and maintaining users. User master records contain information such as basic user data, logon information and authorization assignments.
Common SU01 Activities
A BASIS administrator can use SU01 to perform activities such as:
Create users
Change user details
Display users
Lock or unlock users
Reset passwords
Maintain validity dates
Assign roles
Assign profiles
Maintain user groups
Maintain user parameters
Delete users
Important SU01 Tabs
| Tab | Purpose |
|---|
| Address | Name, email, telephone, department and related information |
| Logon Data | User type, password and validity |
| Defaults | Logon language, date format, decimal notation and printer |
| Parameters | User-specific parameter IDs |
| Roles | Roles assigned to the user |
| Profiles | Authorization profiles assigned to the user |
| Groups | User group information |
| SNC | Secure Network Communication-related settings |
Important BASIS Point
A user master record is client-specific. Therefore, the same username can exist independently in different SAP clients.
For example:
SAP System
Client 100
└── USER01
Client 200
└── USER01
These are separate user master records.
2. SAP Roles and Authorizations – PFCG
PFCG is the standard transaction for SAP role maintenance.
SAP describes PFCG as the role maintenance tool used to configure roles and manage authorization-related information.
A typical role-maintenance flow is:
Create Role
↓
Maintain Menu
↓
Maintain Authorizations
↓
Generate Authorization Profile
↓
Assign User
↓
User Comparison / Authorization Update
Important PFCG Tabs
Menu
The Menu tab can contain objects such as:
Transactions
Reports
URLs
Web Dynpro applications
Other menu objects
Authorizations
The Authorizations tab contains:
User
The User tab contains:
Users assigned to the role
User assignment information
User comparison/update functions
3. Role vs Profile – Important Interview Question
One of the most common SAP BASIS interview questions is:
What is the difference between a Role and a Profile?
Role:
A role is maintained in PFCG and contains the menu and authorization information required for a business function.
Profile:
The authorization profile is generated from the role and represents the authorization information that is assigned to the user.
In modern SAP administration, administrators normally maintain authorizations through roles in PFCG rather than manually maintaining authorization profiles.
4. What Happens When a Role Is Assigned to a User?
Suppose a user reports:
"I have been assigned the required role, but I still receive an authorization error."
Don't immediately assume that the role assignment is wrong.
Use a structured troubleshooting approach:
Check PFCG Role
↓
Check Authorization Values
↓
Authorization Generated?
↓
User Assigned?
↓
User Comparison / Update
↓
SU53
↓
STAUTHTRACE if required
Useful transactions include:
PFCG – Role maintenance
SU01 – User maintenance
SU53 – Analyze failed authorization checks
STAUTHTRACE – Authorization trace
SU56 – Display user's authorization buffer
5. SAP User Types
SAP provides different user types for different purposes.
The commonly encountered user types are:
| User Type | Typical Purpose |
|---|
| Dialog | Normal interactive SAP users |
| System | Technical/background processing |
| Communication | System/application communication |
| Service | Shared or anonymous access scenarios |
| Reference | Additional authorizations for another user |
Dialog User
A Dialog user is generally used by normal SAP end users.
Example:
Employee
↓
SAP GUI / Application
↓
Dialog User
System User
System users are generally intended for technical processing and background communication rather than normal interactive business-user activity.
Example:
Background Job
↓
Technical Processing
↓
System User
Communication User
Communication users are primarily used for communication scenarios between systems or applications.
Service User
Service users can be used in shared or anonymous access scenarios.
Because these accounts can have shared-access characteristics, they should be controlled carefully according to the organization's security policies.
Reference User
A reference user is not intended for normal interactive login.
It can be used to provide additional authorizations to another user.
6. SAP User Locking and Unlocking
A user may become locked for several reasons:
Incorrect password attempts
Manual administrator lock
Security policy
Central user administration
Other configured security controls
For an individual user, the BASIS administrator can check the account in:
SU01 → Lock/Unlock
7. User Cannot Log In – BASIS Troubleshooting
This is an extremely common production-support scenario.
Scenario
"The user was able to log in yesterday, but today the user cannot log in."
Don't simply reset the password.
Follow a structured investigation:
Does the user exist?
↓
Is the user locked?
↓
Password / initial password status?
↓
Validity dates?
↓
Correct client?
↓
Authorization?
↓
Exact error message?
↓
Security / audit investigation if required
Interview Answer
A strong BASIS response would be:
"First I would check whether the user exists and whether the account is locked. Then I would verify the password status, validity dates and client. If the user can authenticate but cannot perform a specific activity, I would investigate the authorization issue using SU53 and, if required, STAUTHTRACE. I would also review the exact error message and relevant security information."
This demonstrates troubleshooting thinking rather than simply knowing transaction codes.
8. What Is an SAP Client?
An SAP client is a logical organizational unit within an SAP system.
A single SAP system can contain multiple clients.
For example:
SAP System
|
+-- Client 000
|
+-- Client 100
|
+-- Client 200
|
+-- Client 300
Depending on the data and application design, clients can contain their own:
Users
Roles
Business data
Customizing data
However, not every object in SAP is client-dependent. Some technical and repository objects are cross-client.
9. SCC4 – SAP Client Administration
SCC4 is used to maintain the client definition and client-specific settings.
Typical information includes:
Interview Question
What is SCC4 used for?
Answer
SCC4 is used to maintain the logical client definition and client-specific settings in an SAP system.
Important Point
Creating a client definition in SCC4 does not mean that the client has already been populated with business or customizing data.
It primarily defines the client and its settings.
10. SAP Client Creation – High-Level Process
At a high level:
Create Client Definition
↓
Maintain Client Settings
↓
Populate Client
↓
Post-Copy Activities
↓
Validation
Depending on the requirement, the client can be populated using supported client-copy or client-transport procedures.
SAP documents client-copy tools for creating and copying clients within the same system or between systems.
11. SCCL – Local Client Copy
SCCL is used for a local client copy.
The source and target clients are located in the same SAP system. SAP's BASIS documentation explicitly identifies SCCL as local client copy.
Example:
Same SAP System
Client 100
|
| SCCL
↓
Client 200
Typical Use Case
Creating a test or sandbox client from an existing client within the same SAP system.
12. SCC9 / SCC9N – Remote Client Copy
When the source and target clients are in different SAP systems, a remote client-copy procedure can be used.
Example:
DEV System QA System
Client 100 ------------------> Client 200
RFC
SAP documents remote client copy as a direct transfer between systems using the RFC interface.
Typical Pre-Checks
Before starting a remote client copy, BASIS should verify:
Important
Do not start a large production-to-QA client copy just because the RFC connection works.
A successful RFC test is only one part of the readiness check.
13. SCCL vs SCC9 – Must-Know Interview Question
| Feature | SCCL | SCC9/SCC9N |
|---|
| Type | Local client copy | Remote client copy |
| Source | Same SAP system | Different SAP system |
| Target | Same SAP system | Another SAP system |
| Communication | Within system | RFC-based |
| Typical use | Client copy within system | Cross-system client copy |
Easy Memory Trick
L = Local → SCCL
9 = Remote → SCC9
This is one of the simplest SAP BASIS interview questions to remember.
14. Client Copy Profiles
Client-copy profiles determine the scope of data copied.
Depending on the SAP release and procedure, profiles can control whether the copy includes areas such as:
SAP documentation lists profiles such as SAP_ALL, SAP_APPL, SAP_CUST and others, with their respective data scopes.
For example, SAP documentation describes SAP_ALL as copying all client data except specified exclusions such as change documents and local data, while SAP_APPL is SAP_ALL without user master data.
Important Interview Question
Does client copy always copy everything?
Answer: No.
The data copied depends on:
The selected copy profile
The client-copy procedure
The SAP release
The specific business/system requirement
Therefore, always verify the profile and expected scope before executing the copy.
15. Client Copy – Production Support Checklist
Before executing a significant client copy, consider:
Technical Checks
Source and target clients confirmed
RFC connectivity validated
Client settings checked in SCC4
Database capacity checked
Filesystem capacity checked where relevant
Background jobs reviewed
System workload reviewed
Runtime estimated
Logs/monitoring planned
Business Checks
Business approval obtained
Users informed
Interfaces considered
Batch jobs considered
Data-retention requirements checked
Downtime/locking impact understood
Post-Copy Checks
Client copy logs reviewed
Users validated
Roles/authorizations checked
Interfaces validated
Background jobs reviewed
Logical systems checked where applicable
Application functionality validated
16. Client Deletion – High-Risk BASIS Activity
Client deletion should never be treated as a simple "delete" operation.
Before deleting a client, verify:
Interview Question
How would you delete an SAP client?
Avoid giving a simplistic answer such as:
"I will delete the client from SCC4."
A stronger answer is:
"First I would obtain the required approval and confirm the correct client. I would review dependencies, jobs, interfaces, data-retention requirements and recovery options. Then I would execute the supported SAP client-deletion procedure, monitor the process and validate the system after completion."
That answer demonstrates real production experience.
17. User vs Client – Don't Confuse Them
This is a common interview trap.
Client
A logical organizational unit inside an SAP system.
User
An identity that logs into a specific client.
Therefore:
A user master record is client-specific.
Example:
Client 100 → USER01
Client 200 → USER01
The username is the same, but the user master records belong to different clients.
SAP explicitly states that user master records are maintained separately for each client.
18. Practical Scenario – Developer Has Authorization Error
Situation
A developer says:
"I have the role assigned, but I still get an authorization error."
BASIS Troubleshooting
PFCG Role
↓
Authorization Objects
↓
Field Values
↓
Authorization Generated?
↓
User Assigned?
↓
User Comparison / Update
↓
SU53
↓
STAUTHTRACE
What Should You Check?
Is the correct role assigned?
Are the authorization values correct?
Has the role been generated?
Is the user assignment correct?
Has the authorization data been updated?
What does SU53 show?
Is STAUTHTRACE required for deeper analysis?
19. Practical Scenario – DEV to QA Client Copy
Requirement
The project team asks:
"We need to copy a client from DEV to QA."
Before execution, ask:
Source Client?
↓
Target Client?
↓
Same or Different System?
↓
Local or Remote Copy?
↓
RFC Connectivity?
↓
Copy Profile?
↓
Database/Storage Capacity?
↓
Runtime?
↓
Business Impact?
↓
Post-Copy Activities?
If the source and target are in different systems, the operation falls into the remote-copy category. SAP documents remote copy using RFC without requiring an intermediate client transport.
20. Rapid-Fire SAP BASIS Interview Questions
Q1. What is SU01?
SU01 is used for SAP user administration and maintenance.
Q2. What is PFCG?
PFCG is used for SAP role and authorization maintenance.
Q3. What is SU53?
SU53 helps analyze the last failed authorization check.
Q4. What is SCC4?
SCC4 is used to maintain client definitions and client-specific settings.
Q5. What is SCCL?
SCCL performs a local client copy within the same SAP system.
Q6. What is SCC9?
SCC9 is used for remote client copy between SAP systems.
Q7. What are the common SAP user types?
Dialog, System, Communication, Service and Reference.
Q8. Can a System user normally be used as a regular interactive business user?
It is intended primarily for technical/background processing rather than normal interactive activity.
Q9. What is the difference between a role and profile?
A role is maintained through PFCG and contains authorization information; the generated profile represents the authorization information assigned to the user.
Q10. Where do you unlock a user?
SU01 → Lock/Unlock
Q11. Can two clients have the same username?
Yes. User master records are client-specific.
Q12. Is every SAP table client-dependent?
No. SAP contains both client-dependent and cross-client data.
Q13. What should you check before a client copy?
Source/target, client settings, connectivity, authorizations, storage, jobs, runtime, business impact and post-copy requirements.
Q14. What is the difference between SCCL and SCC9?
SCCL = Local client copy
SCC9/SCC9N = Remote client copy
Q15. What is the biggest risk during client deletion?
Deleting the wrong client or proceeding without validating approvals, dependencies, recovery and data-retention requirements.
21. 30-Second Interview Answer
If an interviewer asks:
"Explain SAP User and Client Administration."
You can answer:
"SAP BASIS user administration primarily involves maintaining users through SU01 and managing roles and authorizations through PFCG. For authorization troubleshooting, I use tools such as SU53 and STAUTHTRACE. SAP provides different user types including Dialog, System, Communication, Service and Reference users. For client administration, SCC4 is used to maintain client definitions and settings. Client copies can be performed locally using SCCL or remotely using SCC9/SCC9N depending on the source and target systems. Before performing a client copy or deletion, I would always validate approvals, connectivity, storage, dependencies, running jobs, business impact and post-activity requirements."
22. The Most Important BASIS Transactions to Remember
| Transaction | Purpose |
|---|
| SU01 | User Administration |
| SU10 | Mass User Maintenance |
| PFCG | Role Maintenance |
| SU53 | Authorization Error Analysis |
| STAUTHTRACE | Authorization Trace |
| SU56 | User Authorization Buffer |
| SCC4 | Client Maintenance |
| SCCL | Local Client Copy |
| SCC9/SCC9N | Remote Client Copy |
| SCC3 | Client Copy Logs |
| SCC5 | Client Deletion |
| SCC8 | Client Export |
SAP's current BASIS transaction documentation also identifies SCCL, SCC9, SCC8 and SCC5 for these client administration activities.
23. Final Takeaway
SAP User and Client Administration may look simple because many activities are performed using familiar transactions such as SU01, PFCG, SCC4, SCCL and SCC9.
But an experienced BASIS consultant should think beyond transaction codes.
The real skill is understanding:
User → Role → Authorization → Client → Copy Profile → System Landscape → Business Impact
When working in production, always validate the requirement, understand the scope, check dependencies and plan the rollback/recovery considerations before performing high-impact activities.
For SAP BASIS interviews, remember these five:
SU01 → User
PFCG → Role
SCC4 → Client
SCCL → Local Copy
SCC9 → Remote Copy
Master these concepts and you will be able to answer both transaction-based and scenario-based SAP BASIS interview questions with much greater confidence.
