SAP User & Client Administration: SU01, PFCG, SCC4, SCCL & SCC9 Complete BASIS Guide

SAP User and Client Administration is one of the most important areas for every SAP BASIS administrator.

Whether you are working on SAP ECC, SAP S/4HANA, SAP NetWeaver or S/4HANA Private Cloud, understanding users, roles, authorizations, clients and client-copy procedures is essential for day-to-day administration and production support.

In this guide, we will cover:

SU01 – SAP User Administration
PFCG – Role and Authorization Management
SAP User Types
User Lock/Unlock Troubleshooting
SCC4 – Client Administration
SCCL – Local Client Copy
SCC9/SCC9N – Remote Client Copy
Client Copy Profiles
Client Deletion Considerations
Local vs Remote Client Copy
Practical BASIS troubleshooting scenarios
SAP BASIS interview questions

BASIS Tip: Don't memorize only transaction codes. In real projects, interviewers and clients are more interested in understanding why and when you use each transaction.

1. SAP User Administration – SU01

SU01 is the primary SAP transaction used for maintaining user master records.

SAP documentation describes SU01 as a user administration tool for creating and maintaining users. User master records contain information such as basic user data, logon information and authorization assignments.

Common SU01 Activities

A BASIS administrator can use SU01 to perform activities such as:

Create users
Change user details
Display users
Lock or unlock users
Reset passwords
Maintain validity dates
Assign roles
Assign profiles
Maintain user groups
Maintain user parameters
Delete users

Important SU01 Tabs

Tab	Purpose
Address	Name, email, telephone, department and related information
Logon Data	User type, password and validity
Defaults	Logon language, date format, decimal notation and printer
Parameters	User-specific parameter IDs
Roles	Roles assigned to the user
Profiles	Authorization profiles assigned to the user
Groups	User group information
SNC	Secure Network Communication-related settings

Important BASIS Point

A user master record is client-specific. Therefore, the same username can exist independently in different SAP clients.

For example:

SAP System

Client 100
   └── USER01

Client 200
   └── USER01

These are separate user master records.

2. SAP Roles and Authorizations – PFCG

PFCG is the standard transaction for SAP role maintenance.

SAP describes PFCG as the role maintenance tool used to configure roles and manage authorization-related information.

A typical role-maintenance flow is:

Create Role
     ↓
Maintain Menu
     ↓
Maintain Authorizations
     ↓
Generate Authorization Profile
     ↓
Assign User
     ↓
User Comparison / Authorization Update

Important PFCG Tabs

Authorizations

The Authorizations tab contains:

Authorization objects
Authorization fields
Organizational levels
Authorization values
Generated authorization profile

User

The User tab contains:

Users assigned to the role
User assignment information
User comparison/update functions

3. Role vs Profile – Important Interview Question

One of the most common SAP BASIS interview questions is:

What is the difference between a Role and a Profile?

Role:

A role is maintained in PFCG and contains the menu and authorization information required for a business function.

Profile:

The authorization profile is generated from the role and represents the authorization information that is assigned to the user.

In modern SAP administration, administrators normally maintain authorizations through roles in PFCG rather than manually maintaining authorization profiles.

4. What Happens When a Role Is Assigned to a User?

Suppose a user reports:

"I have been assigned the required role, but I still receive an authorization error."

Don't immediately assume that the role assignment is wrong.

Use a structured troubleshooting approach:

Check PFCG Role
       ↓
Check Authorization Values
       ↓
Authorization Generated?
       ↓
User Assigned?
       ↓
User Comparison / Update
       ↓
SU53
       ↓
STAUTHTRACE if required

Useful transactions include:

PFCG – Role maintenance
SU01 – User maintenance
SU53 – Analyze failed authorization checks
STAUTHTRACE – Authorization trace
SU56 – Display user's authorization buffer

5. SAP User Types

SAP provides different user types for different purposes.

The commonly encountered user types are:

User Type	Typical Purpose
Dialog	Normal interactive SAP users
System	Technical/background processing
Communication	System/application communication
Service	Shared or anonymous access scenarios
Reference	Additional authorizations for another user

Dialog User

A Dialog user is generally used by normal SAP end users.

Example:

Employee
   ↓
SAP GUI / Application
   ↓
Dialog User

System User

System users are generally intended for technical processing and background communication rather than normal interactive business-user activity.

Example:

Background Job
      ↓
Technical Processing
      ↓
System User

Communication User

Communication users are primarily used for communication scenarios between systems or applications.

Service User

Service users can be used in shared or anonymous access scenarios.

Because these accounts can have shared-access characteristics, they should be controlled carefully according to the organization's security policies.

Reference User

A reference user is not intended for normal interactive login.

It can be used to provide additional authorizations to another user.

6. SAP User Locking and Unlocking

A user may become locked for several reasons:

Incorrect password attempts
Manual administrator lock
Security policy
Central user administration
Other configured security controls

For an individual user, the BASIS administrator can check the account in:

SU01 → Lock/Unlock

7. User Cannot Log In – BASIS Troubleshooting

This is an extremely common production-support scenario.

Scenario

"The user was able to log in yesterday, but today the user cannot log in."

Don't simply reset the password.

Follow a structured investigation:

Does the user exist?
        ↓
Is the user locked?
        ↓
Password / initial password status?
        ↓
Validity dates?
        ↓
Correct client?
        ↓
Authorization?
        ↓
Exact error message?
        ↓
Security / audit investigation if required

Interview Answer

A strong BASIS response would be:

"First I would check whether the user exists and whether the account is locked. Then I would verify the password status, validity dates and client. If the user can authenticate but cannot perform a specific activity, I would investigate the authorization issue using SU53 and, if required, STAUTHTRACE. I would also review the exact error message and relevant security information."

This demonstrates troubleshooting thinking rather than simply knowing transaction codes.

8. What Is an SAP Client?

An SAP client is a logical organizational unit within an SAP system.

A single SAP system can contain multiple clients.

For example:

SAP System
   |
   +-- Client 000
   |
   +-- Client 100
   |
   +-- Client 200
   |
   +-- Client 300

Depending on the data and application design, clients can contain their own:

Users
Roles
Business data
Customizing data

However, not every object in SAP is client-dependent. Some technical and repository objects are cross-client.

9. SCC4 – SAP Client Administration

SCC4 is used to maintain the client definition and client-specific settings.

Typical information includes:

Client number
Client description
Client role
Changes and transports settings
Client protection settings

Interview Question

What is SCC4 used for?

Answer

SCC4 is used to maintain the logical client definition and client-specific settings in an SAP system.

Important Point

Creating a client definition in SCC4 does not mean that the client has already been populated with business or customizing data.

It primarily defines the client and its settings.

10. SAP Client Creation – High-Level Process

At a high level:

Create Client Definition
          ↓
Maintain Client Settings
          ↓
Populate Client
          ↓
Post-Copy Activities
          ↓
Validation

Depending on the requirement, the client can be populated using supported client-copy or client-transport procedures.

SAP documents client-copy tools for creating and copying clients within the same system or between systems.

11. SCCL – Local Client Copy

SCCL is used for a local client copy.

The source and target clients are located in the same SAP system. SAP's BASIS documentation explicitly identifies SCCL as local client copy.

Example:

Same SAP System

Client 100
     |
     | SCCL
     ↓
Client 200

Typical Use Case

Creating a test or sandbox client from an existing client within the same SAP system.

12. SCC9 / SCC9N – Remote Client Copy

When the source and target clients are in different SAP systems, a remote client-copy procedure can be used.

Example:

DEV System                       QA System

Client 100  ------------------>  Client 200
                  RFC

SAP documents remote client copy as a direct transfer between systems using the RFC interface.

Typical Pre-Checks

Before starting a remote client copy, BASIS should verify:

Source client
Target client
RFC connectivity
Client settings
Required authorizations
Database/storage capacity
Background processing
Network connectivity
Runtime expectations
Business impact
Locking/downtime requirements
Post-copy activities

Important

Do not start a large production-to-QA client copy just because the RFC connection works.

A successful RFC test is only one part of the readiness check.

13. SCCL vs SCC9 – Must-Know Interview Question

Feature	SCCL	SCC9/SCC9N
Type	Local client copy	Remote client copy
Source	Same SAP system	Different SAP system
Target	Same SAP system	Another SAP system
Communication	Within system	RFC-based
Typical use	Client copy within system	Cross-system client copy

Easy Memory Trick

L = Local → SCCL

9 = Remote → SCC9

This is one of the simplest SAP BASIS interview questions to remember.

14. Client Copy Profiles

Client-copy profiles determine the scope of data copied.

Depending on the SAP release and procedure, profiles can control whether the copy includes areas such as:

Customizing
User master data
Application data
Cross-client customizing considerations

SAP documentation lists profiles such as SAP_ALL, SAP_APPL, SAP_CUST and others, with their respective data scopes.

For example, SAP documentation describes SAP_ALL as copying all client data except specified exclusions such as change documents and local data, while SAP_APPL is SAP_ALL without user master data.

Important Interview Question

Does client copy always copy everything?

Answer: No.

The data copied depends on:

The selected copy profile
The client-copy procedure
The SAP release
The specific business/system requirement

Therefore, always verify the profile and expected scope before executing the copy.

15. Client Copy – Production Support Checklist

Before executing a significant client copy, consider:

Technical Checks

Source and target clients confirmed
RFC connectivity validated
Client settings checked in SCC4
Database capacity checked
Filesystem capacity checked where relevant
Background jobs reviewed
System workload reviewed
Runtime estimated
Logs/monitoring planned

Business Checks

Business approval obtained
Users informed
Interfaces considered
Batch jobs considered
Data-retention requirements checked
Downtime/locking impact understood

Post-Copy Checks

Client copy logs reviewed
Users validated
Roles/authorizations checked
Interfaces validated
Background jobs reviewed
Logical systems checked where applicable
Application functionality validated

16. Client Deletion – High-Risk BASIS Activity

Client deletion should never be treated as a simple "delete" operation.

Before deleting a client, verify:

Correct client number
Business approval
Backup/recovery considerations
Running jobs
Interfaces
Dependencies
Data-retention requirements
System capacity
User impact

Interview Question

How would you delete an SAP client?

Avoid giving a simplistic answer such as:

"I will delete the client from SCC4."

A stronger answer is:

"First I would obtain the required approval and confirm the correct client. I would review dependencies, jobs, interfaces, data-retention requirements and recovery options. Then I would execute the supported SAP client-deletion procedure, monitor the process and validate the system after completion."

That answer demonstrates real production experience.

17. User vs Client – Don't Confuse Them

This is a common interview trap.

Client

A logical organizational unit inside an SAP system.

User

An identity that logs into a specific client.

Therefore:

A user master record is client-specific.

Example:

Client 100 → USER01

Client 200 → USER01

The username is the same, but the user master records belong to different clients.

SAP explicitly states that user master records are maintained separately for each client.

18. Practical Scenario – Developer Has Authorization Error

Situation

A developer says:

"I have the role assigned, but I still get an authorization error."

BASIS Troubleshooting

PFCG Role
    ↓
Authorization Objects
    ↓
Field Values
    ↓
Authorization Generated?
    ↓
User Assigned?
    ↓
User Comparison / Update
    ↓
SU53
    ↓
STAUTHTRACE

What Should You Check?

Is the correct role assigned?
Are the authorization values correct?
Has the role been generated?
Is the user assignment correct?
Has the authorization data been updated?
What does SU53 show?
Is STAUTHTRACE required for deeper analysis?

19. Practical Scenario – DEV to QA Client Copy

Requirement

The project team asks:

"We need to copy a client from DEV to QA."

Before execution, ask:

Source Client?
      ↓
Target Client?
      ↓
Same or Different System?
      ↓
Local or Remote Copy?
      ↓
RFC Connectivity?
      ↓
Copy Profile?
      ↓
Database/Storage Capacity?
      ↓
Runtime?
      ↓
Business Impact?
      ↓
Post-Copy Activities?

If the source and target are in different systems, the operation falls into the remote-copy category. SAP documents remote copy using RFC without requiring an intermediate client transport.

20. Rapid-Fire SAP BASIS Interview Questions

Q1. What is SU01?

SU01 is used for SAP user administration and maintenance.

Q2. What is PFCG?

PFCG is used for SAP role and authorization maintenance.

Q3. What is SU53?

SU53 helps analyze the last failed authorization check.

Q4. What is SCC4?

SCC4 is used to maintain client definitions and client-specific settings.

Q5. What is SCCL?

SCCL performs a local client copy within the same SAP system.

Q6. What is SCC9?

SCC9 is used for remote client copy between SAP systems.

Q7. What are the common SAP user types?

Dialog, System, Communication, Service and Reference.

Q8. Can a System user normally be used as a regular interactive business user?

It is intended primarily for technical/background processing rather than normal interactive activity.

Q9. What is the difference between a role and profile?

A role is maintained through PFCG and contains authorization information; the generated profile represents the authorization information assigned to the user.

Q10. Where do you unlock a user?

SU01 → Lock/Unlock

Q11. Can two clients have the same username?

Yes. User master records are client-specific.

Q12. Is every SAP table client-dependent?

No. SAP contains both client-dependent and cross-client data.

Q13. What should you check before a client copy?

Source/target, client settings, connectivity, authorizations, storage, jobs, runtime, business impact and post-copy requirements.

Q14. What is the difference between SCCL and SCC9?

SCCL = Local client copy

SCC9/SCC9N = Remote client copy

Q15. What is the biggest risk during client deletion?

Deleting the wrong client or proceeding without validating approvals, dependencies, recovery and data-retention requirements.

21. 30-Second Interview Answer

If an interviewer asks:

"Explain SAP User and Client Administration."

You can answer:

"SAP BASIS user administration primarily involves maintaining users through SU01 and managing roles and authorizations through PFCG. For authorization troubleshooting, I use tools such as SU53 and STAUTHTRACE. SAP provides different user types including Dialog, System, Communication, Service and Reference users. For client administration, SCC4 is used to maintain client definitions and settings. Client copies can be performed locally using SCCL or remotely using SCC9/SCC9N depending on the source and target systems. Before performing a client copy or deletion, I would always validate approvals, connectivity, storage, dependencies, running jobs, business impact and post-activity requirements."

22. The Most Important BASIS Transactions to Remember

Transaction	Purpose
SU01	User Administration
SU10	Mass User Maintenance
PFCG	Role Maintenance
SU53	Authorization Error Analysis
STAUTHTRACE	Authorization Trace
SU56	User Authorization Buffer
SCC4	Client Maintenance
SCCL	Local Client Copy
SCC9/SCC9N	Remote Client Copy
SCC3	Client Copy Logs
SCC5	Client Deletion
SCC8	Client Export

SAP's current BASIS transaction documentation also identifies SCCL, SCC9, SCC8 and SCC5 for these client administration activities.

23. Final Takeaway

SAP User and Client Administration may look simple because many activities are performed using familiar transactions such as SU01, PFCG, SCC4, SCCL and SCC9.

But an experienced BASIS consultant should think beyond transaction codes.

The real skill is understanding:

User → Role → Authorization → Client → Copy Profile → System Landscape → Business Impact

When working in production, always validate the requirement, understand the scope, check dependencies and plan the rollback/recovery considerations before performing high-impact activities.

For SAP BASIS interviews, remember these five:

SU01  → User
PFCG  → Role
SCC4  → Client
SCCL  → Local Copy
SCC9  → Remote Copy

Master these concepts and you will be able to answer both transaction-based and scenario-based SAP BASIS interview questions with much greater confidence.

Pages

Tuesday, September 1, 2026