SAP Fiori Security & Authorization: 10 Best Practices

The Fiori security model in one picture

Fiori uses two role types:

• **Front-end role** — catalogs, groups, spaces & pages (what the user sees)
• **Back-end role** — OData services + classic authorization objects (what the user can do)

10 best practices

1. Separate front-end and back-end roles always.
2. Use business catalogs from SAP's reference content — don't rebuild from scratch.
3. Use spaces & pages (not groups) for S/4HANA 2020+.
4. Never assign SAP_ALL in production — even for Fiori testing.
5. Restrict OData services with S_SERVICE.
6. Use PFCG derived roles for org-level restrictions.
7. Trace missing authorizations with /IWFND/TRACES and ST01 together.
8. Version-control your catalog assignments.
9. Automate role transports — no manual role edits in QA/PRD.
10. Run SoD analysis with GRC on the back-end roles.

Common mistakes

Assigning SAP_UI2_USER_700 to everyone, forgetting S_START, or mixing catalogs across LoBs.