Who has access to what?

Here’s a simple SAP security question:

𝗪𝗵𝗼 𝗵𝗮𝘀 𝗮𝗰𝗰𝗲𝘀𝘀 𝘁𝗼 𝘄𝗵𝗮𝘁?

It sounds almost too basic.

But there is a second part that makes it more interesting:

𝗖𝗮𝗻 𝘆𝗼𝘂 𝗮𝗻𝘀𝘄𝗲𝗿 𝗶𝘁 𝗻𝗼𝘄?

Not:

❌ After exporting three reports
❌ After someone builds a spreadsheet
❌ After asking an analyst to investigate it next week

I mean now.

And then:
→ Why does that person have the access?
→ Which role provides it?
→ Which authorization object provides it?
→ What value creates the access?
→ Is the access being used?
→ Is it sensitive?
→ Does it create an SoD conflict?
→ Would removing it from the assigned role affect other users?

That is where “visibility” becomes very different from simply having data.

Most large SAP environments contain the information required to answer these questions.

The challenge is connecting it quickly enough to make the information useful.

For me, that distinction is important.

𝗛𝗮𝘃𝗶𝗻𝗴 𝗦𝗔𝗣 𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗱𝗮𝘁𝗮 𝗶𝘀 𝗻𝗼𝘁 𝘁𝗵𝗲 𝘀𝗮𝗺𝗲 𝘁𝗵𝗶𝗻𝗴 𝗮𝘀 𝘂𝗻𝗱𝗲𝗿𝘀𝘁𝗮𝗻𝗱𝗶𝗻𝗴 𝘆𝗼𝘂𝗿 𝗦𝗔𝗣 𝗮𝗰𝗰𝗲𝘀𝘀 𝗽𝗼𝘀𝘁𝘂𝗿𝗲.

And when a CISO, auditor, or project team asks a question, speed matters.

You shouldn’t need to start a small consulting project every time someone asks:

“𝗪𝗵𝗼 𝗰𝗮𝗻 𝗱𝗼 𝘁𝗵𝗶𝘀?”