SU01, SU10, or PFCG: which one for which job
Two different questions
User administration answers who has an account, what type it is, whether it is locked, and when it expires. Authorization administration answers what an account is permitted to do. SAP keeps these in separate transactions on purpose, and questions in this area usually test whether you noticed.
SU01 and SU10 are the same job at different scale
SU01 maintains a single user: address data, user type, validity dates, initial password, assigned roles and profiles, and user group.
SU10 performs the same maintenance across a selected set of users in one operation. When a question mentions applying a change to a department, a group, or a list, it is describing SU10 even if it does not name it.
PFCG owns the permissions
Role maintenance is where authorizations are defined, generated into profiles, and assigned. Adding a transaction to someone's access is a PFCG task rather than an SU01 task, even though the assignment is visible from the user record.
The practical rule: if the change is about a person, start in SU01 or SU10. If it is about a permission, start in PFCG.
Least privilege in practice
The safe default is to grant the narrowest role that lets someone finish their work, and to prefer expiring access over permanent access where the work is temporary. Validity dates on the user record and tightly scoped roles are the two levers for that.
Common questions
- Can you assign a role to many users at once?
- Yes, through SU10. It applies the same maintenance, including role assignment, across a selected set of users in a single operation.
- Should authorizations be changed in SU01?
- No. SU01 assigns existing roles to a user, but the authorizations inside those roles are defined and generated in PFCG.
- What is the difference between a role and a profile?
- A role is what you maintain in PFCG. Generating that role produces a profile, which is the object the system actually checks at runtime.