PFCG and SAP Fiori Roles
PFCG is the SAP role maintenance transaction that grants SAP Fiori access on-premise and in Private Edition. A PFCG role menu holds business catalogs and launchpad spaces, and the role's authorizations include the start authorizations for the OData services the apps call, checked through the authorization object S_SERVICE.
Quick facts
- Type
- Transaction (role maintenance)
- Layer
- Content, navigation & access
- SAP Fiori menu entries
- Launchpad Catalog; Launchpad Space / Launchpad Space Template
- Key authorization object
- S_SERVICE (OData service start authorization)
- SAP templates
- SAP_BR_* business roles; SAP_FLP_USER and SAP_FLP_ADMIN for the launchpad
- Related transactions
- SU53, STAUTHTRACE, SU25, /UI2/FLIA
- Applies to
- SAP S/4HANA on-premise, Private Edition, SAP ECC with SAP Fiori
Layer: Content, navigation & accessWhere it sits ▾
Layer: Content, navigation & access
Open the architecture map →What does PFCG do for SAP Fiori?
PFCG is the same role maintenance transaction used for SAP GUI, with SAP Fiori entries added to the role menu. For SAP Fiori, a PFCG role does three jobs:
- Content: business catalogs decide which apps the user can reach; launchpad spaces decide the home page layout.
- Start authorizations: S_SERVICE entries allow the user to call the OData services behind the apps.
- Business authorizations: the usual authorization objects, such as purchasing organization or company code, decide what data the user can see and change.
PFCG is where SAP Fiori content and classic SAP authorizations meet in one role.
How do you build an SAP Fiori role in PFCG step by step?
- Copy an SAP_BR_* template, for example SAP_BR_PURCHASER, to the customer namespace. Users also need the launchpad start role; SAP delivers SAP_FLP_USER as a template.
- On the Menu tab, add SAP Fiori Launchpad → Launchpad Catalog, choose the local or a remote front-end server and select the business catalog. Keep Include Applications active so the apps' authorization defaults, including OData services, are added.
- Add SAP Fiori Launchpad → Launchpad Space with the space ID, if the release of the front-end server supports spaces.
- On the Authorizations tab, maintain open values and generate the profile.
- Assign users and run the user comparison.
In a hub deployment, the back-end system needs its own role with matching business authorizations; the report PRGN_CREATE_FIORI_BACKENDROLE can create it from the front-end role menu. A working PFCG role for SAP Fiori is built in this order: content, start authorizations, then business authorizations.
How does S_SERVICE control OData access?
Every OData call from an SAP Fiori app passes a start authorization check on S_SERVICE. On the front-end server, the check uses the service's IWSG entry (OData V2) or G4BA entry (OData V4); on the back-end system, the IWSV entry applies to OData V2. When a catalog is added with its applications, PFCG derives these entries automatically. The service must be activated, and called once, before it can be assigned.
A wildcard (S_SERVICE set to an asterisk) lets users call every activated service. SAP advises against it in production. S_SERVICE decides whether an app may talk to its service at all; business authorizations still decide what the service returns.
What do common PFCG errors for SAP Fiori mean?
| Symptom | Likely cause in the role |
|---|---|
| No tile, app not found by search | Catalog missing, or the menu option that hides the menu from the launchpad is selected |
| Tile visible, navigation fails | Target mapping's catalog not in the user's roles; check with /UI2/FLIA |
| App opens, then shows a 403 or "no authorization" | S_SERVICE entry missing for the app's OData service |
| App opens with empty lists | Business authorization values missing in the back-end role |
For authorization failures, run SU53 or record the checks with STAUTHTRACE in the system where the check failed, front end or back end; in a hub deployment, the back-end checks run for the same user through a trusted RFC connection. Most PFCG errors for SAP Fiori trace back to one missing layer of the role.
PFCG role vs. business role in SAP S/4HANA Cloud Public Edition: what is the difference?
| PFCG role (on-premise, Private Edition) | Business role (Cloud Public Edition) | |
|---|---|---|
| Maintained in | Transaction PFCG | Maintain Business Roles app |
| SAP Fiori content | Catalogs and spaces in the role menu | Business catalogs and spaces assigned to the role |
| Authorizations | Authorization objects and values, including S_SERVICE | Restrictions per access category; objects are hidden |
| Starting point | Copies of SAP_BR_* template roles | Business role templates |
Both are business roles; PFCG exposes the authorization objects, the cloud app abstracts them.
FAQ
Do SAP Fiori apps still need PFCG roles in SAP S/4HANA?
Yes, on-premise and in Private Edition. Catalogs, spaces, OData start authorizations and business authorizations are all granted through PFCG roles. Only SAP S/4HANA Cloud Public Edition replaces PFCG with the Maintain Business Roles app.
Should I use S_SERVICE with a wildcard in production?
SAP advises against it. A wildcard lets users call every activated OData service, including services of apps they cannot see. Add catalogs with their applications instead, so PFCG derives the exact service entries the apps need.
Why does SU53 show nothing for a failing SAP Fiori app?
SU53 shows failed checks only for the system where you run it. Since ABAP platform 1809, it lists failed checks across all application server instances and works from any of the user's sessions, so the session is not the problem. SAP Fiori apps fail inside OData requests, often in a different system from where SU53 is started. Run SU53 or STAUTHTRACE on the front-end and back-end systems.
Can I use PFCG in SAP S/4HANA Cloud Public Edition?
No. Cloud Public Edition offers no access to PFCG. Administrators create business roles from SAP templates in the Maintain Business Roles app and control data access through restrictions instead of authorization objects.
Sources
- SAP Help Portal: Assign Business Catalogs to Roles (ABAP platform)
- SAP Help Portal: Creating Roles on Front-End and Assigning Launchpad Catalogs and Spaces/Pages (SAP S/4HANA)
- SAP Help Portal: Configuring Roles with Launchpad Start Authorizations (ABAP platform)
- SAP Help Portal: Configure Roles for Spaces (ABAP platform)
- SAP Help Portal: Display Authorization Data for User (Changed) — SU53 in ABAP platform 1809
- Applies to
- SAP S/4HANA on-premise · SAP S/4HANA Cloud Private Edition · SAP ERP (ECC)
- Last reviewed