SU01: How to Create a New User in SAP
Jessica Blake
⚡ Smart Summary
SU01 is the central SAP transaction for creating and maintaining user master records. Creating a new user in SAP establishes secure system access, assigns the correct user type, and links the roles and profiles that govern every authorization.
User administration is one of the first tasks every SAP Basis or security administrator performs. Following are the detailed steps to create a user in SAP, together with the key concepts—user types, roles, profiles, and best practices—that keep each account secure and compliant.
What is SU01 in SAP?
SU01 is the SAP transaction code for User Maintenance. Administrators use it to create, display, change, lock, unlock, copy, and delete individual user master records in an SAP ABAP system. The user master record is the object that lets a person or a service log on and defines what that account is allowed to do.
A single SU01 record stores several groups of information: address data such as name and email, logon data including the user type and password, the user group used for administration, validity dates, and the assigned roles and profiles that carry authorizations. Because SU01 controls both access and authorization, it is a core tool for every SAP Basis and security team. Correctly maintained records keep the system compliant with audit requirements and prevent users from receiving more access than their job demands.
Steps to Create a User in SAP
The following eight steps walk through the complete process of creating a new user inside transaction SU01, from executing the T-code to saving the finished master record.
Step 1) Execute T-code SU01
Step 2)
- Enter Username which you want to create.
- Click the create button
Step 3) In the next screen
- Click the Address tab.
- Enter details
Step 4) Choose the user type in Logon Data tab.
There are 5 types of users in sap:-
- Dialog user: – Normally it is used for interactive system access from GUI (used for human users)
- System user: – Normally it is used for Background processing, communication within a system.
- Communication user: – It is used for external RFC calls.
- Service user: – Dialog user available to a larger, anonymous group of users.
- Reference user: – General, non-person related users that allows the assignment of additional authorizations. Example, Internet users created with transaction SU01. No logon is possible.
Step 5) Type the initial password for 2 times.
On first logon of the new user, system will ask to reset the password.
Step 6)
- Select the roles tab
- Assign roles as per requirements
Step 7)
- Select the profiles tab
- Assign profiles as per requirements
You can assign SAP_ALL and SAP_New profile to user for full authorization.
- SAP_ALL:You assign this profile to users who are to have all R/3 authorizations, including super-user authorization.
- SAP_NEW:You assign this profile to users who have access to all currently unprotected components. The SAP_NEW profile grants unrestricted access to all existing functions for which additional authorization checks have been introduced. Users can therefore continue to work uninterrupted with functions which are subject to new authorization checks which were not previously executed.
Step 8)
- Press save
- Then the back button (F3) button
User will be created!
Difference Between Roles and Profiles in SAP
Steps 6 and 7 above assign roles and profiles, but the two objects are not the same. Understanding the difference helps you grant access safely instead of over-authorizing an account.
A profile is a low-level, technical object that contains the actual authorization values the system checks at runtime. A role is a higher-level container built in the Profile Generator (PFCG); it stores the role name, description, business purpose, menu, and the authorization data. When you generate a role, SAP automatically creates its profile, so assigning a role in SU01 assigns the underlying profile indirectly. For day-to-day administration, always assign roles rather than raw profiles, because roles are easier to document, transport, and audit.
| Aspect | Role | Profile |
|---|---|---|
| Level | High-level business object | Low-level technical object |
| Created with | Profile Generator (PFCG) | Generated automatically from a role |
| Contains | Menu, description, and authorization data | Authorization values checked at logon |
| Assigned in SU01 | Roles tab | Profiles tab |
| Best practice | Preferred for user assignment | Assigned indirectly through roles |
SU01 vs SU10: Single vs Mass User Maintenance
SU01 maintains one user at a time, which is ideal when you create or edit a single account. When the same change must reach many users—for example assigning a role during a project rollout or a reorganization—transaction SU10 performs the update for a selected list of users in one operation. Both transactions edit the same user master records, so the choice depends on how many accounts you need to touch.
| Criteria | SU01 | SU10 |
|---|---|---|
| Scope | One user per transaction | Many users at once |
| Best for | Creating or editing a single account | Mass role or lock changes |
| Typical use | New hire, single correction | Project rollout, reorganization |
| Data maintained | Full user master record | Selected fields across users |
Best Practices for Creating Users in SAP
A consistent process keeps user administration secure and audit-ready. Apply the following best practices whenever you create an account in SU01:
- Use a naming convention: Adopt a standard user ID format so accounts are easy to identify and report on.
- Assign a user group: Group users by department or function to simplify management and delegated administration.
- Prefer roles over profiles: Grant access through roles built in PFCG rather than direct profile assignment.
- Apply least privilege: Give only the authorizations a job requires, and avoid SAP_ALL for regular users.
- Set validity dates: Restrict temporary or contractor accounts with Valid From and Valid To dates.
- Review regularly: Audit users, roles, and locked accounts periodically to keep the system aligned with your SAP Security policy.
