Real-Time Case of SU25 : Dealing with Authorization Problems After an SAP Upgrade

 Whenever an SAP system is upgraded, one of the most common complaints from users is that something they could do before suddenly stops working. A transaction that used to run fine now throws an authorization error.

So, how do I usually approach this?

My way of handling it step by step:

1. I always begin with an SU53 check. I ask the user to share the screenshot right after the error so I can quickly see which authorization objects are missing.

2. If that doesn’t give the full picture, I move to ST01 or STAUTHTRACE. This helps me trace what exactly is being checked in the background and which field or value is failing.

3. Then I look into SU24 proposals. After an upgrade, these proposals often change, so I confirm if the right objects are still tied to the transaction.

4. Next, I go through the SU25 post-upgrade steps:

   • Step 2a: Making sure SAP’s adjusted proposals are taken in.

   • Step 2b: Double-checking customer-specific changes.

5. If needed, I regenerate the affected roles in PFCG so that the new or updated objects are properly in sync.

6. I also verify organizational level fields and ensure that master and derived roles are consistent.

7. Finally, I check for transport gaps and reset the user buffer (SU56), because sometimes the issue is simply a missed transport or outdated buffer.

By moving through these checks in order, I’m usually able to pinpoint and fix the root cause of authorization errors that appear after an upgrade.