Dear All, do you want to know – How to find out who are all having access to a particular tcode in SAP system? In an SAP system, administrators and SAP Security consultants frequently need to identify which users have authorization to execute a particular transaction code (T-Code). For example, you may need to find all users who can access SE16, SE16N, SM30, SU01, PFCG, SE38 or another transaction.

SAP provides a standard reporting facility called the User Information System (SUIM). Using SUIM, an SAP Basis administrator or Security consultant can search for users based on transaction authorizations and generate a list of user IDs associated with a particular transaction code.

In this step-by-step tutorial, we will use SE16 as an example and demonstrate how to identify all users who have authorization for this transaction in an SAP system. Learn how to use SAP SUIM step by step to find all users who have authorization for a particular transaction code such as SE16.

1. Why Do We Need to Identify Users Having Access to a Particular T-Code?

In day-to-day SAP operations, there are many situations in which the Basis or Security team needs to identify users who have access to a particular transaction.

Consider the following real-time scenario.

A business user needs to make an urgent change to a table in the SAP system. However, the user does not have the required authorization to perform the activity. The business team approaches the SAP Basis or Security team and requests assistance in identifying users who are authorized to execute the relevant transaction.

In this situation, the administrator can use SUIM to identify users associated with the required transaction authorization and share the results with the authorized business or support team.

Other common reasons include:

• Security audits: Identify users who have access to sensitive or critical SAP transactions.
• Access reviews: Verify whether transaction access is assigned to the correct employees.
• Emergency support: Identify authorized support personnel who can perform an approved activity.
• Segregation of Duties (SoD): Support reviews of potentially conflicting access.
• Role cleanup: Identify users who may no longer require particular transaction authorizations.
• Compliance reporting: Prepare user access lists for internal and external auditors.
• Troubleshooting: Investigate why one user can start a transaction while another user cannot.

Instead of checking every user individually, SUIM allows the administrator to search for users using a transaction authorization as the selection criterion.

2. Prerequisites Before Starting the SUIM Report

Before executing the report, make sure that you have the necessary access to the SAP system.

Requirement	Details
SAP system access	You must be able to log in to the relevant SAP system and client.
Transaction SUIM	You need authorization to execute the User Information System report.
Transaction code	Know the exact transaction code you want to investigate, for example SE16.
Correct SAP environment	Confirm whether you are checking Development, Quality, Production or another SAP system.
Correct client	Make sure you are checking the intended SAP client. User assignments can differ between clients.

Important: The results are specific to the SAP system and client in which you execute the report. Do not assume that the same users or authorizations exist in every environment.

3. Step-by-Step Procedure to Find Users Having Access to a Particular T-Code

Follow the procedure below to identify users who have authorization for a particular transaction code.

Step 1: Log in to the SAP System

First, open SAP GUI and log in using your authorized SAP user ID and password.

1. Open SAP Logon.
2. Select the SAP system you want to investigate.
3. Click Log On.
4. Enter your client, user ID and password, if requested.
5. Press Enter to access the SAP Easy Access screen.

For this demonstration, we will assume that you want to identify all users who have authorization for transaction code SE16.

Step 2: Execute Transaction SUIM

Once you have successfully logged in, enter the transaction code SUIM in the SAP command field.

1. Locate the SAP command field at the top of the SAP GUI screen.
2. Enter /nSUIM to open SUIM from the current session.
3. Press Enter.
4. The SAP User Information System screen will appear.

You can also enter SUIM directly if you are already on a suitable SAP Easy Access screen.

The User Information System provides different reporting options for users, roles, profiles, authorizations and transaction assignments.

10 Surprising Reasons Why You Will Like Windows 10 Best

Step 3: Navigate to Users by Complex Selection Criteria

On the SUIM screen, expand the Users node in the left-hand navigation tree.

Follow this exact navigation path:

Detailed instructions:

1. Find the Users folder in the SUIM navigation tree.
2. Click the expand arrow or plus symbol next to Users.
3. Locate Users by Complex Selection Criteria.
4. Expand this selection if required.
5. Choose By Transaction Authorizations.
6. Double-click the selection or select it and execute the report using the Execute icon or F8, depending on your SAP GUI screen.

This selection allows you to search for user IDs based on transaction authorization information.

Note: The exact wording or arrangement of the navigation tree can vary slightly depending on the SAP release and interface. Look for the option named By Transaction Authorizations.

Step 4: Enter the Transaction Code You Want to Search

After selecting By Transaction Authorizations, SAP displays the report selection screen.

On this screen, enter the transaction code for which you want to identify users.

For our example:

Selection field	Value
Transaction code	SE16
Search purpose	Identify users with authorization for SE16

Follow these steps:

1. Locate the transaction authorization or transaction code selection field.
2. Enter SE16 in the appropriate field.
3. Check that you have entered the correct transaction code.
4. Do not enter the transaction description in place of the code.
5. Leave other selection fields at their default values unless you have a specific requirement to restrict the search.

You can replace SE16 with another transaction code when required. For example, you could search for MM03, VA03, FB03, SM30 or another valid transaction code in your SAP environment.

Step 5: Execute the Search Using F8

After entering the transaction code, execute the report.

1. Verify that the transaction code entered is correct.
2. Click the Execute button, normally represented by a clock/check-style icon on the selection screen.
3. Alternatively, press F8 on your keyboard.
4. Wait for SAP to process the report.
5. The system will display the matching user records, if any are found.

For this example, the report searches for users associated with the authorization for transaction SE16.

Step 6: Review the List of Users Having Authorization

After successful execution, SAP displays the report output containing users matching the selection criteria.

Review the result carefully. Depending on the SAP release and report layout, the output may contain user IDs and additional user information.

The report output helps the SAP administrator identify which user IDs have the selected transaction authorization in the current system and client.

Important: The screenshot is an example from an earlier SAP GUI version. Your actual result layout, columns and user list will depend on your own SAP system and its authorization configuration.

Step 7: Record and Validate the User IDs

After obtaining the result, do not immediately assume that every listed user is currently able to perform every activity associated with the transaction.

For a proper access review, record and validate the following information:

• User ID
• User description or full name, where available
• SAP system and client
• Transaction code searched
• Assigned roles and authorization profiles
• User validity dates
• User lock status
• Business owner or department, if required for the review

Where necessary, open the user details using the appropriate authorized administration or reporting transaction and investigate the roles and authorization assignments behind the result.

4. How to Find the Roles Assigned to a User Who Has the T-Code Authorization

Identifying user IDs is only the first part of an SAP access investigation. In many cases, the business or audit team will also ask:

• Which role provides this user with access?
• Is the transaction authorization coming from a single role or multiple roles?
• Is the user assigned a composite role?
• Is the authorization assigned through a profile?

To investigate the role assignments, you can use SUIM or the appropriate user and role administration tools available in your SAP environment.

A typical investigation process is:

1. Copy the user ID from the SUIM result.
2. Open the relevant user evaluation or user maintenance screen, if you have permission.
3. Review the roles assigned to the user.
4. Check the role validity dates and assignment status.
5. Identify the role or roles containing the transaction authorization.
6. Review the generated authorization data for the relevant role.
7. Record the findings for the access review.

In many SAP systems, transaction SU01 is used to display user master information, while PFCG is used for role maintenance. Use these transactions only when you have the required authorization, and do not make changes during an investigation unless an approved change request exists.

5. Understanding the SAP Authorization Object S_TCODE

To understand why SUIM can identify users associated with a transaction code, it is useful to know about the SAP authorization object S_TCODE.

When a user starts a standard SAP transaction manually, SAP checks whether the user is authorized to start that transaction. The authorization object used for this start check is generally S_TCODE.

The important authorization field in S_TCODE is:

Authorization object	Field	Meaning
S_TCODE	TCD	Transaction code that the user is permitted to start.

For example, an authorization entry may include the value SE16 in the TCD field.

However, permission to start a transaction does not automatically mean that the user can perform every activity within it. The application may perform additional authorization checks for business operations, organizational values, tables or other protected resources.

For example, a user may be able to start SE16 but may not be authorized to display every table. Additional checks can apply depending on the transaction, table and system configuration.

This distinction is particularly important when investigating access to sensitive transactions such as SE16, SE16N, SM30, SU01 and PFCG.

6. Alternative Method: Search Users Through Authorization Values

If you need to investigate the underlying transaction authorization values, another SUIM approach is to search using the authorization object and its field values.

A typical navigation path is:

Where the relevant selection fields are available, you can investigate the following:

1. Open transaction SUIM.
2. Expand the Where-Used List section.
3. Select Authorization Values.
4. Choose the option to search In Users.
5. Enter authorization object S_TCODE.
6. Open the entry-value selection, if provided by your SAP release.
7. Enter the transaction code, for example SE16, in the relevant TCD value selection.
8. Execute the report and review the matching records.

Note: The exact selection-screen fields and menu labels can differ by SAP release. Use this as an alternative authorization-value investigation, not as a replacement for validating the actual user access.

7. How to Export the SUIM Result for an Audit or Access Review

In many SAP GUI reports, the result can be exported using the available list or ALV export functions. This is useful when the business team or auditor requires a documented list of users.

1. Execute the SUIM report using the required transaction code.
2. Review the output and confirm that the correct SAP system and client were searched.
3. Look for the Export, Spreadsheet or local-file option in the report toolbar or menu.
4. Select the appropriate spreadsheet format offered by your SAP GUI.
5. Follow the export prompts and save the file in an approved location.
6. Open the exported file and verify that the user IDs and columns are readable.
7. Record the report date, system, client, transaction code and selection criteria.

Export options vary depending on the report layout, SAP release and GUI configuration. If the spreadsheet option is not available, ask your SAP administrator about the supported list-export method.

Security reminder: User access reports contain sensitive company information. Share the exported list only with authorized recipients and follow your organization’s data-retention and access-review procedures.

8. Important Checks Before Confirming That a User Has Access

SUIM is an important authorization analysis tool, but a responsible SAP access review should include additional checks.

Check 1: Confirm the Correct SAP System and Client

A user may have authorization in Development but not in Production. Always confirm the system ID and client before sharing the result.

Check 2: Review User Validity Dates

Check whether the user account is valid on the date of the review. A role or user assignment may have validity restrictions.

Check 3: Check Whether the User Is Locked

A user may have an authorization assignment but may be locked. Therefore, distinguish between an authorization appearing in a report and an account being able to log in and use the system.

Check 4: Investigate All Assigned Roles

Users can receive authorizations from multiple roles. Review all relevant role assignments rather than assuming that one role is responsible for the access.

Check 5: Review Additional Authorization Checks

Some transactions perform further authorization checks after the initial transaction-start check. For example, the system may restrict activities, organizational units, company codes, plants or tables.

Check 6: Confirm the User’s Current Authorization Buffer When Troubleshooting

When investigating a specific user’s actual authorization behavior, transaction SU56 can help display the user’s authorization buffer, subject to the administrator’s permissions. A user’s active buffer and the authorization data assigned in the system should be considered during troubleshooting.

9. Troubleshooting: What If the Expected User Is Not Displayed?

Sometimes the SUIM report may not return the user you expected. Before concluding that the user has no access, investigate the following possibilities.

Possible issue	What to check
Incorrect transaction code	Verify the exact T-Code and check for typing errors.
Wrong SAP client	Execute the report in the client where the user is maintained.
Wrong SAP system	Confirm that you are checking the correct Development, Quality or Production system.
Authorization not assigned	Review the user’s roles and authorization data.
Role validity issue	Check role assignment validity dates and user validity.
Authorization profile issue	Check whether the role’s authorization data has been generated and correctly assigned.
Additional authorization checks	Investigate the transaction’s other authorization objects and field values.

If a user reports an authorization error while executing a transaction, you can also use SU53 immediately after the failed attempt to inspect the most recent authorization failure. For more detailed analysis, an authorized administrator can use STAUTHTRACE to trace authorization checks.

Do not add authorization values or modify roles merely because a user reports an error. First identify the failed check, verify the business requirement and follow the organization’s approval process.

10. Practical Example: Finding All Users with SE16 Access

Let’s summarize the complete procedure using our example.

Step	Action
1	Log in to the required SAP system and client.
2	Execute transaction SUIM.
3	Expand Users.
4	Select Users by Complex Selection Criteria.
5	Choose By Transaction Authorizations.
6	Enter SE16 in the transaction code selection field.
7	Press F8 or click Execute.
8	Review the resulting user list.
9	Validate user status, roles and authorization details as required.
10	Export and document the result if required for an approved review.

Using this procedure, you can search for other transaction codes as well. Simply replace SE16 with the transaction code you need to investigate.

11. Frequently Asked Questions (FAQs)

Q1. How can I find all users who have access to a particular T-Code in SAP?

Execute SUIM and navigate to Users → Users by Complex Selection Criteria → By Transaction Authorizations. Enter the required transaction code and execute the report. Review the matching user list.

Q2. Which SAP transaction is used to find users having access to a T-Code?

Use SUIM, the SAP User Information System. The By Transaction Authorizations selection is used to identify users based on transaction authorization.

Q3. Can I use SUIM to find users who have access to SE16?

Yes. Open SUIM, select By Transaction Authorizations, enter SE16 and execute the report. Then review the matching user IDs and validate their additional authorizations where necessary.

Q4. Which authorization object is generally checked when a user starts an SAP transaction?

The standard transaction-start authorization object is S_TCODE. Its TCD field contains the transaction code. Other authorization checks may also be performed by the transaction or application.

Q5. Does having SE16 authorization mean that a user can display every SAP table?

No. Authorization to start SE16 does not automatically provide unrestricted access to all tables. Additional authorization checks, including table-related restrictions, may apply depending on the system and configuration.

Q6. Can I find the roles that provide a user with a particular T-Code?

Yes. After identifying the user, review the user’s assigned roles and investigate the authorization data of the relevant roles using SUIM and authorized role-administration tools.

Q7. Can I export the list of users from SUIM?

Many SUIM report layouts support spreadsheet or local-file export. The available export options depend on the SAP release, report output and GUI configuration.

Q8. What is the difference between SUIM and SU53?

SUIM is used to report and analyze users, roles and authorizations. SU53 is commonly used to inspect the most recent failed authorization check for a user.

Q9. Can SUIM show whether a user actually executed a transaction?

The By Transaction Authorizations report is an authorization report, not a transaction-usage history report. To investigate actual execution or usage, use the appropriate system logging, workload or audit tools available in your SAP environment.

Q10. Can I use this procedure for other SAP transaction codes?

Yes. You can use the same SUIM procedure for other transaction codes by entering the required T-Code in the selection screen.

12. Conclusion

The SAP User Information System (SUIM) is a useful tool for SAP Basis administrators, Security consultants and auditors who need to investigate user access.

By following the navigation path SUIM → Users → Users by Complex Selection Criteria → By Transaction Authorizations, you can search for users associated with a particular transaction code, such as SE16.

Remember that identifying a transaction authorization is only one part of an access review. Always validate the user’s account status, role assignments, authorization values and any additional application-level checks before confirming that the user can perform a particular business activity.

This procedure can help simplify SAP access investigations, security reviews, audit preparation and day-to-day Basis support activities. SAP SUIM, find users with T-Code access in SAP, SAP users by transaction authorization, SAP SUIM step by step, how to check T-Code authorization in SAP, SAP S_TCODE authorization, SAP SE16 access users, SAP security authorization report, SAP Basis user access check, SAP transaction code user list. SAP SUIM, find users with T-Code access in SAP, SAP users by transaction authorization, SAP SUIM step by step, how to check T-Code authorization in SAP, SAP S_TCODE authorization, SAP SE16 access users, SAP security authorization report, SAP Basis user access check, SAP transaction code user list.

Disclaimer: This article is intended for SAP learning and authorized administration purposes. SAP menu labels, report layouts and authorization behavior may vary by product version and system configuration. Always follow your organization’s security policies and approval procedures before making access changes.