How to Set up and Analyse STUSOBTRACE

Listen to the SAP Security & GRC podcast – helping you on your journey to effective access risk management in SAP.

In this episode, Ross Robertson covers the SAP Authorisation Trace at the application level – STUSOBTRACE – which reveals exactly what authority checks a given SAP application (a transaction, Fiori OData service, RFC function module, or background job) performs at runtime. It’s the final piece in our authorisation tracing mini-series, following STAUTHTRACE (E09) and STUSERTRACE (E10).

🔑 Key Takeaways:

What STUSOBTRACE is and how the application-level view differs from STAUTHTRACE and STUSERTRACE

How to activate it via the auth/authorization_trace parameter in both the dynamic (RZ11) and static (RZ10) profiles

Parameter values N / Y / F – and why Y usually works at the application level while the per-user trace leans on F

How unique-once recording keeps it viable as a long-term trace

Why the “changed by” user is only the first to trigger a check – and the analysis trap to avoid

Analysing by application or by authorisation object (e.g. every transaction that calls an object for Activity 01)

Real use cases: building SU24 authorisation defaults or identifying S/4HANA high-tier license usage.

👥 Featuring:

Ross Robertson – Senior SAP Authorisations Consultant, Soterion

🎧 Take me to the Podcast: 

https://soterion.com/podcast/