SAP Security & GRC Podcast - Technical Series (E07): Using LSMW in SAP Authorisation Management

In this session, Ross Robertson and Wehmeyer Ferreira explore the practical use of the Legacy System Migration Workbench (LSMW) for mass maintenance of data subjects in SAP. With a specific focus on bulk role deletion, this episode demonstrates how SAP authorisations professionals can automate repetitive tasks that would otherwise require manual intervention in PFCG for every single role.

LSMW allows administrators to perform structured, repeatable batch processing by recording a transaction once and replaying it across large datasets – in this case, nearly 500 roles. Wehmeyer walks through the full setup process step by step, including how to structure the input file, configure the LSMW recording, run the batch input session, and review the results once execution is complete. 

In this episode, we explore:

• LSMW (Legacy System Migration Workbench) enables mass processing of SAP data objects, including roles, users, and other authorisation-related records. 
• Setting up an LSMW recording requires defining the project, sub-project, and object, before recording the target transaction (in this case, PFCG). 
• A structured input file (containing the list of roles to be processed) is mapped to the recording to drive the batch execution. 
• During batch input execution, it is recommended to keep batch input running continuously to avoid having to manually locate where processing stopped. 
• After execution, a session overview provides visibility into successful transactions and any errors, allowing administrators to investigate exceptions. 
• LSMW is a powerful alternative to manual PFCG processing – in this example, 496 out of 498 roles were successfully deleted with just two errors flagged for review. 
• A final spot-check using the roles table is recommended to confirm all expected deletions have been applied. 

Through this walkthrough, viewers gain a practical understanding of how to configure and execute LSMW recordings to handle mass maintenance scenarios, saving significant time during SAP authorisations administration and reducing the risk of manual error.