<p>Continuing with SAP alphabet. Hope we both understand that there are template roles and functional and they differ.<br />
First ones are never assigned to end users and in fact are templates for functional roles. We use them to quickly edit function in one place and derive changes to functional. Functional roles are already typed with exact permissions for personnel areas, employee groups and subgroups, business units and other objects.</p>
<p>If you don&#8217;t want to die creating all combinatoric variety of functional roles per each personnel area and employee group, you can use derivation tool. When deriving we define master role (template) with a nice user menu, setup authorization objects with organizational levels. Then with easy we create derived role which references to master role. Derived role inherits menu and all authorization objects from the master role. When we do any change in master role it reflects in slave roles. Also we can do any changes in slave roles without any effect to master. You only can&#8217;t change user menu in slave role.</p>
<p>In pictures it looks like this.</p>
<h3>Create master role<br />
<a href="http://saphr.ru/wp-content/uploads/pfcg_derived_1.png"><img class="alignnone size-full wp-image-2127" src="http://saphr.ru/wp-content/uploads/pfcg_derived_1.png" alt="" width="689" height="360" /></a><br />
<!--more--></h3>
<p>with one PA30 transaction and default authorizations.<br />
<a href="http://saphr.ru/wp-content/uploads/pfcg_derived_2.png"><img class="alignnone size-full wp-image-2128" src="http://saphr.ru/wp-content/uploads/pfcg_derived_2.png" alt="" width="768" height="279" /></a></p>
<h3>Create slave (derived) role</h3>
<p>Pay attention to the name of m the ster role.<br />
<a href="http://saphr.ru/wp-content/uploads/pfcg_derived_3.png"><img class="alignnone size-full wp-image-2129" src="http://saphr.ru/wp-content/uploads/pfcg_derived_3.png" alt="" width="709" height="361" /></a></p>
<p>We see menu editing is disabled in the slave role.<br />
<a href="http://saphr.ru/wp-content/uploads/pfcg_derived_4.png"><img class="alignnone size-full wp-image-2130" src="http://saphr.ru/wp-content/uploads/pfcg_derived_4.png" alt="" width="587" height="368" /></a></p>
<p>While authorizations are inherited from the master role.<br />
<a href="http://saphr.ru/wp-content/uploads/pfcg_derived_5.png"><img class="alignnone size-full wp-image-2131" src="http://saphr.ru/wp-content/uploads/pfcg_derived_5.png" alt="" width="738" height="264" /></a></p>
<h3>Test roles derivation</h3>
<p>Let&#8217;s add P_TCODE in master role and click derivation button.<br />
<a href="http://saphr.ru/wp-content/uploads/pfcg_derived_6.png"><img class="alignnone size-full wp-image-2132" src="http://saphr.ru/wp-content/uploads/pfcg_derived_6.png" alt="" width="754" height="352" /></a></p>
<p>System automatically adds the same object in the slave role.<br />
<a href="http://saphr.ru/wp-content/uploads/pfcg_derived_7.png"><img class="alignnone size-full wp-image-2133" src="http://saphr.ru/wp-content/uploads/pfcg_derived_7.png" alt="" width="800" height="343" /></a></p>
<p>Take into consideration there could be more than 1 slave (derived) role for 1 master.</p>