## 13.13.5.2.1  Authorizations
The SAP ECC Industry Extension Higher Education &amp; Research component uses the authorization concept provided by SAP NetWeaver. Therefore, the recommendations and guidelines for authorizations as described in the ABAP Platform Security Guides also apply to the SAP ECC Industry Extension Higher Education &amp; Research component. The ABAP Platform authorization concept is based on assigning authorizations to users based on roles. For role maintenance, use the profile generator (transaction PFCG) when using ABAP technology and the User Management Engine's user administration console when using Java.
##  Note
For more information about how to create roles, see the ABAP Platform Security Guide under User Administration and Authentication.
## Standard Roles
The table below shows the standard roles that are used by SAP Student Lifecycle Management (SLCM).
| Role                       | Description                                                                                                       |
|----------------------------|-------------------------------------------------------------------------------------------------------------------|
| Composite Roles            |                                                                                                                   |
| SAP_CM_ADM_COORDINATOR     | Admission coordinator                                                                                             |
| SAP_CM_ADM_OFFICER         | Admission officer                                                                                                 |
| SAP_CM_ASM_COORDINATOR     | Assessment coordinator                                                                                            |
| SAP_CM_ASM_OFFICER         | Assessment officer                                                                                                |
| SAP_CM_STREC_COORDINATOR   | Student records coordinator                                                                                       |
| SAP_CM_STREC_OFFICER       | Student records officer                                                                                           |
| Single Roles               |                                                                                                                   |
| SAP_CM_ACCOUNT_DATA_UPDATE | Technical user for automatic update of student account data after changes to account-relevant student master data |
| Role                        | Description                                                     |
|-----------------------------|-----------------------------------------------------------------|
| SAP_CM_ADMIN_ACAD_STRUCTURE | Administrator for the academic structure (internal single role) |
| SAP_CM_ADMOFF_STUDYDATA     | Activities for the admission coordinator                        |
| SAP_CM_ADMREGDATA_DISP      | Display study data                                              |
| SAP_CM_ALL                  |                                                                 |
| SAP_CM_ASMCO_ADDACT         | Additional activities for the assessment coordinator            |
| SAP_CM_ASMDATA_DISP         | Display progression and grades                                  |
| SAP_CM_ASMOFF_ACT           | Activities for the assessment officer                           |
| SAP_CM_STMASTERDATA_DISP    | Display student master data                                     |
| SAP_CM_STMASTERDATA_MAINT   | Edit student master data                                        |
| SAP_CM_STRCO_ADDACT         | Additional activities for the student records coordinator       |
| SAP_CM_ASMDATA_DISP         | Display progression and grades                                  |
| SAP_CM_ASMOFF_ACT           | Activities for the assessment officer                           |
| SAP_CM_STMASTERDATA_DISP    | Display student master data                                     |
| SAP_CM_STMASTERDATA_MAINT   | Edit student master data                                        |
| SAP_CM_STRCO_ADDACT         | Additional activities for the student records coordinator       |
| SAP_CM_STROFF_ACT           | Activities for the student records coordinator                  |
| SAP_CM_MODULEBOOK           | Module booking (only up to release CM4.72)                      |
| SAP_CM_REGIST               | Activities for registration (only up to release CM4.72)         |
| SAP_CM_STUDENTMASTER        | Student master data processing (only up to release CM4.72)      |
All of the above roles are automatically generated by the system.
##  Note
SAP\_IQ\_CAMPUS and SAP\_CM\_ALL are critical roles because they contain a comprehensive authorization for all Student Lifecycle Management functions. The following roles are obsolete as of the SAP ECC Industry Extension Higher Education &amp; Research 6.0 release:
- SAP\_IQ\_CAMPUS
- SAP\_CM\_MODULEBOOK
- SAP\_CM\_REGIST
- SAP\_CM\_STUDENTMASTER
## Standard PFCG Roles in SAP Student Lifecycle Management
If a user does not want to use the portal role, you can choose the PFCG role option. The SLCM application provides the following PFCG roles:
| Nameof PFCG Role               | RelevancetoNWBC                    | Relevance to Portal Role                       |
|--------------------------------|------------------------------------|------------------------------------------------|
| SAP_SR_ACADEMIC_ADVISOR_5      | NWBCrole for advisor               | Equivalent to the portal role Academic Advisor |
| SAP_SR_UNIVERSITY_INSTRUCTOR_5 | NWBCrole for university instructor | No equivalent portal role available            |
| SAP_SR_STUDENT_5               | NWBCrole for student               | Equivalent portal role Student                 |
Once you configured these roles you can access the applications attached to the role using SAP NetWeaver Business Client. You can use these as entry points to the different applications that can be accessed by the academic advisor, the instructor or the student.
## Standard Authorization Objects
If a user does not want to use the portal role, you can choose the PFCG role option. The SLCM application provides the following PFCG roles:
| Authorization Object   | Description                                                                                 |
|------------------------|---------------------------------------------------------------------------------------------|
| P_CM_AUDCT             | Student Lifecycle Management: requirement catalogs                                          |
| P_CM_AUDIT             | Audits                                                                                      |
| P_CM_AUDPR             | Requirement profile                                                                         |
| P_CM_CORR              | Correspondence                                                                              |
| P_CM_FCDOC             | Student accounting document                                                                 |
| P_CM_PROC              | Activity                                                                                    |
| P_CM_UCAS              | Authorization Object Student Lifecycle Management UCAS (only for Great Britain)             |
| P_CM_UCASR             | Authorization Object Student Lifecycle Management UCAS for Reports (only for Great Britain) |
| Authorization Object   | Description                             |
|------------------------|-----------------------------------------|
| P_CM_NLPAY             | NL Payment Details Authorization Object |
| P_CM_NLVER             | NL Verification Authorization Object    |
## Basic Authorizations in SAP Student Lifecycle Management
There are three important authorization objects within SLCM to simplify authorization assignment: :
- S\_TCODE S\_TCODE checks whether a user is allowed to start a given transaction. Every time the user starts a menu command or a transaction code using the command line, the roles assigned to the user are checked to see whether the user has the authority to execute this transaction.
- PLOG
PLOG checks whether a user is allowed to read, write or insert specific HR Infotypes.
- P\_CM\_PROC
P\_CM\_PROC checks whether a user has the authority for a specific Student Lifecycle Management process.
## Structural Authorizations in SAP Student Lifecycle Management
Structural authorizations enable you to define the set of objects the user is authorized to process. You determine these objects using evaluation paths. For example, you can define whether the user receives a display authorization or a maintenance authorization for these objects.
- Evaluation Paths
An evaluation path is an instruction for the system that determines which object types and relationships are to be included in an evaluation of the organizational plan. It describes the chain of relationships that exist between objects in a hierarchical structure. The report takes into account only the objects that lie along the specified evaluation path.
- Organizational Structure
One or more relationships are then used as paths to evaluate structural information in your organizational plan (relating to the organizational or reporting structures) or matrix organization. The sequence of the relationships included in the evaluation path is decisive in how the results of the evaluation are displayed.
##  Note
As functions of other applications areas, for example, Training and Event Management, Notification Processing or Student Accounting are integrated into SLCM, users also need authorizations for these areas.
##  Note
SLCM contains a number of single roles, which you can combine with the roles of other application areas to create composite roles. You can either assign a composite role or individual roles to users.
## Authorizations in Business Rule Framework plus (BRFplus)
To handle the BRFplus security, the standard authorizations are available in the BRFplus framework.
For information about the authorization concept of BRFplus, go to https:/ /help.sap.com/s4hana\_op\_2021, enter Services for Application Developers into the search bar, press Enter , open the search result with that title, and navigate to Business Rule Framework plus (BRFplus) Concepts Authorizations