SAP_NEW vs. SAP_ALL
What is SAP_NEW?
SAP_NEW is an SAP standard Profile that is usually assigned to system users temporarily during an upgrade to ensure that the activities and operations of SAP users are not hindered, during the Upgrade. It contains all the necessary objects and transactions for the users to continue their work during the upgrade. It should be withdrawn once all upgrade activities are completed and replaced with the now modified Roles as it has more extensive authorizations than required.
What is SAP_ALL?
SAP_ALL is an SAP standard profile, that is used on a need basis, to resolve particular issues that may arise during SAP usage. It is used by Administrators and Developers only and is applied temporarily when needed. It contains all SAP system objects and transactions. SAP_ALL is very critical and only user IDs starting with SAP* contain SAP_ALL attached to it in the production system. No other regular user accounts have SAP_ALL attached to them.
Key differences between SAP_ALL and SAP_NEW
- SAP_NEW is used in the Production environment during a version upgrade whereas SAP_ALL shouldn't be or not be allowed to be used in Production (for audit purposes obviously), except where necessary, in a controlled manner with all proper approvals from the customer.
- SAP_ALL grants access to everything whereas SAP_NEW provides access to new functionalities introduced in an upgrade.
- Assigning SAP_ALL bypasses specific role-based permissions, whereas SAP_NEW complements existing roles with new authorizations.
- SAP_NEW contains all the necessary objects and transactions for the users to continue their work during the upgrade whereas SAP_ALL contains all SAP system objects and transactions
- SAP_ALL has a very high security risk as it grants excessive permission that can lead to data compromise whereas SAP_NEW has a moderate risk.