Skip to Content
Technical Articles
Author's profile photo Netra Thapa

SAP S/4 HANA On-Prem Fiori Business Roles Activation

Starting with SAP S/4HANA 1809 FPS00 and SAP S/4HANA 1709 FPS01, SAP has introduced Rapid Activation methodology for its on-premise deployments. This methodology helps companies cut efforts required to activate business content.  Using this methodology companies can activate business content in much reduced time than before.

In this blog, I am going to cover one primary aspect of this activation process.  I will provide details on Fiori Content activation for Business roles. By activating business roles through this process activates all apps associated to the selected business roles including ICF nodes and ODATA Services.

There are 2 Rapid Activation task lists:

  1. SAP_FIORI_FOUNDATION that provides a list of tasks activating Fiori Foundation
  2. SAP_FIORI_CONTENT_ACTIVATION that provides a list of tasks for activating Fiori Content by selecting business roles.

You need to execute Foundation tasks before running Content activation tasks. Generally activating Foundation tasks will execute basic configuration for Fiori Launchpad, SAP GUI for HTML, activates ICF Node, activates ODATA services required for WebGUI.  Additionally, it generates couple of roles including one composite role for Administrator and one single role for end user.

You can test activated administrator role by creating a test user and assigning Admin composite role (Z_FIORI_FOUNDATION_ADMIN) & end user role Z_UI2_USER_750.  Then, login with test user and launch Fiori UI either via t-code /UI2/FLP or entering url.  You will see admin associated apps displayed as shown below:

After activating SAP Foundation, you are ready to activate Fiori Content.  We use Fiori Content activation task list to activate all applications associated with selected business roles.  For each business role the activation process will perform following tasks:

  • It activates all associated Fiori apps
  • It activates all associated Web Dynpro for ABAP applications
  • Generates profiles for all business roles with default authorizations
  • Optionally, you can also generate a Test user for each business role

As I mentioned above, you can select bunch of business roles to activate or start with one or few. There are three business roles that are required for configuration:  SAP_BR_ADMINISTRATOR (Administrator), SAP_BR_ANALYTICS_SPECIALIST (Analytics Specialist), and SAP_BR_BUSINESS_PROCESS_SPEC (Business process Specialist).   It’s best to start with these 3 roles first. Then, expand to include other roles.

After you have activated content for those 3 business roles, you will work with each workstream functional specialist to collect list of roles to be activated.  Usually, they already have this collected through scope IDs and related test scripts.

Let’s step through Content activation process:

a.  Execute transaction code STC01 and enter Then, click on ‘Generate Task list Run’ from task bar menu.

b.  You will get following screen after you click on Generate Task List Run

List of business roles for which you want to activate apps for are uploaded/listed in parameter field of task ‘Select/Confirm SAP Business Roles for FLP content activation’.   Following screen will appear for roles selection.  First time this screen is empty and therefore you can upload business roles list that you have prepared.

You need to click on parameter for task ‘Select/Confirm SAP Business Roles for FLP Content activation’ and enter list of roles that you would like to activate.  For example:

After you have selected business roles, you click on ‘Start/Resume Task List Run in Dialog’ or ‘Start/Resume Task List Run in Background’. You may receive some errors.  You can re-run these tasks.  With successful completion of these tasks, you will see Z_ version of business roles.

I have included some screenshots below. I have shown an SAP delivered business role and Z version role generated after activation.  As you can see in these screenshots, the menu changes with addition of individual apps.  Also, you can see the role has no authorization before activation and authorization is added after activation. I have also included a screenshot of S_SERVICE auth objects and TADIR services added after activation.

SAP Delivered Role:

Role Menu


After activation Z role:

Role Menu


Please note following:

  • Ensure Process mode is set to’ co-deployed only’
  • business roles that you want to activate content for are listed in second task’s parameter
  • Make sure to read composite note ‘Special Roles’ section of the note lists business roles that require business functions activation before you can use Content activation for those roles.
  • SAP recommends selecting less than 100 business roles at a time.
  • You can provide prefix for business roles in parameter field of task ‘Generate new Business Roles with Prefix’ task. The prefix will replace SAP for SAP_BR* role names. For example, SAP delivered role SAP_BR_AA_ACCOUNTANT will be generated as Z_BR_AA_ACCOUNTANT.



SAP note 2834415

SAP note 2704570

Assigned Tags

      You must be Logged on to comment or reply to a post.
      Author's profile photo Mark Smith
      Mark Smith

      Awesome blog, Netra! Great read!

      Author's profile photo Netra Thapa
      Netra Thapa
      Blog Post Author

      Thanks Mark!

      Author's profile photo Jocelyn Dart
      Jocelyn Dart

      Hi Netra

      Glad to see someone else speaking on this.

      A couple of additional recommendations:

      • With SAP S/4HANA 1909 we also recommend activating role Configuration Expert - Business Process Specialist as a number of configuration apps are assigned to this role
      • With SAP S/4HANA 1909 we include Web Client UIs as standard launchpad content in addition to GUIs and Web Dynpro ABAP

      You might also reference this blog series for the why behind the how... and how to prepare for this step

      All the best


      Author's profile photo Netra Thapa
      Netra Thapa
      Blog Post Author

      Hi Jocelyn,

      I appreciate your comments and will sure to keep those 2 recommendations in mind.




      Author's profile photo LI WEIHAN

      Hi Netra Thapa 

      Greate job.

      I've a simple question, when I execute task list SAP_FIORI_CONTENT_ACTIVATION, the business roles I find out all begin with SAP_BR. But now I'm activating a HCM related business role SAP_HCMFAB_BCR_EMPLOYEE_T which I can't find in the list. How can I activate the apps in this role by this rapid method? Or in another word how to make this business role available in this selection list of SAP_FIORI_CONTENT_ACTIVATION.

      Looking forward your reply. Thanks in advance.




      Author's profile photo Willem Lourens
      Willem Lourens

      I have same issue

      Author's profile photo D. Schenk
      D. Schenk

      Hi Netra Thapa,

      My list of roles is empty. How can I get these 400+ Business Roles?


      Dirk-Jan Schenk


      Author's profile photo Joe Oppenheim
      Joe Oppenheim

      Following as I have the same issue. No roles available for selection


      Author's profile photo D. Schenk
      D. Schenk

      Solved it by installing the latest version of SAP FIORI FOR S/4HANA 2020 Initial Shipment Stack SAP FIORI FRONT-END SERVER 2020 Initial Shipment Stack.

      Never checked this, because it was is fresh installation of SAP S/4 HANA. Perhaps the Fiori version was changed, because we did a brownfield migration. The migration tools for a brownfield migration and the support from SAP are the worst experience I have had with SAP over 25 years.


      (A) Enter tCode SPAM -> button Package Level, tab (1) Installed Product Versions, Check the below Product versions are installed – (2) SAP S/4HANA 2020 Initial Shipment Stack or higher and (3) SAP FIORI FOR S/4HANA 2020 Initial Shipment Stack SAP FIORI FRONT-END SERVER 2020 Initial Shipment Stack.

      Author's profile photo plaban sahoo
      plaban sahoo

      Thank you Netra for the blogpost. Few remarks about the blogpost are below. Requesting your suggestion on the same.

      What if we do not want the Z roles(i.e custom roles naming convention is diff. ). So, these are u to be removed ? Before removal is it mandatory to create the necessary custom role. I do not think so, because once FIORI apps are activated, they can be added directly from Menu tab in any other role.

      Is there no other means to activate FIORI apps. I mean, it is the responsibility of FIORI consultants. Isn't it. And prior to these 2 activations, how were FIORI apps activated. Can the old steps not applicable in S/4 HANA anymore

      Do, FIORI front-end roles( separate external system) need not be activated as similar to back-end roles



      Author's profile photo Michael Healy
      Michael Healy


      Activating the fiori services wouldn’t be the responsibility of the functional person (not sure what you mean by fiori consultant), in past projects the basis teams did this with the help of the security team. My comment below I think answers your question but I’m not fully sure on what it is you’re asking.

      One really shouldn’t be activating services that are not going to be used in production, the only services that should be activated are the ones that are going to be used in the custom roles. Your security consultants should be leading the process, they will make sure that only the services that have been placed in the custom PFCG roles are activateD ie: Take SICF for example, you wouldn’t activate every service there in production, you’d only activate the ones you’d need, same approach for the OData services here. 

      Author's profile photo Michael Healy
      Michael Healy

      Question, my assumption is this is only relevant for the discovery phase or the lower environments like DEV and TEST? As the standard SAP_BR roles would Not be provisioned in your production system, an easy and secure approach I have used in the past would be to download the z custom roles that will be provisioned to your users from the AGR table, put them into an excel sheet and ask your basis teams to activate only those services that are needed in STC01.