Help Center / Getting Started / Your First Analysis

Your First Analysis

This walkthrough takes you from an empty application to a risk result you have read and understood. It is deliberately narrow: one system, a small population, one pass. The aim is to reach a correct result you trust, not a complete picture of your landscape.

Allow about thirty minutes, most of which is exporting data from SAP. You need a ruleset file and either an SAP extract or the ability to make one.

1. Prepare a small extract

Export these four tables from your SAP system as CSV or TSV, into one folder:

AGR_1251, AGR_1252, AGR_AGRS, AGR_DEFINE

Add AGR_USERS and USR02, because you are going to analyze users rather than roles.

If your system is large, restrict the export to one role prefix or one user group. A small extract loads in seconds and gives you a result you can check by hand, which is exactly what you want the first time. Analyzing everything comes later.

You now have six files in a folder. For what the other tables add, see SAP File Import.

2. Load it as a data source

  1. Open MTC Skopos and go to Data Sources
  2. Click Add → SAP Files
  3. Select your folder
  4. Give the data source a name you will recognize, then Save
  5. Load it

Check before continuing. Open the Info tab for the data source and look at the row counts. Every table should show an effective count in the region you expect, and the unparsable count should be zero. A non-zero unparsable count means rows were silently dropped, and any result built on them is incomplete. If you see one, the cause is almost always encoding or a delimiter that split a description containing a separator. See Troubleshooting.

3. Load a ruleset

  1. Click Load Ruleset
  2. Give the ruleset a name. It has to be unique
  3. Choose the Format, either CSV or XLSX. For XLSX, also type the Worksheet name holding the rules, exactly as the sheet is named in Excel
  4. Pick the file, then click Import ruleset

If your risk library lives in Excel, load the workbook directly with the XLSX option rather than exporting a CSV first. See Loading a Ruleset.

Check before continuing. The single most common reason a first analysis returns nothing is a ruleset whose System column does not match the data source name you chose in step 2. Open the ruleset file, look at the System values, and make sure at least some of them match your data source name exactly, including case.

If they do not match, either rename the data source or edit the ruleset. See Creating Custom Rulesets.

4. Browse the data first

Go to the users browser and look at what you loaded. Spend two minutes here.

Pick one user and open their detail view. You will see their composite roles, the single roles inside each, and the actions those roles grant. This is the raw material the analysis works on, and seeing it once makes the results far easier to interpret afterwards.

Note roughly how many users you have. It tells you what result size to expect.

5. Run the analysis

  1. Go to Analysis
  2. Set mode to users analysis
  3. Select your system
  4. Select your ruleset
  5. Set the mandatory criteria. Fields marked with a red asterisk must be filled, and there is no "leave it empty for everything" behaviour, which is deliberate: an empty filter would silently mean an unbounded run
    • User types: Dialog, so technical accounts do not dominate the findings
    • Risk types and Risk levels: select all of them for this first pass
    • Business processes: select all
  6. Set a Save directory you can find again
  7. Click Run analysis

6. Read the result

Start with the Info tab and read back the criteria the analysis actually used. Doing this now builds the habit: a result is only meaningful alongside the scope that produced it.

Then the Summary report, one row per user and risk. Sort by risk level and look at the top of the list.

Then pick one finding and open the Detailed report, filtered to that user and risk. You will see several rows for one finding, because there is one row per authorization that contributes to it. Read across: the Function columns show the two conflicting capabilities, Action shows what grants each, and Role/Profile shows which role delivered it.

That last column is the answer to "so what do we do about it", because it names the object you would change.

If you got no results

Work through these in order:

  1. Does the ruleset System value match your data source name exactly? This is the usual cause
  2. Did you select risk types, risk levels, and business processes? An unselected filter excludes everything
  3. Does the ruleset reference transactions your system actually uses? A ruleset written for S/4HANA finds little in an ECC system
  4. Did every table load with a non-zero effective count?

If you got tens of thousands of results

That is normal and expected on an unscoped first pass. It is also the reason scoping exists. See Scoping Your Analysis.

7. Keep the evidence

The save directory now holds the summary report, the detailed report, and a signed .log execution log. The log records the criteria, the ruleset checksum, and a checksum and row count for every table. Keep all three together: the reports on their own are a spreadsheet, and with the log they are audit evidence. See How Log Signing Works.

What to do next

You have a result, and you know what produced it. The three directions from here:

  • Make it actionable. Scope to one department or one risk owner so the output belongs to somebody who can act on it: Scoping Your Analysis
  • Fix something. Generate recommendations, then simulate them before applying: Generating Recommendations and User Simulation
  • Sharpen the evidence. Add usage data and change documents so results separate access that was used from access merely held: Did-Do Analysis

Updated on: 2026-08-02

« Back to Getting Started