SAP Business One SoD Analysis: Groups & Superusers

MTC Skopos analyzes segregation of duties in SAP Business One from its authorization model: the general authorization tree, authorization groups, report, query and add-on permissions, and the superuser flag. It extracts five tables through the DI API, on SQL Server or HANA, and runs the analysis on your own machine. Built by SAP authorization specialists, it covers Business One subsidiaries in the same tool as ECC and S/4HANA, at a flat €5,736/year base license with no per-company fee.

	MTC Skopos for SAP Business One
Access model analyzed	General authorizations (Full, Read-Only), authorization groups with validity, report, query and add-on authorizations, superusers
Databases	SAP HANA, Microsoft SQL Server 2016, 2017, 2019, 2022
Extraction	DI API from inside MTC Skopos, or an MTC PowerShell script
Tables read	OUSR, OUGR, USR7, USR3, UGR1 (listed columns only, never passwords)
Traceability	Each finding names the authorization group or the user's own setting behind it
Mixed landscapes	Analyzed next to ECC, S/4HANA, S/4HANA Public Cloud, Business Central and other systems
Deployment	Desktop application, analysis runs locally, no data sent to MTC
Price	€5,736/year base license, unlimited company databases and users

Why does SAP Business One need its own SoD approach?

Because it shares the SAP name, not the SAP ERP authorization model. There is no PFCG, no transaction code, no authorization object. Business One gives each user a tree of permissions, each set to Full, Read-Only or No Authorization, and lets administrators define authorization groups whose settings add to the user's own. Reports, queries and add-ons carry their own permissions. And any user flagged as superuser can do everything.

That last point is the most common Business One finding. Small finance teams grow, a superuser flag granted for a go-live stays for years, and nobody can say who can both create a vendor and pay it. An on-premise SAP ruleset will not fire against this model, so a Business One analysis needs a ruleset written against Business One permissions.

How does MTC Skopos analyze a Business One company?

Connect through the DI API. In MTC Skopos, add a SAP Business One data source with the server, the SLD server and the company database, and test the connection. The extraction reads five tables and writes them to a folder you control. Teams that prefer not to connect can run the MTC PowerShell script and supply the files.
Load the ruleset. The Excel ruleset format is the same as for SAP ERP. A function names the Business One permission and the level that performs it, for example Full authorization on business partner master data for vendor maintenance.
Run a users or authorization groups analysis. Each authorization group appears as a role, each user's own settings as a personal role, and superusers as a dedicated role, so the report shows exactly where a conflicting permission comes from.

Table	What it provides
OUSR	Users, lock status, superuser flag and the user's own general authorizations
OUGR	Authorization groups and their general authorizations
USR7	Which user belongs to which group, with start and due dates
USR3	The user's own report, query and add-on authorizations
UGR1	The group's report, query and add-on authorizations

The connection fields and file format are described in the Business One import guide.

What does the analysis find in Business One?

The same categories as on SAP ERP, adapted to the model: segregation of duties conflicts between two permissions (vendor maintenance against outgoing payments, item master against inventory postings), and critical access on its own (superuser, authorization administration, period-end settings). Group validity dates are read, so an expired membership does not count as access. The access risk analysis page describes the full detection scope.

As with every system, the ruleset must reflect how your organization works. Treat any starting point as a template to review and tune, then own it; the ruleset page explains how.

Can Business One subsidiaries be analyzed with the SAP core?

Yes. Two-tier landscapes, S/4HANA or ECC at headquarters and Business One in subsidiaries, are where Business One SoD usually gets audited, because the group auditor asks for the same evidence everywhere. MTC Skopos loads both as data sources in one application. With the Cross-System add-on, a rule can pair a function in Business One with a function in the core, for the shared service user who holds accounts in both. Microsoft Dynamics 365 Business Central and S/4HANA Public Cloud subsidiaries are covered the same way.

What does it cost?

The base license is €5,736/year and covers unlimited company databases and users. Simulation (€1,199/year), remediation recommendations (€2,398/year) and cross-system rules (€1,199/year) are optional add-ons, listed on the pricing page. MTC Skopos analyzes and recommends; it never writes changes back to Business One.

Frequently asked questions

How do you check segregation of duties in SAP Business One?

SAP Business One has no roles in the SAP ERP sense. Access comes from the general authorization tree, set per user and per authorization group to Full, Read-Only or No Authorization, plus report, query and add-on authorizations and the superuser flag. An SoD check has to combine a user's own settings with every group they belong to, then test the result against a ruleset. MTC Skopos reads these tables through the DI API and reports each conflict with the group or user setting that grants it.

Which data does MTC Skopos extract from SAP Business One?

Five tables: OUSR (users, superuser flag and their own authorizations), OUGR (authorization groups), USR7 (group membership with validity dates), USR3 and UGR1 (report, query and add-on authorizations of users and groups). Only the columns the analysis needs are read; password columns are never extracted.

Does MTC Skopos support SAP Business One on HANA?

Yes. The DI API extraction supports SAP Business One on SAP HANA and on Microsoft SQL Server 2016, 2017, 2019 and 2022. A PowerShell script provided by MTC produces the same files for teams that prefer to run the extraction themselves.

Can SAP Business One and S/4HANA be analyzed together?

Yes. Groups often run S/4HANA or ECC at headquarters and SAP Business One in subsidiaries. Both load as data sources in the same MTC Skopos application, and with the Cross-System add-on (€1,199/year) a rule can pair a function in Business One with a conflicting function in S/4HANA for the same person.

How much does SAP Business One SoD analysis cost with MTC Skopos?

The base license is €5,736/year and covers unlimited company databases and users analyzed. Simulation, remediation recommendations and cross-system rules are optional add-ons. There is no per-company or per-user fee.