Explain SAP Fiori Launchpad & Role-Based Access in SAP

38 / 65

S/4HANAbeginner

SAP Fiori Launchpad & Role-Based Access

How the Fiori Launchpad aggregates apps into catalogs and groups, and how PFCG roles control which tiles a user sees.

Fiori Launchpad configuration is a practical, hands-on topic interviewers ask both technical consultants and Basis-adjacent security folks about, since getting it wrong is one of the most common go-live day issues - users logging in and either seeing nothing or seeing far more than their role should allow.

A catalog is like a restaurant's full kitchen menu of everything the chefs can prepare (what's technically available and authorized); a group is the specific printed menu handed to one type of customer (the actual tiles a user sees), and both the kitchen's willingness to cook a dish and the printed menu listing it have to align before a customer can actually order it.

Key Concepts

The launchpad organizes apps hierarchically: an app (a Fiori tile) is assigned to a catalog (a technical grouping of apps, generally maintained by IT/development, often one catalog per business area or app package), and catalogs are assigned to PFCG roles, exactly the same authorization role concept used everywhere else in SAP. A separate concept, the group (a business-user-facing, often personalizable collection of tiles arranged for a specific persona's daily workflow, distinct from the technical catalog grouping), determines the actual visual layout of tiles the end user sees on their home page, and groups are also assigned to roles, meaning a single PFCG role assignment determines both which apps a user can technically access (via catalogs, tied to underlying authorization objects) and which tiles visually appear on their launchpad home page (via groups).

Under the hood, each tile references a target mapping - the actual technical navigation target (an OData service and Fiori app, a WebGUI transaction wrapped for Fiori, or a native UI5 app) resolved via a semantic object and action (e.g., semantic object "SalesOrder", action "manage"), which is what allows the same semantic intent to be satisfied by different concrete apps depending on context (intent-based navigation) - a subtlety worth explaining since it's one of Fiori's more architecturally elegant but initially confusing aspects for people used to SAP GUI's direct transaction-code navigation.

A senior-level answer covers the difference between the older Fiori Launchpad on NetWeaver Gateway / classic on-premise front-end server versus the newer SAP Business Technology Platform-hosted Launchpad service used in S/4HANA Cloud and multi-system scenarios, and the practical troubleshooting flow when a user reports a missing tile: check PFCG role assignment first, then catalog/group assignment within that role, then the underlying OData service authorization, since a missing tile can originate at any of these layers independently.