SAP Data Archiving & ILM Roles Overview

In the world of SAP, data archiving and Information Lifecycle Management (ILM) are essential for managing data growth, ensuring compliance, and optimizing system performance. But just as important as the tools themselves are the roles and authorizations that govern who can do what.

This guide walks you through the key roles, transaction codes, and best practices for SAP data archiving and ILM.

---

🔐 Key Authorization Objects

To manage access, SAP uses authorization objects assigned via transaction PFCG. Here are the most relevant ones:

• S_ARCHIVE – Controls access to archive functions (write, delete, read).
• S_DATASET – Governs access to logical file paths and file operations.
• SBTCHJOB / SBTCHNAM – For scheduling and managing background jobs.
• SADMIFCD – Administrative functions for archiving.
• S_TCODE – Required for executing archiving transactions.
• S_PROGRAM – Allows execution of archiving reports.
• SILMOBJ / SILMSTOR / SILMLKPR – ILM-specific objects for managing policies, storage, and legal holds.

---

👥 Common Archiving Roles

SAP may not always provide pre-built roles, but here are some commonly used or custom-defined ones:

Role Name	Description
ZARCHIVEADMIN	Full access to all archiving and ILM functions
ZARCHIVEDISPLAY	Read-only access to archive logs and files
ZILMADMIN	Full ILM object and policy management
ZILMUSER	Executes ILM-based archiving activities
SAPBCSRVARCADMIN	SAP NetWeaver role for basic archiving services
SAPILMADMIN	Template for ILM administration (customizable)

---

🔁 Transaction Codes (T-Codes)

Ensure users have access to these T-codes via S_TCODE:

Transaction	Purpose
SARA	Central archive administration
ILMSTOREADM	ILM store and storage system management
ILMWORKCENTER	ILM Work Center (Web UI)
AOBJ	Archive object definition
SARI	Archive Information System
FILE	Logical file path configuration
WE20	Partner profile (for ALE scenarios)

---

🛠️ Role Design Best Practices

• Least Privilege: Only assign what’s necessary.
• Split Duties: Separate write and delete permissions.
• Enable Logging: For sensitive archiving actions.
• Audit Compliance: Especially important with ILM.

---

🧩 ILM-Specific Enhancements

When using ILM, you’ll work with:

• Retention & Destruction Policies
• Legal Holds
• ILM Store Integration
• Audit-Proof Archiving

These require fine-grained authorizations like:

• S_ILM_STOR – Storage operations
• S_ILM_LKPR – Legal case handling

---

🧪 Sample Role Templates

Here are three hybrid role templates combining SARA and ILM access:

Role	Purpose
ZARCHIVEADMIN	Full admin access to SARA and ILM
ZARCHIVEUSER	Can schedule/view jobs, but not delete archives
ZARCHIVEDISPLAY	Read-only access to logs and archived data

---

📌 Final Tips

• Use SU24 to check default authorizations.
• Always test in QA before going live.
• Restrict access to SDATASET and SARCHIVE by object or file path.