As the message is self explanatory, that no changes for user SAP* allowed, so please create a new user and then perform the activity, if it's a test system then you can make copy of SAP* user. Moreover, it is not advised to use SAP* for day to day operations.
Yes you can create a role like this: Create a new role & assign PFCG to that role. Go to Object: S_USER_AGR and edit the field name: ACT_GROUP and add Z* there, similarly go to object: S_USER_SAS and edit the field: ACT_GROUP and add Z* Let us know if still any issue.
Go to transaction SUIM and expand the node 'USER' and then expand 'USERS BY COMPLEX SELECTION CRITERIA' and then execute 'BY AUTHORIZATION' button and in the 'Authorization object' field enter the object and click on execute, you'll get the desired results.
