GRC 5.3 | ERM | Synch ERM - Back-End

[Former Member]

Hi Experts,

suppose a role is generated in the back-end over ERM, it hence exists in both.

If changes are made to the authorizations (e.g. deletion of a tcode, changed field value, ...) in the back-end, how can these then be synchronized automatically in ERM?

Is this done by the background job "Trans/Obj/Fld Sync"? Or does this job only synch the back-end with changes in ERM?

Much appreciated!

Kraell

[Former Member · Accepted solution]

Kraell,

It will be better to maintain roles from only one place so if the role is generated by ERM then you should stick with ERM to modify the role. If you still want to use PFCG then there is a way to open PFCG via ERM. Use this option so you can get best of both worlds.

If you already used PFCG to modify a role then only way to sync is to download the role from SAP backend system and upload it into ERM. I hope SAP simplifies this process and makes it just one click sync the way CUP has.

Regards,

Alpesh

[Former Member · Accepted solution]

Thx Alpesh. I indeed think as well that it's better to maintain authorizations in one place. However, a tool is used to maintain them in the back-end going way faster than PFCG or ERM and hence still having added value...

The idea was to create the roles in ERM without maintaining the authorizations, generating it so it would be in the back-end. Then updating the auth in the back-end using the tool and synching the authorizations with ERM using a background job...

But the static bgjobs in ERM only synch the back with changes in ERM and not vice-versa, right?

[Former Member · Accepted solution]

I understand, Kraell.

The background job available in ERM only brings transaction data, org level, activity and field values in ERM from SAP back-end system. It has nothing to do with role synchronization.

The only way to bring roles into ERM would be to download from SAP and upload them into ERM.

Regards,

Alpesh