CUP -> Users, compatible & incompatible roles

[Former Member]

Hello,

In the knowledge that approval flows can be established for the addition of new users, we are currently concerned about the modification of employeeu2019s functions.

If the assignment of new roles to a user provokes incompatibilities, this will be detected and notified by the tool when modifying the assignment.

But if these roles happen to be compatible, we would like to know if there is a means of automatically removing the previously assigned roles, or at least establishing an approval flow, because these roles, even if not incompatible, may correspond to different functions or departments and should be segregated.

Best Regards.

Pablo Mortera.

[Former Member]

Pablo,

Are you talking about cross functional risk analysis, eg. HR adding a role and Finance adding a role both independantly but then finding out that the two roles should not be assigned together?

In the first instance, I would make sure that your CC ruleset is adequately updated with actions that you wish to be segregated.

If the roles can happily co-exist, then the problem is solved.

If not, then consider the approval mechanisms defined. If you need additional levels of approval, then make sure that you have them assigned correctly into the workflow path.

If that still doesn't stop it, then you can create a new request to remove the access and get that approved as a separate action.

You will then just have to configure and define the process for removing access in the same way that you have for provisioning access.

Simon