CUP: Differences between User Access Review and Role Reaffirm?

[Former Member]

Hi All,

Iu2019m a little confused with the differences between u201CRole Reaffirmu201D and the u201CUser Access Reviewu201D (UAR). Possibly you gurus can help clarify my thoughts on thisu2026

1. The UAR appearance is very nice and the workflow works well. I particularly like the Admin review screen to validate the requests before sending out the workflows.

2. The Role Reaffirm process has no workflow BUT the nice thing about it is that it updates the Reaffirm dates so the owner is not re-notified until the next review date.

My main question is: Can the UAR update the Role Reaffirm dates once completed?

Otherwise, it seems to me that the UAR serves little purpose other than the workflow since it appears that once the UAR is completed, someone could send out a new UAR for the exact same roles the very next day. Whereas, once the role reaffirm is complete, the roles correctly fall off the u201Cqueueu201D until the next reaffirm period (e.g. 1, 2, 3 months). It seems to me that with the UAR, weu2019d have to be very careful to send out the notifications making sure that our UAR jobs do not accidentally run twice or overlap data.

Any suggestions on how to best use the UAR but with the Reaffirm benefits?

[Former Member · Accepted solution]

Dylan,

Current Version v5.3 SP11.1

According to my discussion with SAP Support on this matter recently, AE UARs are the new direction of Role Reaffirm. Role Reaffirm and UAR implementation do not affect eachother, with regards to the role reaffirm setting. Role Reaffirm will not be improved and will eventually be removed from AE, but they would not specify when. I agree with the other posts that Role Reaffirm has more cons than pros. I have implemented UARs twice now and they are much easier to use and report on then Role ReAffirm. With regards to the not updating the role reaffirm setting and the possibility of a new UAR going out: (1) you can remove that AE Role Reaffirm config; (2) A new UAR would not go out until the AE UAR Admin ran the onetime UAR load process again.

-john

[Former Member · Accepted solution]

John / Alpesh, thanks for your answers, very helpful !

-Dylan

[Former Member]

Dylan,

I agree with you that UAR should contain benefits of Role Reaffirm but it does not. We started using Role Reaffirm but after researching UAR, we will change our process to start using UAR instead of Role Reaffirm. Role Reaffirm process has more cons than pros. I would say UAR is the lates implementation of role reaffirm and I will warn you to not to look at role reaffirm. In fact, I think that the role reaffirm feature should be removed from CUP as it does not do much. Here are the cons of role reaffirm process and I do have messages open for all of these issues:

1) Does not have any report which shows if the roles are finished or not

2) You have to reaffirm the role which are assigned to expired users. This is totally weird.

3) Shows the role in reaffirm screen even though they are not assigned to any users. How funny is that?

4) You can not put comments of more than 10 cahracters as it does not display comments which has more than 10 characters.

5) Once you select some users as approved and some users as removed, the users still show up in the list till the role is fully reaffirmed so there is alwayu chace of user error. We have seen our reviewers removing roles from some valid users, by mistake.

Regards,

Alpesh

[Former Member]

Hello Alpesh,

Thanks for the synopsis, very helpful ! How do you track with the UAR which roles are outstanding and which are not?

[Former Member]

Dylan,

Did you work with Baljit? Your name sounds familiar. I think you can track it by requests. I am also researching it now and should have answer for you by end of this week.

Alpesh

[Former Member]

Hello Alpesh,

I can see that I can track by requests and request status in the Informer tab, but I don't show any reports that track by role of outstanding roles (e.g. roles never or not yet UAR'd).

Maybe I'll open an enhancement request as a reporting suggestion or look into Datamart reporting. Any recommendation on your side is helpful.

Yes, you helped me on an "ERM-role-import-transaction-menu-folder-problem" issue back in January. SAP supposedly fixed it with SP12, but I've yet to test it out. I worked with Baljit in 2009 on a short project, he's a good guy.

-Best Regards, Dylan