Difference from Deprovisioning and removing tasks

[Former Member]

Hello,

In a repository i can configure both deprovision task and remove member task. I don't understand the difference from these jobs. In my opinion I can delete users in the targetsystem with both tasks...

I don't find any informations about the different tasks... Maybe someone could explain it or have a link to a helpful document...

Thank you

[Former Member · Accepted solution]

Hi Peter,

the provision and deprovision tasks are called when a privilege is added or removed and the privilege should be provisioned or deprovisioned immediately.

When you use the add or delete member tasks, a pending value is created. The privilege is not immediately provisioned and is not immedaitely assigned. You can then start an approval task, where the assignement or deassignment of the privilege first needs to be approved. Once the approval is done, the privilege can then be provisioned or deprovisioned.

Best regards

Holger

[Former Member · Accepted solution]

OK, thank you for your answer.

So I never use booth the "Provisioning" AND the "Add Member" event, right?

[Former Member · Accepted solution]

You use them both. If you have an ABAP system for example you have the ProvisionABAP task assigned to the repository. This means whenever a privilege from that repository gets assigned, this task is called. It is needed to assign the privilege. Normally this tasks is identical on all your ABAP systems.

The add member task is something else. If you have such a task set to a privilege, it gets called, every time you assign this privilege (or role). An example would be a HR Payroll privilege on your HR Prod system. If this privilege gets assigned, you can kick off approval tasks. If this is a single approval or something more complex is open to your choice. Once all approval steps are done, the privilege gets assigned on the target system.

To make it short: You always need a provision task, but you might not need an approval task.

I hope this was more or less understandable.

[Former Member · Accepted solution]

Perfect, I think I've understood the issue.

Thank you both!