Configuration of User Access Review process

[Former Member]

Hi,

I'm new to the forum.

I´m looking at the User Access Review process in CUP.

I would like implement the User Access Review request. So, my question is:

1. Where take GRC the data to make the analysis? I need to know the exactly place where data are collected (which table, transaction code or statistical data)

In case that GRC use the backend tables, I should be aware of time that tables are operational in the system, correct?

2. Otherwise, how affects this analysis the performance in backend system?

3. I have read that it is possible obtain reports with use of Action Usage. The report that I mention is: RAR --> Informer --> Security Reports --> Miscellaneous --> Action Usage by User

Where does it gets information from? Could be data in the same place that use User Access Review process?

4. Is it possible to introduce another actors in the Reviewers (In Configuration Tab, User Review > Options > User Review pane)? Now, the reviewers configured are Manager or Role Owner.

5. To set User Access Reviews, I need some additional technical or is an automatic procedure?

If there is any requirements that I should be taken into account please, let me know.

Thanks in advance

Marta

[Former Member]

Hi,

I have found this document that answers all my questions: www.sdn.sap.com/irj/bpx/go/portal/prtroot/docs/library/uuid/b05010a3-ed45-2c10-79b2-96df60a6bf2b

So, now I have another question:

The GRC Access Control that I have, ERM is not configured and there is no communication with it; (only RAR and CUP are configured). So, I would like to know if it´s possible configured User Access Review apart from ERM.

To realize the Role Usage Synchronization job in ERM, the transaction usage information from RAR alert data is needed. The job also obtains role to user assignments and role content information from the back-end systems. Access Control then translates the transaction usage information into role usage.

If this information could be extracted from the backend tables, I am looking for an alternative to way to load data in the system, regardless ERM. Is it possible?

Thanks in advance

Marta

[Former Member]

Marta,

CUP relies on ERM to pull the role-user assigments as you mentioned, so in order for the UAR to even be kicked off, the ERM system connectors need to be connected and the role usage background job run. A key point to mention here is that you must have a license for ERM to enable the UAR portion of CUP, which shouldn't be an issue if you bought Access Control as a package. As far as setting up ERM, you only need the connector, web services, and background jobs for UAR to successfully work; the other master data can remain dormant.