cancel
Showing results for 
Search instead for 
Did you mean: 

Role getting created in backed with ERM 5.3 with out passing role analysis

Former Member
0 Kudos

Hi Team,

I am tring to create role in backed system using ERM.

role is directly getting created in to backend SAP R/3 with out generation of profile.

can you please let me know how we can restrict this setting so that role will be get created and generated in backed after passing approval stage.

Accepted Solutions (1)

Accepted Solutions (1)

Former Member
0 Kudos

Hi Shripad,

As per my knowledge, this is the normal behaviour of ERM. When you change a role or create a new one, the role is created or changed in the back-end system, BUT the profile is not generated until you do it manually or perform the generation in the role generation phase of ERM. So, the role is changed, but the profile is not generated so far, and users do not have access to the new role or to the changes to the existing role.

We have connected ERM to our DEV system, so the roles are changed only in our dev system. If the change or the new role is approved, we generate the role in the generation phase, later we include the role into a transport request and transport it to QAS and PRD system. This approach leave your productive roles untouched until generation is done and the role is transported. If the change or the new role is not approved you just have to delete the role in your dev system or do a export/import of the old version of the role from production system

I have to tell u that I faced this "problem" and and I would prefer to the role not getting changed until the approval is done, but I think this is a missing functionality of ERM.

Hope It helps

Regards,

Diego.

Former Member
0 Kudos

Hi,

I've found this note recently. It contains the official explanation:

1655426 - Roles appear to be generated in backend before clicking 'Generate' button

"According to this functionality, as soon as the 'SAVE' button is clicked in BRM while in other steps of the methodology other than the 'Generation' step, the role is created (NOT generated) in the backend R/3 system. At this point of time the authorization tab in the transaction PFCG has turned yellow - that means the profile is not yet generated.

The profile only gets generated once the 'Generate' button is clicked."

Note: It refers as BRM, but actually is ERM. This is just because a naming change ().The point is that this note is for GRC 5.3.

Cheers,

Diego.

Answers (1)

Answers (1)

Former Member
0 Kudos

Hi Shripad,

Please check SAP Note 1136690 - Failed to perform Risk Analysis in ERM.

Is the issue with performing Risk Analysis or generating profile. What SP you are on?

Regards,

Raghu

Former Member
0 Kudos

Hi Raghu,

thanks a lot for attending the question.

but risk analysis is working fine and role is also getting generated as per defined step.

issue is only that when i am defining the role and assigning the authorization through ERM same time role is alos appeared in backend R3.it's somewhat strange as role is not approved yet and still it is created in backend.

Logicaly it is no use as still profile is not generated but still I thought itu2019s better role must appear in to backend only when changes are approved.

Former Member
0 Kudos

Hi,

The role in the backend system should not be in there at least you pass the generation step in ERM. Are you editing a role or creating a newone?

Clearly, it´s not usual that when you define a rol this inmediatly reflects the role in backend...

Send a OS message to SAP.

I hope i have helped...

Good luck!