User Access Review content

[Former Member]

Hello experts

Is it possible that the UAR (user access review) functionality in AC ARQ10.0 will be based on business roles that maintained in the system insted of the single roles? e.g the manager will recieve a report indicating which business roles each user has with it's usage insted of which single/composite roles he has.

We maintain in our system both single/composite and business roles.

The managers in the organization (who are responsible to approve the UAR reports) are familiier with ONLY the business roles and do not work or know the single/composite technical roles hence cannot approve the UAR based on them.

We would appriciate your response as this issue would determine if the customer will work with the ARQ component or not.

Thank you in advance

Shira

[Former Member]

Shira,

Since no one responded to your inquiry, and there is no mention of user access reviews in the Business Role Management guides, it seems to me that your customer is out of luck. That is a shame; the situation is the same here, and I suspect it is a very common scenario. Isn't the business users' lack of familiarity with the technical roles a large part of why SAP came up with the whole idea of Business Roles in the first place? If they are not familiar enough with the technical roles to request them, they are not familiar with them at review time either. I would be very excited if someone from SAP could tell us that such functionality is now available, or coming soon via support pack.

Gretchen

[Former Member]

Hi Gretchen,

We will have the same requirement as we are evaluating the Business Role concept to allow a better understanding for the access requestor. The goal beside the Business role name would also be to provide a more detailed decription on a business comprehensive wording.

From there, we would like to evaluate the GRC  User Access Review functionality to provide enough comprehensive details to the reviewers to be able to approve or reject the different accesses.

We expected to have the option to only have Business Roles in the review where applicable to facilitate the process.

At this point it doesn't seem to be available and as per your reply SAP doesn't provide any information on this as well.

Again, we will have to wait until something is delivered on this area but we are not even sure that this is taken in account. So, maybe we won't spend time on GRC UAR at all.

Hope that the SAP GRC Lab is hearing our need.

Thanks.
Patrick.

[Former Member]

Patrick,

Thanks for adding your thoughts on this functionality issue. I would encourage you and everyone else who has been following this discussion to "like" the thread and the comments, in order to increase the visibility of this discussion. I intend to pursue it further through the various channels open to us, including the Customer Engagement initiative and the ASUG Influence Councils, and invite others to do the same.These influence opportunities do get results, but it takes customer participation to get SAP's attention.

Cheers,

Gretchen