How often should GRAC_PFCG_AUTHORIZATION_SYNC be run ?

[Former Member]

Hello SAP Experts,

I am wondering how often the GRC AC job GRAC_PFCG_AUTHORIZATION_SYNC should be run.

I understand that GRAC_PFCG_AUTHORIZATION_SYNC needs to run and complete before GRAC_REPOSITORY_OBJECT_SYNC should be kicked off. We do have GRAC_REPOSITORY_OBJECT_SYNC scheduled to run hourly so any role changes are captured in our ARA reports. 

Should GRAC_PFCG_AUTHORIZATION_SYNC be run with the same frequency ?

Is this job a one and done task only to be done during configuration ?

I’ve seen the job referenced in much of the SAP docs but have not found an indication of the frequency with wich is needs to be run.

Many Thanks !

Jamie

[kevin_tucholke1 · Accepted solution]

Jamie:

My recommendation has always been weekly on this.  This transfers changes in new permissions, new actions, changes in Su24 for simulations, as just SOME examples.  Frequency of this sync is loosely tied to the frequency of changes in the PFCG Authorization data. 

This is not just a one and done job, but needs to be scheduled periodically.

Thanks,

Kevin Tucholke

SAP America - Sr Consultant

Business Analytics Competency Center - SAP Access Control

[Former Member]

Recieved a very good resource from our SAP folks on site. This guide lists the jobs that need to be scheduled along with frequencies.

　

Operations Guide

SAP Access Control™ 10 / Process Control™ 10 / Risk Management™ 10

[Former Member]

Hello Kevin,

Thank you for the recommendation. This will be very useful.

What prompted us to examine this is that our ARA role reports are now showing more SOD violations than our initial runs. One of the variables from our initial runs was that this job was finally kicked off again manually since the early reports (about a 4 month interval) were run. Any idea if not running this job, then suddenly running it would be linked to our ARA reports growing ?

I can add that our roles have not changed as much as the reports have grown.

Jamie