Modifying GRC 10 WF to include one more stage of approval

[Former Member]

We have GRC 10 implemented and runnung successfully. However, recently we have decided to include one more team as an approver for Delete account requests. Please anyone can guide if the exisiting Delete account path can be modified or I need to create the new Workflow.

For information, this new stage is not for the standard ones like manager, security. I need to create this additional approver stage for the Workflow team to approve the delete account request before the final deletion of the SAP account.

Thanks in advace for your valuable replies.

[kevin_tucholke1 · Accepted solution]

Sameer:

As long as you have and available step number in the path, you can just include the new stage into your workflow. 

For example, if your current path has stages 010 Manager, 020 Role Owner, 030 Security, and you need to add a new stage between 010 Manager and 020 Role Owner, you can add a stage with Step Number 015 New Approver Group.

Hope this helps.

Kevin Tucholke

[Former Member · Accepted solution]

Kevin, thanks for the reply.

I got that the new stage can be added. But do I need to play with BRF+ rule or I just go to MSMP path and include the new stage.

Also where to define the new group members so the approval request should go the designated stage members.

[former_member1127887 · Accepted solution]

Sameer,

BRF+ is not needed for adding a new stage to a workflow. New group members can be maintained in Agent type - 'PFCG User Groups' in MSMP.

Regards,

Manjeera Kuppala

[Former Member · Accepted solution]

Dear Kevin and Kuppala,

I just checked, there is no free stage number possible as the current path has 001 and 002 stage used. Is it possible to move 002 to position 003 and create a new 002 in between.

Otherwise, Do I need to create the new path from scratch and inactivate the current path.

[former_member1127887 · Accepted solution]

Sameer,

Moving stages is not possible. And there is no need to create a new path from scratch. But you can delete the unwanted stages and create a workflow team stage and assign the agent id accordingly. So that the team will receive the requests for final deletion of SAP account.

Regards,

Manjeera Kuppala

[Former Member · Accepted solution]

Dear Manjeera,

As per current scenario, I have 2 stages for delete account request(Manager and Security). I want to add one more stage for WF team in between these 2 stages of Manager and security. So the flow to be Manager -> WF -> Security. 

But as you know there is no stage number free to be inserted.  Please advice.

[kevin_tucholke1 · Accepted solution]

Sameer:

You will have to DELETE the state in Step 002, then add the new stage (I would recommend that you make this step 020), then add back the deleted stage (recommend the step number be 030).  My recommendations will allow addition of more stages if you need to.  It does not have to be the numbers that I suggest, but would recommend that you leave space between the stages.

I hope this helps.

Kevin Tucholke

[former_member1127887 · Accepted solution]

Sameer,

As per the above scenario you need to create a BRF+ flat rule to achieve this scenario. As any changes done to GRAC_AR_INITIATOR will effect all types of requests. So I would suggest you to create brf+ rule rather than adding a stage in MSMP for deleting a SAP user account as per your requirement.

Hope this helps!

Regards,

Manjeera Kuppala

[Former Member · Accepted solution]

Thanks Kevin and Manjeera.. I will try with the suggestion as mentioned by Kevin as I not used to BRF+ rules as of now. If it works its good, otherwise I need to learn BRF rules to create a new path as Manjeera suggested.