Turning off autoprovision for UAR?

[Former Member]

Hi experts,

We are testing UAR in 10.0 SP08 (which we were running in 5.3).   We see references in some documentation to the fact that auto-provisioning can be turned on or off.   However I haven't seen a document that says "here is where you turn on|off auto-provisioning for UAR".   We did find a SPRO setting for auto provisioning for CUP.    It does seem to make a difference, except with unexpected results (though we don't provision with CUP, so might be my lack of knowledge).   Under SPRO=>GRC=>AC=>User Provisioning=>Maintain Provision Settings, there is a "Provisioning options" field.   Our test scenario is that a manager removes one of a users roles (all the rest are approved).   We want the request to then flow back to security (which is working), but the security administrator does NOT want the role to be automatically removed, even if he approves the removal.   We have found that with either "auto provisioning at end of request" or "manual provisioning" set, the role is automatically removed in the backend system immediately after the security admin submits the request.  With "no provisioning" set, the role is automatically removed in backend immediately even before security admin gets a chance to look at it, immedately after the manager submits/approves the request.

We do see that the admin can change "remove" to "approve" if he needs to override the manager's removal.  But our admin would prefer to do all removals manually.  Am I even looking in the right spot for where to turn this off?   If so, does this behaviour make sense?

Appreciate insights any of you might have to share.

Regards,

Heraleen

[kanika]

Hi Heraleen,

Were you able to achieve this scenario?

Regards

KG

[Colleen]

H Heraleen

I think for in the Path/Stage of the MSMP approval there might be a stage setting option for provisioning in addition to the Configuration path you mention

Allow Manual Prov - Used on last stage of the workflow path. If enabled, displays a provisioning manually button

Have a look there and see if that resolves your issue. As it is the last path you might need a routing rule or something to split when you want automatic verse not.

I suspect you set the IMG Configuration to "Auto provision at end of the request" and possibly MSMP setting is the override for that path.

Message was edited by: Colleen Lee

[Former Member]

Thanks for your reply Colleen.   I am not seeing a setting in the workflow about allowing manual provisioning.  Maybe it's worded differently and I'm missing it, but I don't find it.   Anyway our security team has decided they are going to allow the automatic provisioning.   At least they have the option to be notified of changes that are made so that they can review.

[Former Member]

Hi Heraleen,

At the stage level settings,If you click on the tab modify task settings it will have an option called Allow manual prov. Please select this checkbox and generate the MSMP Version and test the scenario.

You can also enable the manual provisioning for the specific system from the SPRO

Thanks & Regards

Japneet Singh