Application Development Discussions
Join the discussions or start your own on all things application development, including tools and APIs, programming models, and keeping your skills sharp.
cancel
Showing results for 
Search instead for 
Did you mean: 

GRC USER level report vs AGR_TCODES is not same

Arif1
Active Participant
0 Kudos

HI,

i am fetching problem that, when i run user level report in GRC i seen that one T-code is assigned many role. but if i check in AGR_TCODES than, found that grc report is not same.

example.

as per GRC report.


user name : user1

T-code VA01 assigned to role1,role2 for the user user1.

but if I check in AGR_TCODES with T-codes than found that VA01 is only assinged role1 not role2.

thanks,

Arif

1 ACCEPTED SOLUTION

Colleen
Advisor
Advisor
0 Kudos

Hi Arif

As Prasant said - verify there is a not a manually added S_TCODE to the role - or someone mapped S_TCODE proposal via SU24

Best way - check AGR_1251 table for object S_TCODE or run SUIM Report Roles by Complex Critieria and specify the transaction code authorisations instead of transaction in menu

In addition, if the second role is a derived/child role there will be no menu values in AGR_TCODES as the AGR_TCODES are only stored for the imparting/derived. Using AGR_1251 will again show if the transaction is in the role

Also, rerun object repository sync in GRC for your roles

Regards

Colleen

4 REPLIES 4

former_member193066
Active Contributor
0 Kudos

check any role has tcode assigned at object level under s-tcode

0 Kudos

AGR_TCODES collects only added tcodes from the role menu. Adding tcodes or ranges directly to S_TCODE is not a good practice

0 Kudos

well i never asked to add under S_tcode just asked him to check since might be a chance,sometime

we add it based on requirement

Colleen
Advisor
Advisor
0 Kudos

Hi Arif

As Prasant said - verify there is a not a manually added S_TCODE to the role - or someone mapped S_TCODE proposal via SU24

Best way - check AGR_1251 table for object S_TCODE or run SUIM Report Roles by Complex Critieria and specify the transaction code authorisations instead of transaction in menu

In addition, if the second role is a derived/child role there will be no menu values in AGR_TCODES as the AGR_TCODES are only stored for the imparting/derived. Using AGR_1251 will again show if the transaction is in the role

Also, rerun object repository sync in GRC for your roles

Regards

Colleen