GRC: HR Trigger + Provision Directly to backend

[Former Member]

I am having some doubts regarding the worklow.

This is what I have right now:

1.HR modify data infotype from a user such us the name

2.GRC

creates a new request for Change User

3.This request goes to a stage and then a user must approve or reject.

This is what I want to get:

1.HR modify data infotype from a user such us the name

2.GRC creates a new request for Change User

3.This request does not go to any stage. It goes direct to

the system.

The new name of the user should not be review by

anyone.

That would the perfect one. But this will be another SNC

message.

1.HR modify data infotype from a user such us the

position.

2.GRC creates a new request for Change User

3.If into the change position there is SoD the request goes to a Manager.

4.If into the change position there is not a SoD the request goes to

direct to the

system.

So the question is, how can I get that for a simple change (Such us the

user name change) the GRC system provision directly to the backend

and not going through a user. I don’t want to have any stage or

agent.

Please check my MSMP workflow. Could you please indicate how

should set the stage to do not get an approver validation?

[Colleen]

Hi Jebeni

You will need to configure the Initiator rule to capture this scenario (BRF+ logic) and direct these results down a different path that as no stages (no stages means auto approval)

Define the Path and complete the mappings for the Initiator Result to Path. Do not add any stages to the path.

Regards

Colleen

[Former Member]

Dear Colleen,

thank you so much for your reply but we have some doubts related with MSMP.

We configured BRF+ for HR Trigger using following links:

• SAP Note 1591291 - GRC 10.0 - HR Trigger
  configuration.
• http://wiki.scn.sap.com/wiki/display/GRC/GRC+10.0+-+HR+Trigger+configuration
• http://wiki.scn.sap.com/wiki/display/GRC/Understanding+HR+Triggers+in+Access+Control+10.0

Additionally, we configure MSMP Workflow as you said in your last message but, we have a new requirement.  All requests has to be auto-provisioning without approval stages but for requests with existing SoD, SAP GRC has to send an email to manager or security lead figure to inform of his request with existing SoD.

Please, could you help us to how we can configure MSMP Workflow to set only a notification without  approval stage in case there is SoD in the request?

Please, it could be really great if you can help us with that.

Thanks in advance.

Best Regards.

[Colleen]

Hi

I suspect you can try to split this into two parts

1. Attempt a routing rule to split the request to a different path if it has a SoD
2. On SoD detour path
   1. have notification to send to the manager/security lead
   2. "play with" escalation/no approver/etc to route to another path with no stages to close out the request (possibly a dummy approver that won't exist). I don't have access to system to prototype but SCN threads may have discussed this scenario already

If you managed to get the basics of MSMP working it can be in your own interest (learning) to prototype and play with the scenario. MSMP concept seems quite powerful in the flexibility it offers. Sometimes you just need to be creative about how you achieve your goal.

Good luck with it if you haven't managed to achieve it already

Regards

Colleen