Does anyone know how to run a SOD simulation that involves removing roles?

[Former Member]

I'm using GRC 10.0 and trying to run a SOD simulation for a user, by trying to remove a role. However, I don't seem to be able to make it work

Does anyone have a step by step guideline on how to address this query?

[Former Member · Accepted solution]

Umberto,

This is how I do it:

In the Define Simulation Criteria screen, in the Additional Criteria selection, select the box next to Exclude Values. select the Role tab,  select Add , Role Type = Technical Role, System = the ECC system,  and in Role From, search for the role to simulate the removal from the user. Note that you have to know which role you are going to simulate removal; if in doubt, log on to the backend system and review the roles assigned to the user via SU01D. Note: if you change your mind and need to remove a role from the simulation, use the remove option.

Does that work for you?

Gretchen

[Former Member · Accepted solution]

It worked!

Many thanks

Umberto

[Former Member · Accepted solution]

Umberto,

Glad to hear it. Please mark my answer as correct and close the discussion thread, unless you have a follow-up question.

Regards,

Gretchen

[dyaryura · Accepted solution]

Hi Gretchen,

Nice option there. I usually have a test user created in DEV and simulate thee removing and adding roles.

Just to confirm, but no option to simulate adding roles and removing roles at the same time right?

Cheers,

Diego.

[Former Member · Accepted solution]

Diego,

Good question! I had not tested that scenario, but apparently not. Once you click that "exclude values" box, the listed roles are excluded.In this case you may be better off creating a test user modelled on your real user but with the desired roles added and excluded.

Gretchen

[dyaryura · Accepted solution]

Hi Gretchen!

Many thanks for your imput. I think that SAP should add a toolbox where you can simulate "add" or "remove" in the action and roles.tab. That's would be nice!. Meanwhile, creating a test user is the better option.

Thank you!

Diego.