Changing Organization level for derived roles

[Former Member]

Dear All,

Below is my query:

When there is any requirement to change the organization level of a derived role, we go to the role and change the organization level manually.

We have derived our roles, based on the units(company codes).

Now we have a scenario, where we need to add one unit in a particular derivation of all roles.

Please suggest if there is any way of updating the organization level in mass for a specific derivation.

Regards,

Reshma Vijayan.

[Colleen]

Hi Reshma

It's all manual to do this via PFCG

I know a few clients who have developed custom load tools and hit the AGR_1252 table directly. It is a high-risk to ensure there is not corruption of values (in one place they accidentally loaded cost centres without the preceding zeros which didn't show up in PFCG as an issue). After they run the program they then run SUPC to mass generate them.

Regards

Colleen

[Former Member]

They should be thankful that the developer didn't forget to:

1. Check that test mode was test mode

2. Check that a s/s wasn't blank before it was loaded.

Goodbye AGR_1252!

[Colleen]

Hi Alex

I read your comment at the gym last night and said "ouch" out loud. People turned around wondering what I had done.

Yes, hitting the table direct is high risk. GRC did provide a pretty good solution with organisational maps but not many clients I know use it.

The places I've seen do custom always have step 1 - download AGR_1252 first (or worse case use the UST tables to grab the values and fix in Excel so long as you haven't generated the role)

Regards

Colleen

P.s. Reshma - Another option could be to mass download your roles and add Org Entries to your file (you will see the pattern for the AGR_1252 line format) with the new value before uploading again? If doing this, I would test with a small sample to make sure modifying the text file doesn't corrupt the rest of the role. At least with this option you are using the PFCG functionality and not hitting the tables directly

[jurjen_heeck]

Colleen Lee wrote:

At least with this option you are using the PFCG functionality and not hitting the tables directly

Hi Reshma, Colleen,

Some additional warnings about manipulating the downloads:

1. The downloadfile is a fixed record length text file, do not mess up the data positions.
2. Be aware of case (upper/lower) when manipulating the file.
3. Make sure you do a unicode download to preserve special characters in the menu texts.

There are very, very few checks done on the file contents when uploading again. It will allow you to pollute your AGR* tables in such a way you'll need an ABAP-er or SQL-savvy colleague to clean up the mess. It is very close to manipulating the tables directly.

I once managed to get entries into AGR_1251 which didn't show up in PFCG and wouldn't even disappear from the tables after I had deleted the roles in question.

And yes, I still use this method, but I won't advise it to anyone I cannot personally train to be aware of the pitfalls 😉

Jurjen

[Former Member]

Thank you all for the response Colleen, Alex and Jurjen . I was just wondering if SAP has a way to do this action is mass. I assume that no built-in SAP functionality provide that option .

Hello Colleen,

Could you give some details on the GRC solution for organizational mapping. Right now we only have Risk and Remediation part of GRC.

Regards,

Reshma Vijayan.

[Former Member]

If you put 2 and 2 together, then you can work out that GRC orgset management needs to be able to transfer the org level values to sets of roles and it must be dialog free for a program to be able to do it in the background, and so it is. Since about a year these are also released APIs on the PFCG side to perform certain operations on roles.

But if you already have the GRC application and the connections, then all you need to do is read the docs and start using it...  🙂

Cheers,

Julius

[Colleen]

BRM usage in GRC may depend on licensing and then time and effort to setup

[Former Member]

Hi

You can try the SAP Script recorder from the TV icon on the main screen or the transaction recorder under system (think it's that one)

You'll need a friendly SQL/VBA bod to write some commands but, by the time all that is done, you could probably have done it manually via SUPC.

Best wishes

David