GRC AC Request Role Creation

[Former Member]

Hello all,

I noticed that by default GRC AC doesn´t have a Request Type for Role Creation. Normally how this is done? I mean, if someone realizes that a new role is necessary, how can this person report the need for a new role creation? What are my option here?

Regards,

SAP Legend

[Former Member · Accepted solution]

Hi SAP Legend,

You can not request a new role to be created via an Access Request workflow. You still need a business governance strategy where someone has to raise a request outside of the GRC system for the new roles through the right channels deemed fit in your company to get the new role made. Maybe you have a support ticketing system in place or some SAP security department you can raise the formal requests to.

The BRM Role creation/maintenance workflow runs separately from the Access Request workflow. Further more, the definition and creation process of roles via GRC should only involve and be used by Business Process Owners/Role Owners and the Authorisation security team only, i.e. not general end users.

A role build methodology will have to be set up and then the underlying approval workflows (based in MSMP technology also, like the AR workflow).

Once the role has been built (either via back end PFCG) or via GRC using the BRM methodology and approval flows, the role will be available to the end user to request via AR.

Hope that helps.

[alessandr0]

Hi SAP Legend,

there isn't a workflow to request roles via ARM. You can set up a workflow within BRM for role approval. Means that role creation / modification requires an approval from the role content approver.

The request for a new role has to be given outside the system and then someone (e.g. role architect) has to create and specify the role in BRM. As soon as the role is defined the approval can be sent out.

Also it is possible to have the approval stage very early in your process, like after basic definitions of the role. Please find more about BRM and its workflows in the following document:

Hope this helps.

Regards,

Alessandro