HR trigger questions

[Former Member]

Hello

We are on stage of blue print design of ARM module. The requirement is that, once HR trigger raise an user resign event, AC will automatically create an user disable request, this request will automatically disable user's accounts in all system where this user existing, and all of assigned roles will be automatically removed。 My questions are:

1. Can AC automatically fill in all systems where this user existing in request form? Do we need to do more configuration or customizing?

2. Can AC disable accounts and remove role assignment in the same automatic request?

3. Can AC support the same function in SAP portal?

4. Another question is related to PSS(Password SelfService), can PSS be applied in SAP Portal?

Would appreciate some views please.

Thank you

James

[Former Member · Accepted solution]

Hi,

1) You may wish to read this SAP note https://service.sap.com/sap/support/notes/1591291 and this WIKI in detail GRC 10.0 - HR Trigger configuration - Governance, Risk and Compliance - SCN Wiki

2) As standard (i.e. not HR triggers) I think this is a challenge. with the request "Lock user" you can utilise the action "Lock and Change User" in the request type, but I believe this only allows you to work on the System level user ID and not the roles assigned within the same request. However, worth looking at how HR triggers deals with this

3) GRC does work against SAP Enterprise Portal roles/groups, therefore this should not be an issue.

4) I believe PSS can be applied to SAP Portal, as you are able to provision user ID's via GRC ARM. You have to ensure the AC and EP fields are mapped/synced correctly in the connector config.