MSMP workflow configuration and Locked client

[lashele_harris]

All,

I'm fairly new to GRC and notice that I'm able to maintain the GRC workflow in our productive client.  Is this considered master data?  If so, how can we locked down this access in production?

Thanks in advance for your responses,

LaShele

[lashele_harris]

Thanks everyone for the feedback.  Restricting the access on the profile worked. 

[alessandr0]

Hi LaShele,

did you close your client via SCC4? Also you can remove authorization from user so that only display is possible.

Let us know.

Regards,

Alessandro

[lashele_harris]

The client is closed, which makes me think this is considered master data.  Do you know what objects control the maintenance of this function? I would like to have display only to the workflow, but still be able to activate the new workflows when they reach production.

I was told that you had to activate/generate the workflow once it reaches it's destination client.  Please let me know if this is incorrect.

[former_member204479]

Hi LeShele,

Yes you are right, after transport the workflow needs to be activated in the destination client.

You can control the access using GRFN_MSMP authorization object. Here the ACTVT is 23 for Maintain and 07 for Activate/Generate. So for your case you can remove 23 from the user and only have 07.

Thanks

Sammukh

[Colleen]

you might also need to check the SAPGUI version and lock down S_TABU* change to some of the tables as well if you have the access to go into MSMP configuration via expert mode.