Access Control-Inactive Users Removal

[Former Member]

Hi gurus,

Do you know if there is a way to automate users removal via GRC AC10 when they have been inactive for more than 180 days?

Thanks,

Kind regards,

[madhusap · Accepted solution]

Hi John,

There is no standard way from SAP GRC to do this.

You need to develop a custom program and may be your logic should be like this:

If using Portal SSO to login:

If you have ECC, BW, GRC etc systems then in your program should check the Last Logon Date in all the systems and if the user is inactive in all the systems for more than 180 days then raise a Lock Account request for that user. Lock Account request should not have any approvals.

If the user is active in any one of the systems don't lock the user.

Regards,

Madhu.

[former_member197694 · Accepted solution]

Dear John,

Yes,even we implemented programs with help of ABAP consultant in ECC and GRC systems to lock and remove inactive users

1st Program for lock the users if they have not logged more than 45 days

2nd Program for delete the users if they have not logged more than 90 days

and scheduled background jobs once in a month.

Regards

Baithi

[Former Member]

No automatic method out of the box sadly, but with a decent Governance process established and implemented this should not be a difficult task.

Previous customers I have worked with have established a regular periodic report to be performed whereby they check for User ID's that have been inactive for a set period of time i.e. 90 days etc and then performed a mass user request to lock and expire the ID's or ultimately delete them if no challenge has been raised.

In addition, a robust "Leavers" procedure has been established, whereby all leaver accounts are removed from SAP systems on the first business day after the user user has left. The Line Manager has to raise a "Delete User" request in ARM.