GRAC 10.1 - Business Role Assigment

[Former Member]

Hi -

We are trying to design a scenario where the end state will look like this:

- Employee is hired into a position on SAP ECC

- HR trigger sends a request to GRC to create the access

- GRC creates the accounts and assigns to business role

While this seems a fairly standard scenario, I feel I am missing a piece of the puzzle.  Is there a way for GRC to know which business role needs to be assigned to the user automatically? Or does this need to be manually done? Is there a place where we can maintain a mapping between position and business role?

Thanks,

Ricardo

[alessandr0 · Accepted solution]

Dear Ricardo,

there are some ways of utilizing that challenge. You can either use BRFplus that based on rules the roles are provided, another possibility also comes with HR and position based authorization.

Another approach is to have a manual step that someone needs to add the necessary roles within the request. In this particular case HR trigger will start the request and send to a defined stage (e.g. user's manager) who then adds the roles. Following stages can be defined for appropriate approvals (e.g. role owner).

I recommend to rethink what are the requirements and how complex the scenario will be. From maintenance point of view also consider the effort required especially if you use BRFplus to set up all the rules. This might be a no go for complex scenarios since you have to define everything in a decision table. BRFPlus is recommended for a little number of roles that based on criterias can be identified. For complex scenarios you should better go with the manual step.

Hope this helps.

Regards,

Alessandro