GRC 10.1 Access Request - Connecting up to 100 systems

[Former Member]

Hi everyone,

I would like to ask fo a piece of advice from you.

We are working on a Proof of Concept to configure GRC Access Request Management for the non-production provisiong within our project.

Currently we use a custom program to provision all the systems across our landscape and we would like to move all this process to GRC.

We manage around 100 systems (sandbox+development+QA), including HANA and BPC systems.

All the information we came across refers to a couple of systems, so we would like to ask for your advice here.

Creating 100 connectors doesn't seem feasible, it could be possible to connect these environments using RFCs? How are those connections usually managed in this kind of situations?

Thanks a lot in advance,

Bea

[kevin_tucholke1 · Accepted solution]

Bea:

Not sure I understand the question.  All SAP AC connectors start at the point of an RFC Destination.

I have implemented SAP AC with as many as 80 sytems and 11 landscapes with no issue.  But each one has to have its own RFC Destination.

Let me know if that helps.

Kevin Tucholke

SAP America

[Former Member · Accepted solution]

Hi Kevin,

Thanks for your response. So you mean that you have created 80 connectors (with their corresponding RFC), one per system, and it's still manegable from GRC standpoint?

Regards,

Bea

[kevin_tucholke1 · Accepted solution]

Bea:

Yes, this is managable.  As always, the more systems, the more data needs to be entered so from a functional standpoint there must be a realization of the amount of support required to 'keep the lights on" if you will.

Thanks.

Kevin.

[Former Member · Accepted solution]

Thank you very much Kevin, your reply has been really helpful

[Former Member]

Hi Bea,

Just to echo what Kevin said, this is definitely feasible. I've had GRC manage 400+ end point connected systems and it stood up to the work load.  A few items to consider when connecting such a high # of systems:

• SM59 RFCs - Consider scripting to load these in an automated fashion especially since they aren't transportable
• Connector Group strategy - map out you design here ahead of time. It can go a long way towards streaming data & maintenance across so many connectors. If you are on a transport path, I feel like setting up all the SM59s in dev (you can leave connection info blank in dev if you don't want them "on") is important so you can do all the connector-specific config one time & transport
• Prioritize & monitor background jobs - make sure your important / highly utilized end points are staying on schedule with repository syncs
• Provisioning Failures - Inevitably if some of your requests end up containing 100+ systems across a non-prod landscape, something will be down or unreachable for GRC.  Plan the approach for handling these failures in GRC
• Business Roles - great way to grant "Security Admin" access across a ton of connected systems within 1 role

-Nate

[Former Member]

Thanks for the suggestions Nate, we'll take them into account for our project