Avoid adding child roles of business role to a access request for removal

[Former Member]

Hello Experts,

I was looking for a way to avoid GRC requester from adding child roles of business roles through 'Existing Assignments' technically. Currently I see that profiles/systems are greyed out in 'Existing Assignments' and requester cannot add them to request for removal.

Please drop your reply if anyone has a way to achieve the same. We are currently providing requestors with training to not select any child role of business role from existing assignments for removal.

Regards,

Sravan

[Former Member · Accepted solution]

Hello Sravan,

You can set SPRO parameter 4011 to NO to prohibit deletion of technical roles if part of business roles.

Best Regards,

Zoltan

[Former Member]

Hi Sravan,

As suggested by Zoltan, Parameter 4011 is used to control the selection of technical roles of a Business Role.

Kindly check the below SAP Note as well

2246689 - UAM 10.1 : Technical roles are coming selectable in Business roles

Hope this helps

Regards,

Manju

[surya_appala]

Hi Sravan,

You may also please check for object GRAC_ROLED where you can control the selection of roles into request.

Also, you can create a BRF+ condition for those requests such that it will get routed to your inbox and you will be able to cancel them.

Regards,

Surya