Question Re: Firefighter Users without SAP GRC AC possible? in Additional Q&A

Firefighter Users without SAP GRC AC possible?

Former Member — Tue, 12 Jan 2016 09:50:40 GMT

Hello,

Transaction /VIRSA/VFAT does not exist on my client's ERP system.

I assumed that this is a standard transaction in ERP.

Does this only come if a SAP GRC AC is implemented? The client does not have a SAP GRC AC installation.

Thanks & Regards,

Peter

Re: Firefighter Users without SAP GRC AC possible?

Colleen — Tue, 12 Jan 2016 09:58:24 GMT

Hi peter

It is a GRC add on transaction

typically if a transaction begins with / then it is probably an add-on (or was originally)

Firefighter is one of the GRC modules

Regards

Colleen

Re: Firefighter Users without SAP GRC AC possible?

Former Member — Tue, 12 Jan 2016 17:31:39 GMT

Hi Peter,

If you don't have a SAP GRC Access Control, don't worry, you can create a manual procedure to work with the "FireFighter" request.

Create a User ID with roles of "Super User" and add to user when his need.

Remember use SM20 log.

Regards,

Salomão

Re: Firefighter Users without SAP GRC AC possible?

former_member742222 — Thu, 10 Mar 2016 21:23:32 GMT

Hi, Peter. The Basis team must install the GRC plug-in for Emergency Access Management (Firefighter) to enable that functionality.

Re: Firefighter Users without SAP GRC AC possible?

plaban_sahoo6 — Fri, 11 Mar 2016 05:20:45 GMT

Hi Peter,

check out for VIRSA* components on ERP system. this will give you the /VIRSA* t-codes. so,

you would have a earlier release of GRC, named VIRSA .

Regards

Plaban

Re: Firefighter Users without SAP GRC AC possible?

Bernhard_SAP — Fri, 11 Mar 2016 08:51:33 GMT

moved to GRC space

Re: Firefighter Users without SAP GRC AC possible?

Former Member — Fri, 11 Mar 2016 13:26:56 GMT

Peter,

It is certainly possible to create a home-grown version of Firefighter. An organization where I worked previously did just that. A custom ABAP was written to monitor for assignments of any role with *FIRE* in the name, log the activity of the user for the duration of the role assignment, and send an email of the log to the manager of the user for his/her review and approval. It was not fool-proof; sometimes the statistics buffers overflowed and not all of the activity was returned in the log. It took quite a bit of intervention and maintenance. Your client is likely better off implementing GRC Access Control. It is certainly more robust. If it was easy to do on your own, SAP would not have included it in their GRC solution, wouldn't you agree?

Gretchen