SAP GRC - Preview User Access Review (UAR)

[former_member748144]

Is there any way (outside of actually GENERATING the UARs) to preview your users and managers that will be included in your UAR?

A related question: Is there a table that holds "Existing Role Assignments" for users (available within GRC)?

[Monsores]

Hi Elaine.

GRC uses the data retrieved by the repository sync to generate UAR requests (specially repository and role usage syncs), and these roles must also be set up in BRM.

Any assignment that comes in the "Role to User Relationship Report" should be on your UAR (always respecting your filters, of course). If you prefer to check directly from tables, the main source for this is GRACUSERROLE.

It is not exactly a preview, but you can enable the "Admin Review" step for UAR in SPRO, and then GRC Administrators will be able to review generated requests (and manually adjust approvers, if needed) before they are released to reach approver inboxes. Here we have created a custom program to compare the content of the generated (but still not released) requests with GRACUSERROLE table to explicitly show which assignments were included or not.

Regards,

Marcelo Monsores

[lukasz_konieczny]

We had to develop our own custom program that helps us manage UAR generations. We can now generate not only test runs, but also generate UAR by individual user, user group, UAR coordinator or reviewer. We can also exclude users by specific business roles, exclude locked users and so on.

[former_member748144]

Wow. Definitely something that should be considered by SAP for the future. It's exactly what I'm looking for overall. I hope you have entered your info as recommended enhancement. GRC is lagging a bit behind the times....

[Monsores]

Hi Lukasz.

Can you please share why the filters in GRAC_UAR_REQUEST_GEN program and the Admin Review step didn't attend to your needs for filters and test runs?

I'm asking because we also had to enhance this program to solve other business needs (an alternate way to retrieve reviewers that are neither managers nor role owners and an improvement for the self-review avoidance) and it would be nice to hear about other improvements that maybe we can also do.

Regards,

Marcelo Monsores

[lukasz_konieczny]

To be honest I don't know full store behind this enhancement because I am new in my current organization, but our version of this report looks like this:

From my perspective one of the main features missing from original version is Test run.

[jjacobs4]

Have you tried using table AGR_USERS?

This table shows the User ID and which roles are assigned to them....

[former_member748144]

No access to the AGR tables, unfortunately. Also need to remove certain default roles from the count because we do not include those in the reviews.