Role design

[#1]

Hello All,

So were planning to re-design all of single roles, would really need your assistance on how to do the ff:

How to identify if the single role is still being used by the client?

What would be the best to go forward if we're going to re-create all 500 single roles into Two (2) separate businesses?

Is there a way that I can confirm/concrete evidence if a role is for a specific module (MM, FI, PO, etc.) - Aside from checking their role description, transaction codes, are there other ways?

Is it necessary to assign the value of Plant to all the roles? Or is there a reference to check this?

Thank you!

[MichaelHealy779]

There is a lot to unpack here. 

If you are re-designing all roles then I presume the client has provided a better understanding of the business processes? Are you going to be working off a defined list of mapped business processes? If not, I would say you should push for this if possible. You also need to make sure you are working to make these roles risk free. 

If you wish to check if a single role is still being used, the only way I see to do this is to track the users' usage. You can use GRC to track the users usage over a period of time. Then you'd need to do some mapping or excel lookup to the usage to the single roles....that's a tricky task. 

Your question regarding the role usage/mapping to modules MM, FI, PO, etc, if the role naming convention allowed you may be able to grab it from there, but other than that you'd need to explore the role contents to check the access and then try and work it out from there.

Assigning plant values to all roles, I am not quite sure I understand this question. Plant values are only required if there is a tcode/fiori app, etc needing this ORG value.