Roles in GRC ERM 5.3 (SP11)

Hello Gurus
We have a couple of dude about to import the Roles to ERM.
Our systems: GRC AC 5.3 (last SP) & SAP R/3 4.7 (SP53):
1) We have around of 450 Roles in BackEnd R/3. All they roles exisiting must being fed in the file downloaded of /VIRSA/RE_DNLDROLES??
2)We to use trx PFCG for maintain the Roles in the Company. Each week we to modify the roles for user's request and pure market's strategy. Those roles modified also must uploaded or updated in ERM?
Thanks for all.
Erick Verbena
SAP Basis
PROLAMSA

Hi Eric,
you can upload entire role in GRC from R/3 system but this will be a resource hungry practice. Better you update the role by increamental method.
Arpan

Similar Messages

Import roles to the ERM without using the "Mass Role Import

Hello,
I want to know if there is another way to import roles to the ERM without using the "Mass Role Import.
Im'm using SAP GRC AC 5.3
Best Regards.
Pablo Mortera.

Hi.
There is NO other way to import roles..
We need to use only ERM for "Mass Role Import.
Regards
Gangadhar

GRC ERM

Hi ,
Can you please let me know how to download roles in mass from SAP in text format to upload it in GRC ERM?
Please help.
Thanking you in advance.
Regards
MK

In your ABAP system, use SA38 and run transaction /VIRSA/RE_DNLDROLES.
You'll end up with 3 files that you can use for the mass upload to ERM.
Frank.

Defaults Roles Doubt - GRC 10.0

Hi All,
I have a query regarding default roles in GRC. In the role search screen when the user selects a role, there will be a defaults roles column which shows all existing defaults roles for different systems maintained in GRC.
Actually our client requirement is that when a user selects role for ECC only defaults roles defined for ECC should show up. But currently default roles column shows all defaults roles defined in GRC.
Is it possible to achieve our scenario? Anyone came across same issue?
Regards,
Sai.

Dear Sai,
the behaviour is standard as you have defined parameter 2011 as ROLE. To change the output you might need help of an ABAPler.
Alternatively you can change parameter 2012 to REQUEST and then the requestor won't see the default roles as they are added to the request after submission. Only the approvers can see the added default roles.
Best regards,
Alessandro

Role approver removed from role in GRC

Hello Experts,
I am a fresher to SAP GRC. Please help me on the below issue.
In SAP GRC 5.3, for some roles role approver has been removed and some roles automatically uploaded to GRC. The role that are uploaded to GRC should not be and while checking there is no change log for the role. For other roles for which role approver have been removed, also there is no log for which recent approver have been removed.
Can you tell how it happened and who did this or way to troubleshoot.
Thanks in Advance.
Biswaranjan

Hello samiran,
Thanks for your reply.
Yes we have already uploaded the OLD file. But my concern is how we can troubleshoot to find out how it was corrupted as no one did the change. we can find the change log for the approver change for any role in GRC 5.3 .
Or it is not possible to find out how it happened???
Regards,
Biswaranjan

Mass role Import in ERM "unable to determine matching org. level" Error

I am trying to upload the Derived Roles into the ERM. I have already uploaded all the Parents Roles. The volumes of the Derived Roles is huge in my SAP Backend system.
I am not able to understand what should be the content of Org File which we upload. Please correct if I am wrong
1>Example a role Z_TEST_D is derived from Z_TEST on the org levels EKGRP,KOART,GSBER,WERKS.
2>I have run Org Synchronization Job in the ERM
3>Downloaded Z_TEST (Parent Role) and uploaded it into ERM(It was easy because there was no org file)
4> Downloaded Z_TEST_D(Derived Role) through /VIRSA/RE_DNLDROLES Tcode in backend.
5>Downloaded the AGR_1252 information for this role which contained the Org levels and values
6>I put all those information into the Org File and then tried to upload it throws me the error Role Z_TEST_D : not imported; unable to determine matching org. level for WERKSin the system
So I again tried with the another method by changing the input sheet for the Org File
Z_TEST_D BUKRS 0* 9*
Z_TEST_D EKGRP *
Z_TEST_D KOART *
Z_TEST_D GSBER *
Z_TEST_D WERKS *
and tried to upload it again gave me the same error. I have checked the ERM all these Org Levels are fetched into the ERM. I am not sure if I am missing any basic things.
Current Support pack: SP10 Hot Fix 2.
Please share your experience and best practice to upload the roles,

Hello Rahul,
I had that same problem with SP10 also. The way I resolved itand this sounds crazywas to move that WERKS line up one or two rows.
The problem I noticed was not with all derived roles, but when there was a problem, it was always the last line of the Org file for the role that was causing the problem. And the problem was not always WERKS either.
If the next time you run it, the error occurs on the "new" last line (e.g. GSBER), move that line up also. Eventually they all make it in. I have not seen this problem repeated in SP12. Don't delete the line, just shift the order within the number of rows the role has.
P.S. I have several hundred derived roles, about 10 - 15% had this import problem.
-Dylan

Error uploading role in GRC CUP5.2

Hello,
I have uploaded role in GRC CUP5.2 for 1 system sucessfully,but when i try to upload for another system it says 0 object uploaded sucessfully out of 50.
Moreover i tried creating role munally,it does. again i tired to upload by dleting all except 1 role,it should show me 0 object uploaded sucessfully out of1,but mesage remain the same 0 object uploaded sucessfully out of 50.
Please advice
Thanks,
Prasant

Prasant,
It should say 0 out of 1 imported. Did you save and close the file before importing? Paste the error log here so we can further analyze the issue.
Regards,
Alpesh

Role Import to ERM

Hellow Eperts,
I imported roles to the ERM from SAP ECC, SRM, CRM, BW systems.
When I searched for the roles in the ERM system, all the roles where at the "Derive roles" level instead of "approval" level (or being comleted).
Do you know why did it happen?
Thank you,
Shira Tzur

Hello Rahul,
I had that same problem with SP10 also. The way I resolved itand this sounds crazywas to move that WERKS line up one or two rows.
The problem I noticed was not with all derived roles, but when there was a problem, it was always the last line of the Org file for the role that was causing the problem. And the problem was not always WERKS either.
If the next time you run it, the error occurs on the "new" last line (e.g. GSBER), move that line up also. Eventually they all make it in. I have not seen this problem repeated in SP12. Don't delete the line, just shift the order within the number of rows the role has.
P.S. I have several hundred derived roles, about 10 - 15% had this import problem.
-Dylan

Deletion of mass roles from GRC CUP 5.3

Dear All,
I have requirement to delete 1000 roles from GRC CUP 5.3.
I can see option to delete the roles individually under "search role" option but I am not able to find option to delete mass roles.
Please advice.
Regards
Trinadh Bokka

Hello Trinadh,
It is not possible to delete all the roles at once through the User Interface. However, you can select a lot of roles at the same time by searching for a role pattern. For example, retrieve all roles starting with Z*:
Hope it helps,
Fernando

Received an error "Unhandled error; n/a in GRC ERM 53 GRCPINW and GRCPIERP

I had an issue in GRC ERM 5.3. I could search for a transaction but if I tried to add it, the transaction screen was empty, although we did receive an error "Unhandled error; n/a" which was displayed at the top of the screen.
I got reply from Basis team saying like
Case Solution :
notes can not be implemented:
1441463 - already implemented (SP05)
1514051 - can not be implemented (only for VIRRE / not available in YRS)
1443612 - already implemented (SP12)
1452772 - already implemented (SP12)
no action done
And Basis team installed GRCPINW and GRCPIERP SP6 components in My backend system last two months back.
Can you please suggest me , Is still Require VIRSAHR and VIRSANH componets for use GRC ERM5.3 if still having GRCPINW adn GRCPIERP SP6 components
And one more thing is Can i ask to basis team to implement 1514051 note into backend system.?
Thanks and Regards,
S. Nagaraju,
09741517935

Hello,
Maybe I'm not getting your point, but you said you installed GRCPINW and GRCPIERP. Are you using GRC10 ???
Are you planing to upgrade to GRC10? in this case, you might want to check here Note 1590030 - GRC10 Plug-in & 5.3 VIRSA Plug-in (RTA) Co-Existence.
And... what's your SAP_BASIS release and SP?
Cheers,
Diego.

GRC ERM mass maintenance

Hi All
Would mass Role name changes of roles possible in ERM by mass maintenance option?
Please suggest how the roles names changes possible.
Thanks & Regards
Abhijeet

Sorry to say Abhijeet, But this may not be feasible. But if you really need to change the role names for some roles, you can utilize the Copy Role functionality in ERM under Search Roles and you can copy the earlier roles into new roles with changed role names. This will reduce some of your efforts in role and authorization definition for the roles.
If the former roles are not generated in backend system then you can delete the same from ERM and maintain the audit history for those roles which have been deleted in this process.
All the Best,
Aman

Role created in ERM is not appearing in CUP request for assignment-GRC 10.0

Hi,
We are on GRC 10.0 - SP5
We have created a role in ERM and it was succesfully created in backend system. However when we tried to assign the same role using CUP request - the role is not appearing.
1) Do we need to upload roles for CUP in GRC 10.0 (similar to 5.3) to populate. Will the role doesnot automatically appears in GRC database for CUP as it is created through ERM?
2) If the roles are imported in ERM with role owner information, does the same reflects for CUP also for role owner approver assignments?
Thanks and Best Regards,
Srihari.K

Hi Sri,
Is the role status set to "production" ??
Cheers,
Diego.

GRC-AC v5.3 SP11 CUP Role Import format issues

Hi All!
Version: GRC-SAC-SAE 5.3_11.0 ( Build ID:05020110 )
Has anyone installed SP11 and found that the CUP Role Export format and Import format no longer match....by a long shot. Also, even you conform your export file with changes to the restrictive import file format, it still does not make any changes.
Has anyone seen this issue? Has anyone resolved this issue?
Much thanks!
John Stephens

Alpesh,
SP11 is only in our development system and you cannot look into certain functionality before you get in installed, except to look over current SAP Notes, SAP SP Release Notes and SAP SDN Forum posts for any current issues.
We are moving from SP8.1 to SP11 since it will solve 12 open SAP Msgs for our SAP GRC-AC system. It has solved 90% of those and has been performing well in tests so far.
We have sent this issue to SAP Support and it is a new issue that has not been reported before.
-john

Issue to add t-codes & functions in ERM role request GRC 10.0 - SP 5

Hi
We are on SAP GRC 10.0 - SP5. We are facing a strange issue while creating a Role request.
After Defining the role, we are unable to add actions and there is no option of add/delete.
Similarly while adding Functions, we are getting an error of Function module doesnot exist.
On SP5 we could able to add t-codes successfully. Is this an issue with SP5.
Thanks and Best Regards,
Srihari.K

Hi Diego,
We applied the SAP Note. Now we could able to add the function from RAR rule set to a role. But this is brining all the t-codes in the function.
We could not able to add the Actions directly into the role while defining. There is no add button appearing in Action edit screen where we can add t-codes to the role manually.
We are on GRC 10.0 - SP5. Does anybody has this issue and got it resolved?
Thanks and Best Regards,
Srihari.K

SAP GRC - ERM - Role update issue - Business Process and Subprocess

Hello Friends:
We are NOT currently maintaining Business processes or sub processes in GRC 5.3 for all roles. We don't want to maintain them in GRC 10 when we upload the roles. These 2 fields are Mandatory in GRC 10.0 - Can we make them NOT mandatory and leave them blank?? Currently we are facing some issues in uploading the roles
Please advise.
Regards
Ashish

Dear Ameet:
I just dislike the idea where SAP has made options for Business Process and Subprocess columns mandatory in uploading the roles as well from backend.
I am NOT using BRM, but still need to upload the roles for SAP to recognize them to be assigned to the users in GRC 10.0
I was facing the issues in uploading the roles initially, but now i have made it simple - just assign all the roles without the information of being FI or SD or Mm - to IT00 business process and sub process. So, all the roles are now uploaded to the system. I was just curious to know if they can me made Non-mandatory field by any settings.
But anyways, thanks for your input.
Regards
Ashish Desai

Roles in GRC ERM 5.3 (SP11)

Similar Messages

Maybe you are looking for