Integrating SailPoint with SAP GRC

This integration is used to leverage SAP GRC's ability to perform SOD (Separation of Duties) checks and take remediation or mitigation decisions within the SAP GRC. The mitigation decision must be taken in SAP GRC so that SAP GRC is aware of the mitigation controls, which are applied on risks, and would not report these risks until the time mitigation is applicable.

The SAP GRC connector enables checking for risk in the request placed in IdentityIQ (containing SAP Direct Roles and Profiles) using the following method:

1. Request is sent to SAP GRC for proactive check.

2. ARA Web Service checks for risk present in the request, if no risk is returned then IdentityIQ continues provisioning the request.

3. If ARA Web Service returns a risk in the request, then a corresponding request is created in SAP GRC using the ARM Web Service.

4. IdentityIQ continues polling the request until a response issued by SAP GRC.

5. On the basis of the response returned in the previous step (approval or rejection by SAP GRC), IdentityIQ continues with provisioning or rejects the request.

This integration is used to aggregate all the Users and Roles from the systems (SAP SCM, JAVA, SAP ERP HCM, and so on) connected to SAP GRC and facilitates their provisioning by creating requests in GRC irrespective if there is risk present or not, as illustrated in the following figure:

The figure explains the following methods:

1. User Aggregated from the GRC connected system.

2. Roles Aggregated from the GRC connected system.

3. Request sent for adding or removing access to the connected system.

4. Access Request ID created in GRC.

5. Requests wait and are queued until a response is issued by SAP GRC.

6. On the basis of the response returned from SAP GRC (approval or rejection in GRC ), SAP GRC provisions or rejects the request and the corresponding status is maintained in the SAP GRC source.

The Risk Management Integration performs risk analysis which helps to find whether the requested access has violations on IdentityIQ. When a Risk Management mode is selected, only the Access Risk Analysis (ARA) module is required as compared to the Risk Analysis mode, where both the Access Risk Analysis(ARA) and the Access Request Management (ARM) modules were required. In the Access Risk Analysis and Access Request Management modules integration, when the end user requests access from IdentityIQ the request goes though IdentityIQ approvals. Once it is approved on the IdentityIQ side, it goes to SAP GRC for a risk analysis check. If a violation is shown, the integration creates a request in the SAP GRC ARM for further processing. If no risk is found, the request goes ahead for provisioning the access. In the Risk Management Integration, whenever a new access request is raised it goes to the SAP GRC ARA module for risk analysis. If the requested access has any violations, a policy violation message is raised on IdentityIQ before creating the access request ticket in IdentityIQ . The requester will receive an option to remove risky entitlements, and the approver can also view the violations before approving or denying the access.

• Additional settings added on the SAP GRC Source Configuration UI for Access Request Type Mapping, Provisioning Actions for Roles and System sections for ease of configuration and maintenance.

• Supports user IDs with mixed-case and special characters, along with the support for custom delimiter characters, making it even more resilient and adaptable to a wide range of customer use cases.

• Supports Access Management Requests that are configured for Auto-Approval in the SAP GRC system.

• Supports SAP Enterprise Portal Integration.

• Allows users to update the Valid From or Valid To date when enabling or disabling an account. This feature empowers customers to streamline user de-provisioning processes, making it easier to manage scenarios such as temporary leaves of absence.

• Upgraded visibility by displaying the actual requester details for associated tickets. This valuable upgradation equips approvers with comprehensive context and specific information regarding the request's purpose and origin. Additionally, it streamlines the approval process, empowering approvers to make more informed and efficient decisions.

• Upgraded and is fully compatible with another non-ABAP system - SAP Process Orchestration.

• Enhanced functionality for modifying attributes associated with a user during the disable operation. This allows Account Disable requests to be distinguished between inactive users (leavers) and active users (leaves of absence). The upgrade also ensures a seamless clean exit process by facilitating the removal of:

  • User roles

  • Configuring specific user groups during the disable operation

  • Setting a user's end date

  • Selectively disabling the account on specified systems

  • In addition to streamlining the account management process, these advanced features provide greater flexibility and precision in handling different scenarios; ultimately enhancing the overall user experience and administrative control within the SAP GRC system.