Integrating SailPoint with SAP GRC

Revised Date: 18 December 2024

Note
This is an integration and requires additional licensing or subscriptions to utilize it. For more information, contact your customer success manager.

Note

IdentityIQ connector information is now available as online help and PDF. The online help describes the latest updates for the connector.

To find documents related to a specific version of IdentityIQ, refer to the Supported Connectors for IdentityIQ page on Compass.

Configuration details for connectors may vary not only by release version but also by patch version. Be sure to refer to the correct documentation for your specific release and patch level.

This document is designed to provide the information required to configure a working instance of a SAP GRC connector for SailPoint. This connector supports:

This integration is used to leverage SAP GRC's ability to perform SOD (Separation of Duties) checks and take remediation or mitigation decisions within the SAP GRC. The mitigation decision must be taken in SAP GRC so that SAP GRC is aware of the mitigation controls, which are applied on risks, and would not report these risks until the time mitigation is applicable.

The SAP GRC connector enables checking for risk in the request placed in IdentityIQ (containing SAP Direct Roles and Profiles) using the following method:

  1. Request is sent to SAP GRC for proactive check.

  2. ARA Web Service checks for risk present in the request, if no risk is returned then IdentityIQ continues provisioning the request.

  3. If ARA Web Service returns a risk in the request, then a corresponding request is created in SAP GRC using the ARM Web Service.

  4. IdentityIQ continues polling the request until a response issued by SAP GRC.

  5. On the basis of the response returned in the previous step (approval or rejection by SAP GRC), IdentityIQ continues with provisioning or rejects the request.

This integration is used to aggregate all the Users and Roles from the systems (SAP SCM, JAVA, SAP ERP HCM, and so on) connected to SAP GRC and facilitates their provisioning by creating requests in GRC irrespective if there is risk present or not, as illustrated in the following figure:

The figure explains the following methods:

  1. User Aggregated from the GRC connected system.

  2. Roles Aggregated from the GRC connected system.

  3. Request sent for adding or removing access to the connected system.

  4. Access Request ID created in GRC.

  5. Requests wait and are queued until a response is issued by SAP GRC.

  6. On the basis of the response returned from SAP GRC (approval or rejection in GRC ), SAP GRC provisions or rejects the request and the corresponding status is maintained in the SAP GRC source.

The Risk Management Integration performs risk analysis which helps to find whether the requested access has violations on IdentityIQ. When a Risk Management mode is selected, only the Access Risk Analysis (ARA) module is required as compared to the Risk Analysis mode, where both the Access Risk Analysis(ARA) and the Access Request Management (ARM) modules were required. In the Access Risk Analysis and Access Request Management modules integration, when the end user requests access from IdentityIQ the request goes though IdentityIQ approvals. Once it is approved on the IdentityIQ side, it goes to SAP GRC for a risk analysis check. If a violation is shown, the integration creates a request in the SAP GRC ARM for further processing. If no risk is found, the request goes ahead for provisioning the access. In the Risk Management Integration, whenever a new access request is raised it goes to the SAP GRC ARA module for risk analysis. If the requested access has any violations, a policy violation message is raised on IdentityIQ before creating the access request ticket in IdentityIQ . The requester will receive an option to remove risky entitlements, and the approver can also view the violations before approving or denying the access.

  • Includes seamless integration with SAP ARA Service, enabling robust SOD Checks and Risk Analysis through GRC. This enhancement allows managers in IdentityIQ to view and address potential risks before submitting provisioning requests. Identified risks are displayed as Policy Violations, empowering managers to take proactive measures or engage with relevant stakeholders such as Requesters, Role Owners, and Risk Owners.

  • Integrates with SAP IAG, using the SAP GRC system as a bridge. This configuration helps you request user and entitlement provisioning, remove user access, and perform risk analysis of user requests in IAG for connected SAP Cloud systems.

  • Features a streamlined connection with the SAP ARA Service, facilitating comprehensive Segregation of Duties (SoD) checks and risk analysis through the GRC platform. This improvement enables IdentityIQ managers to identify and correct potential risks proactively before submitting provisioning requests directly via GRC integration. Risks that are identified are marked as Policy Violations, equipping managers with the insights needed to take proactive action or collaborate with key stakeholders, including Requesters, Role Owners, and Risk Owners.