Configuring Business Role Management

Role Definition starts with determining the values for each attribute. You can configure the role attributes whose values you specified when defining the role. During the configuration, you determine values for each attribute and then assign or input the defined attributes when you create a role. This includes attributes, such as:

• Role type
• Role name (naming rules)
• Business process
• Business subprocess
• Project release
• Role sensitivity
• Criticality level
• Functional areas
• Companies
• Custom fields
• Role prerequisites

In addition to mandatory fields, there are also optional attributes, which you can configure.

SAP Access Control comes with various configuration options. You can access them in the transaction SPRO under Governance, Risk and Compliance → Access Control → Role Management.

Based on various configuration functionalities, you can, for example:

• Deactivate role types.
• Specify the maximum length of a role name for role type per application type.
• Specify naming conventions.
• Manage project and product release names.
• Define role sensitivity.
• Specify critical levels.

Naming conventions are created to enforce role and profile naming standards during the role creation process. They are specific to a system landscape and role type. You can define naming conventions for each landscape and role type. You can do the customizing activity by using the transaction SPRO.

Organizational Value Mapping is the hierarchical structuring of organizational values and is used for role derivation. It allows you to restrict user access by organizational area by mapping roles to different organizational levels. You can name the mappings and select them when deriving a role in the role creation process.

For example, the location in Europe has different plants than the location in North America. With organizational level mapping, you can create two different Org. Value Mappings, each consisting of the primary value company code (Europe and North America respectively). Then, you define the corresponding child values (plants) for each of the maps to complete your map.

Before creating an organizational value map, you must perform a background job to import existing organizational fields and values from your back end system. In addition, you must create a background job to schedule periodic synchronization to keep the information updated.

You can create an organizational value map with a primary organizational level and value. Business Role Management uses this to store and search for the organizational value. You can create multiple maps for the same primary organizational level and value combination. Once set, you can define values for all child organizational levels to complete the organizational value map.