Identity Manager 9.0 LTS - Administration Guide for the SAP R/3 Compliance Add-on

General main data of a function definition Function definition overview Creating authorization definitions in the Authorization Editor Checking authorization objects for completeness Authorization overview Creating working copi Enabling working copies Exporting function definitions Exporting working copies Assigning mitigating controls to SAP functions

Assigning mitigating controls to a function definition Creating mitigating controls for SAP functions

Defining function instances

Main data for a function instance Function instance overview Checking field variable definitions

Adding variable set for authorization objects

Main data for a variable set Variable set overview Copying variable sets Adding variables used in SAP functions

Exporting function definitions Importing function definitions

Compliance rules for SAP functions

Rule conditions for SAP functions More rule violation reports Mitigating controls for compliance rules with SAP functions

Mitigating controls for SAP functions

Entering main data for mitigating controls Mitigating controls overview Assigning function definitions to mitigating controls Calculating mitigating controls for SAP functions

Configuration parameters for SAP functions Default project template for the SAP R/3 Compliance Add-on Module Referenced SAP R/3 tables and BAPI calls

Assigning mitigating controls to a function definition

To assign mitigating controls to a function definition

In the Manager, select the Identity Audit > SAP functions > Function definition working copies category.
Select the working copy in the result list.
Select the Assign mitigating controls task.

In the Add assignments pane, assign the mitigating controls.
TIP: In the Remove assignments pane, you can remove mitigating control assignments.

To remove an assignment
- Select the mitigating control and double-click .
Save the changes.

Creating mitigating controls for SAP functions

To create a mitigating control for SAP functions

In the Manager, select the Identity Audit > SAP functions > Function definition working copies category.
Select a working copy in the result list.
Select the Assign mitigating controls task.
Select the Create mitigating controls task.
Enter the main data of the mitigating control.
Save the changes.
Select the Assign function definitions task.
In the Add assignments pane, double-click the function definitions you want to assign.
Save the changes.

Detailed information about this topic

Mitigating controls for SAP functions

Defining function instances

One and the same function definition can be used for different concrete instances. A specific SAP client that the SAP function will be used in is given in the function instance. In addition, the variables that are assigned to the authorization fields are given specific values. Function instances can only be created for SAP functions that are enabled.

To create or edit a function instance

In the Manager, select the Identity Audit > SAP functions > Function instances category.
In the result list, select a function instance and run the Change main data task.

- OR -

Click in the result list.
Edit the function instance's main data.
Save the changes.

NOTE: One Identity Manager users with the Identity & Access Governance | Identity Audit | Maintain SAP functions application role can create and edit function instances for the SAP functions if they are listed as the manager.

Detailed information about this topic

Main data for a function instance

Enter the following main data of a function instance:

Table 16: Function instance properties
Property	Description
Function definition	The function instance is created for this function definition.
Client	SAP client to which the SAP function should be applied.
Variable set	Variable set with functions defined, which are used in the function definition. The variable set and the function instance must be assigned to the same SAP client.
Manager/supervisor	Application role whose members are responsible for the function instance and variable sets in terms of content. To create a new application role, click . Enter the application role name and assign a parent application role.
Display name	Function instance display name. This is formatted from the function definition name, the assigned client and variable set.
Description	Text field for additional explanation. The function definition description is copied to a new function instance.
Function Instance Elements	Displays SAP applications, approval objects, and function elements of the SAP function with specified values that are determined from the assigned variable set. Changes to the variables or variable set are displayed as soon as the DBQueue Processor has processed the corresponding authorization tasks.

Please select your product:

To serve you better, please complete the Purpose of your Chat:

Recommended Solutions for Your Problem

Identity Manager 9.0 LTS - Administration Guide for the SAP R/3 Compliance Add-on

Assigning mitigating controls to a function definition

Creating mitigating controls for SAP functions

Detailed information about this topic

Defining function instances

Detailed information about this topic

Main data for a function instance

Related topics