SAP GRC Access Control: Global Ruleset is gone!

[reza_ahoui2]

Hi

I read somewhere that all BC sets related to rule set (t-code SCPR20), once activated will be automatically combined into the “Global” rule set, which seems to be the default rule set by SAP. For some reason, we don't have any rule set by that name (we have one with a different name).

1) what would happen if we activate a BC?"

2) how can we have Global rule set back?

Thanks

Reza Ahoui

[tsarav23]

Masters, any custom / global ruleset for GRC Access Control for IS Oil? Please share the details.

[former_member516460]

Hi Reza,

were you able to achieve by getting the Global Ruleset back.

Thanks and Regards,

Naga.

[reza_ahoui2]

Hi Colleen

Thanks for your advice

I prefer to have GLOBAL rule set in addition to our own custom rule set. This would act as an out-of-box SAP rule set (a reference). After all, every time there is an update by SAP for its rule set (through a support pack) we could have it implemented in GLOBAL rule set, see it and then decide if we would like to replicate it to our own custom rule set.

In regards to your suggestion on how to re-establish the GLOBAL rule set, when we create GLOBAL rule set manually:

1- does it matter we choose Append or Override when uploading?

2- should the system be "SAP_R3_LG" when uploading?

Nevertheless, if I understood your proposal correctly, it is still a copy of our custom rule set but we need it to be an out-of-box SAP rule set. Therefore, if we reactivate the BCs would that completely flush out the existing GLOBAL rule set contents and replace it with SAP's?

How about uploading a blank content from our custom rule set as GLOBAL and then reactivating the 9 BCs (

GRAC_RA_RULESET_COMMON + GRAC_RA_RULESET_SAP_*)?

Thanks

Reza

[Colleen]

HI Reza

The GLOBAL ruleset value being gone seems like a deliberate action if you have a custom value. And that's okay

Activating BC set is like any other - when you do it you have to choose the processing option as to whether it's appending or replacing

In relation to GLOBAL - the ruleset object definition is the code and description. The mapping of the ruleset to access risk is against the access risk master data definitions.

To re-establish GLOBAL, you can create the entry and then export your ruleset. Copy all entries in your access risk to custom ruleset mapping and put GLOBAL. Upload the ruleset and you're sorted. When you look at the Access Risk Ruleset tabs, you will see your custom ruleset as well sa GLOBAL.

If this was a deliberate decision, does it matter that you don't have a global value? Good change config parameter for default ruleset is also the custom value.