Skip to Content

GRC ARM - Business Roles not being provisioned

Hello Experts,

We are using Business Roles in order to provision a Production request in both Production and QA environments. We are currently in UAT and the Business Roles should be provisioned similarly in a QA client and in a DEV client.

However, at the end of the request, the provisioning doesn't happen, Audit Log says "no assignments available for provisioning" and the Provisioning Log is empty.

This was tested successfully using 2 DEV clients and, in QA, the request to assign the technical roles directly also works.

In NWBC > Access Management > Role Maintenance, we can see that the Business Role is correct, the technical role assigned to it is also correct and the technical role is linked to the right technical group, which contains the 2 connectors (QA and DEV).

Any suggestions on what to check would be truly appreciated.

Thank you.

Add comment
10|10000 characters needed characters exceeded

  • Get RSS Feed

4 Answers

  • Feb 23, 2017 at 08:09 PM

    Gustavo,

    did you check if the provisioning environment is correctly maintained? Also the roles must exist in the target system and synced properly into GRC. Both status "Role Exists" and "Allow Provisioning" must be set to yes, otherwise the provisioning won't happen.

    Regards, Alessandro

    Add comment
    10|10000 characters needed characters exceeded

    • Hello Gustavo.

      I believe what Alessandro asked you to check about "provisioning environment" is if your backend system is linked to the PROV integration scenario at SPRO > GRC > Common Component Settings > Integration Framework > Maintain Connection Settings.

      Regards,

      Marcelo

  • avatar image
    Former Member
    Feb 24, 2017 at 06:38 PM

    We are having the same issue in our GRC QA environment, Business role provisioning works just fine in Dev, also provisioning of technical roles work, however business role provisioing fails with "No Assignments Available for provisioning"

    Add comment
    10|10000 characters needed characters exceeded

    • Hi Chris,

      Please see the answer for SAP below. So, for us, it was 'working' in DEV because we had only one landscape. Once we moved to QA, we started testing the real scenario and things fell apart.

      Hope this helps you. If it doesn't, the best is to get SAP to connect to your system and have a live screensharing with them.

      Cheers,
      Gustavo

  • Feb 19, 2017 at 10:59 AM

    Hi,

    it seems there is missing inf. in import of the 2 technical roles. Could you ensure that, these technical roles have 'Allow auto-provisioning' as 'Yes'

    Regards

    Plaban

    Add comment
    10|10000 characters needed characters exceeded

  • Mar 02, 2017 at 10:10 PM

    Ok. We've got a reply from SAP:

    Business Roles cannot have the same name for 2 different landspaces.

    To fix the issue, we added the Production client number in the technical name (in the middle, because our naming convention sets the Org Level in the end and that's used for our search).

    No impact on Composite Roles!

    Unfortunately that's not documented anywhere we could find. SAP says it is very specific to our case (same role in different Production clients), so they won't release an information note - which would have saved us a week of pointless investigation :(

    Thanks everyone for extending a helping hand anyway.

    Cheers,
    Gustavo

    Add comment
    10|10000 characters needed characters exceeded