Access Request Creation - Role or System Required at Creation

[Rich_Turnquist]

Hi - We are installing GRC 10.1 SP6.  When I create a request it is forcing me to include at least one system or role.  Is there a system setting that I'm missing to not enforce the requirmenet to add either a system or a role at the time you create a request?

This is not a huge deal to me as I created templates that include the systems we provision to by default.  However, if I don't need to include a system or role at time of request creation I would prefer that this requirement be turned off.

Thanks,

Rich

[alessandr0]

Hi Richard,

additionally to what Colleen has already mentioned you can set up the provisioning configuration in the way that you don't have to select a system in the access request. So basically a requests requires either a system or a role. Most of the time (best practice) users select a role without a system. Personally I also recommend that way as the system comes with the role automatically.

In the global provisioning configuration (SPRO > AC > User Provisioning > Maintain Provisioning Settings) you have to define that the user gets created when the role gets assigned.

Alternatively, as you would like to remove both, you can check if it is workable via the request type settings. I don't have a system to test, but you might be lucky. Remove the "Assign object" action from the request type and check if it is still mandatory to add at least one assignment.

SPRO > GRC > AC > User Provisionign > Define Request Type

Please let me know  if this helps.

Regards,

Alessandro

[Rich_Turnquist]

Thank you Colleen and Alessandro.

The security team assigns the roles by us and we rely on a form attached to the request.  We have several data points not maintained in a role that need to be maintained based on the role requested.

Alessandro - To give it a try, I removed all actions from one of our request types just to check and it was still asking me to include at least one system or role.  Even if it did work, I still would require those actions be in the request type as we do provision roles.

Not a major deal for us as this was the same in 5.3.  I just wanted to see if there was a setting I may have missed.

Thanks,

Rich

[Colleen]

Hi Richard

I was under the impression you would need to define one so GRC knows what the request is for. In choosing a role you and indirectly choosing a system (or both at the same time).

You could have a look at the EUP settings to see if anything can be handled there. I can't comment further as I'm not on 10.1 version

Regards

Colleen