This page contains: Hide
Emergency Access allows appropriate users to quickly and safely assign roles to themselves for emergency activities. This functionality is designed to assist in situations where a user may briefly require additional access to perform certain tasks in the ERP system. A user can request new access for the time period specified, document the request, and ensure that access is either automatically revoked at the pre-defined time or manually revoked before the pre-defined time.
Emergency Access requests can also be created for SAP CUA managed clients.
Before users can avail of the Emergency Access functionality, the following must be ensured:
Users must be SAP users and must have valid credentials to sign into IRC.
Users must present in the connection for which access is requested.
The connection must be configured for automatic request completion.
To create an emergency access request, users including users assigned the Administrator role, must be assigned the Emergency Access User role. This role is added to collection of pre-shipped IRC roles when Access Manager is installed. It governs users who are allowed emergency access, thereby allowing organizations to securely allow or restrict access to the functionality on a user-to-user basis.
A set of functional areas with Role or Company Code as a leaf sub-functional area should be defined as Emergency Access Functional Areas. Once a functional area hierarchy has been marked for emergency access, it will only be used for emergency access and will not be considered for the approval process.
Note: To extract user activities performed during Emergency Access role assignments, select the following objects while scheduling an extraction for the User Activity Insight for SAP:
The object ‘Access Manager’ to extract user activity details, including old/new values.
The objects ‘HRInfyLine’ and ‘HRInfyHeader’ to extract user activities performed on SAP HR data
Emergency Access functionality allows IRC Administrators or Emergency Access Users to self assign roles that are not assigned to them.
To create an emergency access type of request:
Provide a name for the request.
Select the connection in which the emergency
access role is to be assigned. To select a connection, type in a part
of the connection name in the autosuggest text box. All connections
matching the search criteria are displayed. Select the required connection.
Alternatively, browse and select the required connection.
Note: Connections are listed only if they meet the following conditions:
Select the roles to be self-assigned. To select roles, type in a part of the role name in the autosuggest text box. All roles from the selected connection and matching the search criteria are displayed. Select the required roles. Alternatively, browse and select the required roles and click OK. The selected roles appear on the New Roles to be Assigned panel.
In the New Roles to be Assigned panel, the Valid From column displays Request Creation Time. This column is updated with the time when the request is submitted.
The roles that can be self-assigned must be defined through functional areas. To view roles from specific functional areas, select the option Roles by Functional Area from the drop-down list at the top left of the Roles Names and Description browse window.
Note: While an SAP extraction is in progress, the selected roles are not displayed on the New Roles to be Assigned panel. You need to configure the settings in the PostExtractSPConfig.xml file, to view these roles.
For details, refer to the SAP - Configuration Settings Guide..
Set the validity dates for the role by clicking the Valid from and Valid through links. The emergency access assignment period can be configured through the Emergency Access option of the Access Management page (Settings -> Configuration -> Access Management -> Approval Options ->Emergency Access ). The validity time selected here is the local user time. Ensure that the local time zone is set on the Preferences page.
Add comments to explain the reason for this role assignment, if required.
Click Send. The request appears on the Requests History page. After the request is approved, it appears on the Requests page. Click the emergency access request link on the Requests page or on the Requests History page to view the request details. You cannot take any action from this page.
Emergency Access requests do not undergo analysis and also require no action to be taken on them as the completion of the request is always set to 'automatic' on the default template for this type of request. Therefore, once an Emergency Access request is created, the request is documented as self-approved.
For each emergency access request, IRC creates a revocation request to automatically revoke the role after its validity expires. However, request creators can also manually revoke requests even before the validity period lapses.
The revocation request is visible on the Requests home page until it is complete. After completion it is visible on the History tab on the Requests home page. It is also visible in the SAP Emergency Access Activity Report. Only request creators and system administrators can view the revocation request for emergency role assignment on the Requests home page and revoke it manually in either of the following ways:
By opening the request and clicking the Force Submit button at the bottom of the request details page.
By clicking the Quick Process arrow next to the request on the Requests home page.
After the request is revoked, both the History page and the email notification sent out display the message that the request was forcibly revoked.
Emergency Access requests for CUA clients can be created as above, except for the following details:
New Roles to be Assigned panel
