What is our primary use case?
The major use case for SAP Access Control is to create an end-user account, and the second purpose is to check the Separation of Duties risk and the risk on our roles and authorizations.
Having one tool to populate many systems for one user is one of the most beneficial aspects of the product, along with the audit part. When using Firefighter, we could have information about what a user modified or did in production because we sometimes have to use an SU01 transaction, so in that case, we use Firefighter. The main benefit for me is that it is a global system to manage the user in many systems, and also the assessment of risk with GRC.
What is most valuable?
Having one tool to populate many systems for one user is one of the most beneficial aspects of the product, along with the audit part. When using Firefighter, we could have information about what a user modified or did in production because we sometimes have to use an SU01 transaction, so in that case, we use Firefighter. The main benefit for me is that it is a global system to manage the user in many systems, and also the assessment of risk with GRC.
We are using Access Request to onboard people.
I see some potential improvements for stability because sometimes we do not know why the approval workflow of GRC stops in the middle. When we have a look in GRC, we see that the validation is finished, but that is not the case. Sometimes, we have to check and relaunch GRC.
It helps in risk detection.
The benefits of SAP Access Control's user permissions management are measured through the reports in GRC.
Time savings are obvious. In one request, we are able to create a user in a different system, so it is a time saving. It is a money saving as well because the access manager spends less time creating a user in a different system.
What needs improvement?
SAP Access Control is quite complex.
The complexity arises because we need a GRC specialist to set up the connection between GRC and the other system. We also spend time doing some specific configuration in GRC for the workflow. For example, to manage the workflow, we have to use BRFplus, which is not very easy to use, so this cannot be done by an end-user. We need technical people to do that, and people who know GRC well.
Because it took time to get advice on a tricky issue, the support from SAP could be better.
For how long have I used the solution?
I have been using SAP Access Control for maybe ten years already.
What do I think about the stability of the solution?
For the stability of the product, I would rate it around eight points.
I see some potential improvements for stability because sometimes we do not know why the approval workflow of GRC stops in the middle. When we have a look in GRC, we see that the validation is finished, but that is not the case. Sometimes, we have to check and relaunch GRC.
What do I think about the scalability of the solution?
As we are running GRC on-premises, I have no idea about the scalability of this product.
How are customer service and support?
Because it took time to get advice on a tricky issue, the support from SAP could be better.
I would give SAP support a rating of seven or eight.
How would you rate customer service and support?
Which solution did I use previously and why did I switch?
I have not worked with something else from another vendor. Currently, we are starting in BTP, in SAP BTP, so we are starting to use manual creation in SAP BTP, but no other solution from vendors.
What other advice do I have?
We do work with some other SAP products. We are using SAP Access Control with the GRC Access Control product.
We are also using the module for Separation of Duties and the Firefighter module.
It is a good feature, and I see a benefit from it.
I am not the one who is responsible for this risk analysis, but I know the feature. Prior to modifying a role or a right for people, we could do a test to see if we will have a risk to modify or not before we modify the role and assign the new role to the people. Also, every year or two times a year, we do a periodic control to audit the risk on people, and it is useful to manage this.
I have not heard about any small problems from my colleagues.
I have no idea about the pricing because this is included in our global SAP contract. We have an amount for the contract, and this does not detail the price of GRC in this amount.
We bought all of our SAP products from SAP.
I would rate this product eight out of ten overall.
Which deployment model are you using for this solution?
On-premises
