C_GRCAC: SAP Security and GRC Access Control

Security foundations

• Why SAP security matters
• Authentication versus authorisation
• The SAP authorisation concept
• Least privilege and segregation of duties
• Security in S/4HANA landscapes

User administration

• User types and their uses
• Creating and maintaining users in SU01
• Mass maintenance with SU10
• Central User Administration overview
• Password and logon parameters

• Lab: Create and maintain users of different types · 40 min

Authorisation objects

• Object classes, objects and fields
• Activities and organisational levels
• Authorisation checks in transactions
• Key transaction and table objects
• Reading the authorisation profile

• Lab: Inspect authorisation objects behind a transaction · 40 min

Role design in PFCG

• Single, composite and derived roles
• Menus and authorisation data
• Organisational levels and derivation
• Role naming and design standards
• Role transport

• Lab: Build a master role and derive roles by company code · 60 min

SU24 and troubleshooting

• SU24 proposal values
• Missing authorisation analysis with SU53
• Authorisation trace with STAUTHTRACE
• System trace overview
• Common troubleshooting patterns

• Lab: Diagnose and fix a missing authorisation · 45 min

Fiori security basics

• Fiori architecture and front-end server
• Catalogues, groups and spaces
• Back-end OData service authorisations
• Mapping Fiori apps to roles

• Lab: Assign a Fiori catalogue and back-end authorisations to a role · 40 min

GRC Access Control overview

• Components of SAP GRC Access Control
• Architecture and connectors
• Integration framework and configuration overview
• Master data: owners, business processes and organisations
• NWBC and launchpad access

Rule sets and SoD

• Rule set structure: functions, actions and permissions
• Risks and risk levels
• Segregation-of-duties and critical access rules
• Rule generation
• Rule set maintenance good practice

• Lab: Design an SoD risk for a procure-to-pay conflict · 50 min

Access Risk Analysis

• User, role and profile level analysis
• Simulation before assignment
• Mitigating controls and controllers
• Remediation approaches
• Risk reporting and dashboards

• Lab: Run risk analysis and apply a mitigating control · 45 min

Access Request Management

• Request types and access request forms
• Self-service and manager requests
• Role assignment and provisioning
• Risk analysis within requests
• Request audit trail

• Lab: Submit and approve an access request with risk analysis · 45 min

MSMP workflow

• Multi-stage, multi-path concepts
• Processes, stages and paths
• Agents and routing rules
• BRFplus rules overview
• Escalations and notifications

• Lab: Configure a two-stage approval path · 55 min

Provisioning and user data

• Provisioning settings
• User data sources
• Password self-service overview
• Background jobs and synchronisation

Emergency Access Management

• Firefighter IDs, owners and controllers
• Centralised and decentralised firefighting
• Firefighter logs and review workflow
• Reason codes and audit evidence

• Lab: Use a firefighter ID and review the activity log · 40 min

Business Role Management

• Role methodology and phases
• Role definition and maintenance
• Risk analysis during role design
• Role approval and generation

User Access Review

• Periodic review concepts
• Review request generation
• Reviewer actions and removal of access
• SoD review overview
• Reporting for auditors

• Lab: Complete a user access review cycle · 35 min

Exam readiness

• Exam topic review
• Question styles
• Practice questions with review