Non-SAP Provisioning waiting for SAP GRC Risk Analysis

IdentityIQ (IIQ) IIQ Discussion and Questions
, ,
1

We have SAP GRC integrated with SailPoint IIQ for risk analysis only. If SoD risks are identified, a GRC request is created; otherwise, no GRC request is generated.

We observed that when a user submits a single request containing:

  • SAP S/4HANA roles

  • AD groups

  • Disconnected application roles

provisioning for all requested items waits until the SAP GRC risk analysis process completes. As a result, AD groups and other non-SAP access are not provisioned immediately.

Is this expected behavior? Is there a way to allow non-SAP items to proceed with provisioning while SAP roles continue through the GRC risk analysis process?

Any guidance or best practices would be appreciated.

2

@nbidwai1987 Try enabling split provisioning in your LCM workflow and see if it works for you.