Lesson 2 of 5
Access requests
9 min
Listen to this lesson
Access request management replaces emails and spreadsheets with a governed path: a user or manager requests access, the right people approve it with the risk visible to them, and the system provisions it, leaving a complete audit trail. SAP describes a self-service portal, workflow-driven provisioning and deprovisioning, and risk analysis with a check of the mitigating control catalog before access is granted.
The life of a request
- SubmitAna's manager requests the AP clerk role for company code 1810 to cover a colleague, with a business reason and end date.
- Manager approvalThe line manager confirms the business need.
- Role owner approvalThe AP role owner confirms the role fits the job.
- Risk analysisThe request is analyzed with Ana's existing roles; any conflict is shown to the approver.
- Risk decisionIf a conflict appears, the risk owner remediates or assigns a mitigating control.
- ProvisionAccess Control assigns the role in CMP and records the result; the end date is respected.
The path is configured, not fixed. MSMP lets one request take different paths depending on its content: a request for a display role might need only manager approval, while a request for a role in the finance process with a high risk needs the role owner and the risk owner too. BRFplus rules find the right approvers, for example the role owner stored with the role, or the manager from the user's organizational data.
Risk analysis inside the request
The key preventive control is analyzing the request together with the user's existing access before approval. The approver sees whether adding the role creates a conflict, and can reject, change the request, or route it for mitigation. Typical configuration makes risk analysis mandatory at a stage, so approvers cannot skip it. This is the operational version of the preventive design from the SoD course: conflicts are decided before access exists, not discovered in the next review.
| Request type | Example at Contoso | Typical controls |
|---|---|---|
| New account | New AP clerk joins Contoso Parts Distribution | Manager and role owner approval; risk analysis; account and roles provisioned |
| Change account | Ana covers 1810 for two weeks | Approval by role owner; risk analysis with existing roles; end date |
| Lock or remove | A leaver's account in CMP | Triggered by HR or the manager; executed without delay |
| Role removal | Mover no longer needs the buyer role | Manager confirmation; removal provisioned |
Common request types. The exact list and names depend on configuration.
Provisioning and its evidence
After the last approval, Access Control can create the user master record and assign roles automatically in the target system, or hand off to an identity management system. Automatic provisioning removes a manual step where errors and shortcuts creep in, such as an administrator adding an extra role "while they're at it". The request record then holds the whole story: who asked, why, who approved, what risk was shown and how it was handled, and when access was provisioned.
| Aspect | Email-based requests (Contoso's ECC years) | Access request management |
|---|---|---|
| Approver sees risk | Rarely; the security team checks later, if at all | Yes, before approving |
| Who provisions | An administrator, by hand | The system, exactly what was approved |
| End dates | Forgotten | Stored and enforced |
| Audit evidence | Scattered emails | One request record with full history |
What would you do?
A request to give Ana the supplier master role in CMP, in addition to her AP clerk role, reaches the role owner. The risk analysis shows P001 (maintain supplier and process payments) as a new high risk. The manager's justification says "backup for master data team during vacations". What should the role owner do?
- Access requests run through configurable MSMP paths with BRFplus-determined approvers.
- Risk analysis with the user's existing access happens before approval, and can be made mandatory.
- Conflicts are remediated or routed to risk owners for mitigation before provisioning.
- Automatic provisioning grants exactly what was approved and records the full history.
- End dates for temporary access are stored and enforced.
Check your understanding · not graded
Lesson check
1. What is the main preventive value of risk analysis inside an access request?
2. How can one MSMP workflow treat a display-role request differently from a high-risk finance role request?
3. Why is automatic provisioning a control improvement over manual administration?
4. Ana's temporary access to company code 1810 should last two weeks. What makes sure it ends?