SAP Access Control: Access Requests, Emergency Access and Reviews

Keep this: job aid

SAP Access Control operations card

• Five areas: risk analysis, access requests, role management, emergency access, access reviews.
• Requests: MSMP path chosen by BRFplus rules; mandatory risk analysis before approval; provision exactly what was approved.
• Conflicts in requests go to risk owners: remediate or assign a valid mitigating control.
• Temporary access always has an end date.
• Emergency access: purpose-scoped IDs, short firefighter lists, independent controllers, logs reviewed against the incident.
• Repeated emergency use for the same task means a missing role.
• Reviews: business-readable roles, manageable batches, comments on kept high risks, removals provisioned and confirmed.
• Test every GRC change positive and negative; keep GRC test fixtures in CMQ.
• Monitor sync, analysis and log collection jobs; stale data means a switched-off control.