--- title: Quanti e quali workflow definire in SAP GRC Access Control? description: SAP GRC Access Control quali workflow conviene attivare e quali sono i punti di attenzione da tenere presente? image: https://www.aglea.com/hubfs/Aglea/Imported_Blog_Media/SAP%20GRC%20Workflow-2.jpg --- [linkedin](https://www.linkedin.com/company/292350?trk=vsrp_companies_res_name&trkInfo=VSRPsearchId%3A3373431891426179412478%2CVSRPtargetId%3A292350%2CVSRPcmpt%3Aprimary) [YouTube](https://www.youtube.com/c/AgleaSAPSecurity?sub_confirmation=1) [Twitter](https://twitter.com/AgleaItaly?lang=it) [![Logo-Aglea-horsa-company](https://www.aglea.com/hubfs/Aglea/Aglea_November2018%20Theme/Images/Logo-Aglea-horsa-company.webp) ](https://www.aglea.com/) # Quanti e quali workflow definire in SAP GRC Access Control? # Quanti e quali workflow definire in SAP GRC Access Control? Posted by [Massimo Manara](https://www.aglea.com/blog/author/massimo-manara) on May 6, 2020 12:00:00 AM - [Tweet](https://twitter.com/share) Sono diversi i workflow che lo strumento mette a disposizione.   ![SAP GRC Workflow](https://www.aglea.com/hubfs/Aglea/Imported_Blog_Media/SAP%20GRC%20Workflow-2.jpg)   Alcuni di questi sono standard e non possono essere modificati, mentre altri lasciano ampio spazio di personalizzazione.   **Quali sono i punti di attenzione quando si decide quali step e quanti inserire nei vari workflow?**   Ne parliamo in questo articolo. ## Quali sono i workflow standard di SAP GRC Access Control? Tramite la transazione MSMP Multi Stage Multi Path configuration (Maintain MSMP Workflows) è possibile accedere alla configurazione di tutti i workflow presenti nel SAP GRC Access Control, ecco quali sono:   ![SAP GRC-MSMP](https://www.aglea.com/hubfs/Aglea/Imported_Blog_Media/SAP%20GRC-MSMP-2.png)   - SAP_GRAC_ACCESS_REQUEST - Rappresenta il principale workflow utilizzato nel modulo Access Request Management (ARQ) del SAP GRC. Permette di **gestire tutti gli step approvativi durante la creazione, modifica, cancellazione di una o più utenze SAP**. - SAP_GRAC_ACCESS_REQUEST_HR - Come sopra ma quanto viene utilizzata la struttura organizzativa per assegnare ruoli alle posizioni. - SAP_GRAC_CONTROL_ASGN - Questo workflow permette di gestire le **approvazioni da parte del control owner** dei controlli mitigativi, durante l'assegnamento ad utenti e ruoli. - SAP_GRAC_CONTROL_MAINT - Questo workflow permette di gestire le **approvazioni** da parte del control owner dei controlli mitigativi, per la **definizione di nuovi controlli** - SAP_GRAC_FFID_REVIEW - Permette di ri-validare i legami tra super-utenze ed utenti assegnati, usando il componente [Emergency Access Management](https://www.aglea.com/blog/per-gestire-una-super-user-in-sap-serve-sap-grc) - SAP_GRAC_FIREFIGHT_LOG_REPORT - Permette di effettuare una **approvazione** da parte dell'owner delle super utenze **dei log prodotti dalle super-utenze** (Firefighter) a lui riferite, usando il componente Emergency Access Management - SAP_GRAC_FUNC_APPR - Permette di effettuare le **approvazioni delle modifiche alle function** (della matrice dei rischi SoD), usando il componente Access Risk Analysis - SAP_GRAC_RISK_APPR - Permette di effettuare le **approvazioni delle modifiche ai rischi** (della matrice dei rischi SoD), usando il componente Access Risk Analysis - SAP_GRAC_ROLE_APPR - Permette di effettuare le **approvazioni durante la creazione o modifica dei ruoli** (usando il componente Business Role Management) - SAP_GRAC_SOD_RISK_REVIEW - Permette di effettuare una ri-validazione dei rischi SoD presenti su ogni [Risk Owner](https://www.aglea.com/blog/quali-sono-gli-owner-nellarea-governance-e-security) - SAP_GRAC_USER_ACCESS_REVIEW - Permette di effettuare una ri-validazione del legame utenti/ruoli per ogni Role Owner o Manager   ## Access Request Workflow quanti step approvativi? Sicuramente il workflow o Process ID più personalizzabile è quello delle Access Request. Questo workflow permette di definire, nel caso in cui siano create o modificate delle utenze, i passaggi approvativi che deve subire la richiesta.   **Esiste un workflow standard** che prevedere i seguenti tre step approvativi: - Manager - Role Owner - Security   Si tratta di una base pronta all'uso che ben si adatta a tutto le società. Ammesso che sia possibile far leggere i Manager al sistema [SAP GRC](https://www.aglea.com/sap-grc) (da LDAP o HR) e che siano definiti per ogni ruolo i relativi Role Owner, figura essenziale per questo genere di processi.   Ogni passaggio del workflow **può essere ulteriormente personalizzato in termini di interfaccia utente**.   Esiste infatti una funzionalità chiamata EUP (End User Personalization) che permette di definire quali campi siano visibili/modificabili per ogni approvatore.   Ad esempio il Manager potrà vedere solo i campi strettamente necessari, mentre l'ultimo attore del workflow, Security vedrà ad esempio anche campi più tecnici.   ### Ma quali considerazioni possono essere fatte? Quali sono i punti di attenzione?   1. **Non definire troppi passaggi approvativi**. Spesso le richieste, anche se con step approvativi minimali, richiedono alcuni giorni per essere approvate. Aumentando il numero di approvatori è possibile che le richieste si allunghino di molto in termini di tempo. 2. Identificare bene le responsabilità di chi fa cosa ed in che modo. Soprattutto nel caso degli Owner (Rischi, Manager, forse questo è l'owner più semplice da identificare, e Role Owner) [leggi qui l'approfondimento](https://www.aglea.com/blog/quali-sono-gli-owner-nellarea-governance-e-security). Questo può rappresentare una delle maggiori difficoltà 3. Valutare l'introduzione di una figura per il controllo della SoD in maniera preventive (nel caso in cui ci sia almeno un rischio SoD attivo, allora il workitem andrà ad una figura) ## Ma quando valutare la gestione dei workflow? Sebbene il modulo dell'Access Request Management possa essere attivato in qualsiasi momento, è utile ricordarsi alcuni aspetti importanti a mio avviso.   - L'introduzione di questo componente comporta l'attivazione dei workflow approvativi. Se nella tua organizzazione non esisteva già uno strumento formale di gestione delle richieste può essere vissuto come un allungamento in termini di tempi del processo di modifica o creazione dell'utenze. **Abituati ad avere dei processi approvativi (anche via mail) prima dell'introduzione dello strumento** - Chi deve aprire le richieste? **Tutti gli utenti in azienda o solo alcuni "focal point"**? A mio avviso la seconda opzione è sicuramente la migliore per evitare di fare formazione a chiunque e per fare un primo filtro alla creazione di richieste - Quanto conta, per chi sceglie, **la leggibilità dei ruoli caricati nello strumento**? È fondamentale, se chi deve creare le richieste non sa quali ruoli scegliere diventa uno strumento quasi inutile o che genera "rumore" senza produrre benefici, in quanto sarà sempre coinvolto l'IT per spiegare o interpretare le richieste. **L'introduzione di questi strumenti può comportare la revisione del modello autorizzativo attualmente definito in azienda.**     Topics: [sap workflow](https://www.aglea.com/blog/tag/sap-workflow), [SAP GRC](https://www.aglea.com/blog/tag/sap-grc) ### Iscriviti qui! ### Blog Aglea, cosa puoi trovare? Ogni mercoledì pubblichiamo articoli, interviste e documenti relativi alla security SAP. Cosa puoi trovare: - Suggerimenti su come mettere in sicurezza i sistemi SAP - Come fare a … (How To) - Checklist - Gli errori comuni che spesso vengono fatti in ambito Security SAP - Interviste con esperti del settore - Chi è AGLEA quale è la nostra vision security SAP ### Post recenti ### Post By Topic - [SAP Security (32)](https://www.aglea.com/blog/tag/sap-security) - [SAP GRC (24)](https://www.aglea.com/blog/tag/sap-grc) - [audit sap (22)](https://www.aglea.com/blog/tag/audit-sap) - [fiori launchpad (20)](https://www.aglea.com/blog/tag/fiori-launchpad) - [pfcg (19)](https://www.aglea.com/blog/tag/pfcg) - [authorization concept (18)](https://www.aglea.com/blog/tag/authorization-concept) - [cyber security (18)](https://www.aglea.com/blog/tag/cyber-security) - [SAP audit (17)](https://www.aglea.com/blog/tag/sap-audit) - [audit (16)](https://www.aglea.com/blog/tag/audit) - [gdpr (16)](https://www.aglea.com/blog/tag/gdpr) - [sap cyber security (16)](https://www.aglea.com/blog/tag/sap-cyber-security) - [auditing (15)](https://www.aglea.com/blog/tag/auditing) - [sap security blog (14)](https://www.aglea.com/blog/tag/sap-security-blog) - [supporto sap ams (14)](https://www.aglea.com/blog/tag/supporto-sap-ams) - [PFCG SAP transaction (13)](https://www.aglea.com/blog/tag/pfcg-sap-transaction) - [SAP Cloud (13)](https://www.aglea.com/blog/tag/sap-cloud) - [sap FIORI (13)](https://www.aglea.com/blog/tag/sap-fiori) - [libro SAP (12)](https://www.aglea.com/blog/tag/libro-sap) - [sod (12)](https://www.aglea.com/blog/tag/sod) - [SAP GDPR (11)](https://www.aglea.com/blog/tag/sap-gdpr) - [sap password (11)](https://www.aglea.com/blog/tag/sap-password) - [sap vulnerability (11)](https://www.aglea.com/blog/tag/sap-vulnerability) - [SAP cloud identity services (10)](https://www.aglea.com/blog/tag/sap-cloud-identity-services) - [Segregation of duties (10)](https://www.aglea.com/blog/tag/segregation-of-duties) - [vulnerability assessment (10)](https://www.aglea.com/blog/tag/vulnerability-assessment) - [sap btp (9)](https://www.aglea.com/blog/tag/sap-btp) - [sap license auditing (9)](https://www.aglea.com/blog/tag/sap-license-auditing) - [SAP Cloud Security (8)](https://www.aglea.com/blog/tag/sap-cloud-security) - [SAP FIORI Security (8)](https://www.aglea.com/blog/tag/sap-fiori-security) - [SAP HR (8)](https://www.aglea.com/blog/tag/sap-hr) - [consulenza sap security (8)](https://www.aglea.com/blog/tag/consulenza-sap-security) - [idm (8)](https://www.aglea.com/blog/tag/idm) - [secure coding sap (8)](https://www.aglea.com/blog/tag/secure-coding-sap) - [security audit log (8)](https://www.aglea.com/blog/tag/security-audit-log) - [siem (8)](https://www.aglea.com/blog/tag/siem) - [threat detection (8)](https://www.aglea.com/blog/tag/threat-detection) - [upgrade (8)](https://www.aglea.com/blog/tag/upgrade) - [FIORI Security (7)](https://www.aglea.com/blog/tag/fiori-security) - [S/4HANA (7)](https://www.aglea.com/blog/tag/s-4hana) - [SAP IAG (7)](https://www.aglea.com/blog/tag/sap-iag) - [SAP LOG (7)](https://www.aglea.com/blog/tag/sap-log) - [User Access Management (7)](https://www.aglea.com/blog/tag/user-access-management) - [governance (7)](https://www.aglea.com/blog/tag/governance) - [internal audit (7)](https://www.aglea.com/blog/tag/internal-audit) - [sap consulenza security (7)](https://www.aglea.com/blog/tag/sap-consulenza-security) - [sap fiori space (7)](https://www.aglea.com/blog/tag/sap-fiori-space) - [sap grc 12 (7)](https://www.aglea.com/blog/tag/sap-grc-12) - [security ams (7)](https://www.aglea.com/blog/tag/security-ams) - [su53 (7)](https://www.aglea.com/blog/tag/su53) - [HANA Security (6)](https://www.aglea.com/blog/tag/hana-security) - [SAP ECC (6)](https://www.aglea.com/blog/tag/sap-ecc) - [autorizzazioni sap (6)](https://www.aglea.com/blog/tag/autorizzazioni-sap) - [identity management system (6)](https://www.aglea.com/blog/tag/identity-management-system) - [sap patch (6)](https://www.aglea.com/blog/tag/sap-patch) - [ISO (5)](https://www.aglea.com/blog/tag/iso) - [SAP Identity and Access Governance (5)](https://www.aglea.com/blog/tag/sap-identity-and-access-governance) - [SU01 sap (5)](https://www.aglea.com/blog/tag/su01-sap) - [access management (5)](https://www.aglea.com/blog/tag/access-management) - [authorization model (5)](https://www.aglea.com/blog/tag/authorization-model) - [controlli interni (5)](https://www.aglea.com/blog/tag/controlli-interni) - [cyber security culture (5)](https://www.aglea.com/blog/tag/cyber-security-culture) - [data loss prevention (5)](https://www.aglea.com/blog/tag/data-loss-prevention) - [documentazione sap security (5)](https://www.aglea.com/blog/tag/documentazione-sap-security) - [log sap (5)](https://www.aglea.com/blog/tag/log-sap) - [oggetti autorizzativi critici (5)](https://www.aglea.com/blog/tag/oggetti-autorizzativi-critici) - [rfc security (5)](https://www.aglea.com/blog/tag/rfc-security) - [ruoli (5)](https://www.aglea.com/blog/tag/ruoli) - [sap authorization review (5)](https://www.aglea.com/blog/tag/sap-authorization-review) - [sap fue (5)](https://www.aglea.com/blog/tag/sap-fue) - [sap_all (5)](https://www.aglea.com/blog/tag/sap_all) - [securitybridge (5)](https://www.aglea.com/blog/tag/securitybridge) - [sicurezza sap (5)](https://www.aglea.com/blog/tag/sicurezza-sap) - [sviluppo codice sicuro (5)](https://www.aglea.com/blog/tag/sviluppo-codice-sicuro) - [userid (5)](https://www.aglea.com/blog/tag/userid) - [IAG (4)](https://www.aglea.com/blog/tag/iag) - [RISE with SAP (4)](https://www.aglea.com/blog/tag/rise-with-sap) - [SAP IDM (4)](https://www.aglea.com/blog/tag/sap-idm) - [aglea (4)](https://www.aglea.com/blog/tag/aglea) - [code vulnerability analysis (4)](https://www.aglea.com/blog/tag/code-vulnerability-analysis) - [data privacy (4)](https://www.aglea.com/blog/tag/data-privacy) - [fraud management (4)](https://www.aglea.com/blog/tag/fraud-management) - [itgc (4)](https://www.aglea.com/blog/tag/itgc) - [microsoft (4)](https://www.aglea.com/blog/tag/microsoft) - [patch (4)](https://www.aglea.com/blog/tag/patch) - [sap data masking (4)](https://www.aglea.com/blog/tag/sap-data-masking) - [sap gui (4)](https://www.aglea.com/blog/tag/sap-gui) - [sap gui security (4)](https://www.aglea.com/blog/tag/sap-gui-security) - [sap hana (4)](https://www.aglea.com/blog/tag/sap-hana) - [sap logon (4)](https://www.aglea.com/blog/tag/sap-logon) - [sap super user (4)](https://www.aglea.com/blog/tag/sap-super-user) - [security awareness (4)](https://www.aglea.com/blog/tag/security-awareness) - [test system (4)](https://www.aglea.com/blog/tag/test-system) - [workflow security SAP (4)](https://www.aglea.com/blog/tag/workflow-security-sap) - [AI (3)](https://www.aglea.com/blog/tag/ai) - [HANA (3)](https://www.aglea.com/blog/tag/hana) - [RISE (3)](https://www.aglea.com/blog/tag/rise) - [Risk Management (3)](https://www.aglea.com/blog/tag/risk-management) - [SAP AUDIT LOG (3)](https://www.aglea.com/blog/tag/sap-audit-log) - [SAP NOW (3)](https://www.aglea.com/blog/tag/sap-now) - [Single Sing On (3)](https://www.aglea.com/blog/tag/single-sing-on) - [UCON (3)](https://www.aglea.com/blog/tag/ucon) - [UI logging (3)](https://www.aglea.com/blog/tag/ui-logging) - [amministratore di sistema (3)](https://www.aglea.com/blog/tag/amministratore-di-sistema) - [cloud platform (3)](https://www.aglea.com/blog/tag/cloud-platform) - [consulenti (3)](https://www.aglea.com/blog/tag/consulenti) - [consulenti sap security (3)](https://www.aglea.com/blog/tag/consulenti-sap-security) - [corsi sap (3)](https://www.aglea.com/blog/tag/corsi-sap) - [crittografia SAP (3)](https://www.aglea.com/blog/tag/crittografia-sap) - [e-learning (3)](https://www.aglea.com/blog/tag/e-learning) - [emergency users (3)](https://www.aglea.com/blog/tag/emergency-users) - [formazione sap (3)](https://www.aglea.com/blog/tag/formazione-sap) - [mail security sap (3)](https://www.aglea.com/blog/tag/mail-security-sap) - [manuali sap security (3)](https://www.aglea.com/blog/tag/manuali-sap-security) - [password policy (3)](https://www.aglea.com/blog/tag/password-policy) - [process control (3)](https://www.aglea.com/blog/tag/process-control) - [process mining (3)](https://www.aglea.com/blog/tag/process-mining) - [processi security (3)](https://www.aglea.com/blog/tag/processi-security) - [profili sap (3)](https://www.aglea.com/blog/tag/profili-sap) - [reporting (3)](https://www.aglea.com/blog/tag/reporting) - [rfc (3)](https://www.aglea.com/blog/tag/rfc) - [rpa sap security (3)](https://www.aglea.com/blog/tag/rpa-sap-security) - [sap compliance (3)](https://www.aglea.com/blog/tag/sap-compliance) - [sap custom (3)](https://www.aglea.com/blog/tag/sap-custom) - [sap data obfuscation (3)](https://www.aglea.com/blog/tag/sap-data-obfuscation) - [sap dati personali (3)](https://www.aglea.com/blog/tag/sap-dati-personali) - [sap ias (3)](https://www.aglea.com/blog/tag/sap-ias) - [sap mail (3)](https://www.aglea.com/blog/tag/sap-mail) - [sap siem (3)](https://www.aglea.com/blog/tag/sap-siem) - [sap sso (3)](https://www.aglea.com/blog/tag/sap-sso) - [sap training (3)](https://www.aglea.com/blog/tag/sap-training) - [se16 (3)](https://www.aglea.com/blog/tag/se16) - [sicurezza dei dati sap (3)](https://www.aglea.com/blog/tag/sicurezza-dei-dati-sap) - [su25 (3)](https://www.aglea.com/blog/tag/su25) - [suim (3)](https://www.aglea.com/blog/tag/suim) - [ticket management system (3)](https://www.aglea.com/blog/tag/ticket-management-system) - [training (3)](https://www.aglea.com/blog/tag/training) - [transazioni sap (3)](https://www.aglea.com/blog/tag/transazioni-sap) - [zero trust security (3)](https://www.aglea.com/blog/tag/zero-trust-security) - [27001 (2)](https://www.aglea.com/blog/tag/27001) - [NIS2 (2)](https://www.aglea.com/blog/tag/nis2) - [SAP GRC Process Control (2)](https://www.aglea.com/blog/tag/sap-grc-process-control) - [SAP Gateway security (2)](https://www.aglea.com/blog/tag/sap-gateway-security) - [Trace autorizzazioni SAP (2)](https://www.aglea.com/blog/tag/trace-autorizzazioni-sap) - [UI Masking (2)](https://www.aglea.com/blog/tag/ui-masking) - [agleasapsecurity (2)](https://www.aglea.com/blog/tag/agleasapsecurity) - [ams (2)](https://www.aglea.com/blog/tag/ams) - [corso (2)](https://www.aglea.com/blog/tag/corso) - [custom (2)](https://www.aglea.com/blog/tag/custom) - [cyber security exposure (2)](https://www.aglea.com/blog/tag/cyber-security-exposure) - [epi-use (2)](https://www.aglea.com/blog/tag/epi-use) - [eventi (2)](https://www.aglea.com/blog/tag/eventi) - [gxp (2)](https://www.aglea.com/blog/tag/gxp) - [intelligenza artificiale (2)](https://www.aglea.com/blog/tag/intelligenza-artificiale) - [joule (2)](https://www.aglea.com/blog/tag/joule) - [organizzazione (2)](https://www.aglea.com/blog/tag/organizzazione) - [profili (2)](https://www.aglea.com/blog/tag/profili) - [progetti sap security (2)](https://www.aglea.com/blog/tag/progetti-sap-security) - [programmazione sicura (2)](https://www.aglea.com/blog/tag/programmazione-sicura) - [quality (2)](https://www.aglea.com/blog/tag/quality) - [quotazione borsa (2)](https://www.aglea.com/blog/tag/quotazione-borsa) - [s_tabu_dis (2)](https://www.aglea.com/blog/tag/s_tabu_dis) - [sap business role (2)](https://www.aglea.com/blog/tag/sap-business-role) - [sap catalog (2)](https://www.aglea.com/blog/tag/sap-catalog) - [sap data protection (2)](https://www.aglea.com/blog/tag/sap-data-protection) - [sap developer (2)](https://www.aglea.com/blog/tag/sap-developer) - [sap enterprise threat detection (2)](https://www.aglea.com/blog/tag/sap-enterprise-threat-detection) - [sap etd (2)](https://www.aglea.com/blog/tag/sap-etd) - [sap gxp compliance (2)](https://www.aglea.com/blog/tag/sap-gxp-compliance) - [sap ilm (2)](https://www.aglea.com/blog/tag/sap-ilm) - [sap italia (2)](https://www.aglea.com/blog/tag/sap-italia) - [sap menu (2)](https://www.aglea.com/blog/tag/sap-menu) - [sap query (2)](https://www.aglea.com/blog/tag/sap-query) - [sap router security (2)](https://www.aglea.com/blog/tag/sap-router-security) - [sap security guidelines (2)](https://www.aglea.com/blog/tag/sap-security-guidelines) - [sap security note (2)](https://www.aglea.com/blog/tag/sap-security-note) - [sap security partner (2)](https://www.aglea.com/blog/tag/sap-security-partner) - [sap security patch day (2)](https://www.aglea.com/blog/tag/sap-security-patch-day) - [sap security tools (2)](https://www.aglea.com/blog/tag/sap-security-tools) - [sap security video (2)](https://www.aglea.com/blog/tag/sap-security-video) - [sap sos (2)](https://www.aglea.com/blog/tag/sap-sos) - [sap workflow (2)](https://www.aglea.com/blog/tag/sap-workflow) - [se16n (2)](https://www.aglea.com/blog/tag/se16n) - [secure operation map (2)](https://www.aglea.com/blog/tag/secure-operation-map) - [slaw (2)](https://www.aglea.com/blog/tag/slaw) - [smartworking (2)](https://www.aglea.com/blog/tag/smartworking) - [soar (2)](https://www.aglea.com/blog/tag/soar) - [social engineering (2)](https://www.aglea.com/blog/tag/social-engineering) - [solution manager (2)](https://www.aglea.com/blog/tag/solution-manager) - [success Factors (2)](https://www.aglea.com/blog/tag/success-factors) - [super utenti sap (2)](https://www.aglea.com/blog/tag/super-utenti-sap) - [system users (2)](https://www.aglea.com/blog/tag/system-users) - [tabelle (2)](https://www.aglea.com/blog/tag/tabelle) - [trasformazione digitale (2)](https://www.aglea.com/blog/tag/trasformazione-digitale) - [usmm (2)](https://www.aglea.com/blog/tag/usmm) - [youtube aglea (2)](https://www.aglea.com/blog/tag/youtube-aglea) - [youtube sap (2)](https://www.aglea.com/blog/tag/youtube-sap) - [10bklaze (1)](https://www.aglea.com/blog/tag/10bklaze) - [20000 (1)](https://www.aglea.com/blog/tag/20000) - [312 (1)](https://www.aglea.com/blog/tag/312) - [9001 (1)](https://www.aglea.com/blog/tag/9001) - [ABAP (1)](https://www.aglea.com/blog/tag/abap) - [Barcellona (1)](https://www.aglea.com/blog/tag/barcellona) - [CIAM (1)](https://www.aglea.com/blog/tag/ciam) - [CSR (1)](https://www.aglea.com/blog/tag/csr) - [CVA (1)](https://www.aglea.com/blog/tag/cva) - [CVE-2021-44228 (1)](https://www.aglea.com/blog/tag/cve-2021-44228) - [Cloud ALM (1)](https://www.aglea.com/blog/tag/cloud-alm) - [DPO (1)](https://www.aglea.com/blog/tag/dpo) - [ERM (1)](https://www.aglea.com/blog/tag/erm) - [Enterprise risk management (1)](https://www.aglea.com/blog/tag/enterprise-risk-management) - [GROW (1)](https://www.aglea.com/blog/tag/grow) - [Gestione del rischio aziendale (1)](https://www.aglea.com/blog/tag/gestione-del-rischio-aziendale) - [HANA Roles (1)](https://www.aglea.com/blog/tag/hana-roles) - [HR Data Reporting (1)](https://www.aglea.com/blog/tag/hr-data-reporting) - [IAS (1)](https://www.aglea.com/blog/tag/ias) - [IPS (1)](https://www.aglea.com/blog/tag/ips) - [Liste distribuzione SAP (1)](https://www.aglea.com/blog/tag/liste-distribuzione-sap) - [Log4Shell SAP (1)](https://www.aglea.com/blog/tag/log4shell-sap) - [Milano (1)](https://www.aglea.com/blog/tag/milano) - [OKR (1)](https://www.aglea.com/blog/tag/okr) - [Onboarding (1)](https://www.aglea.com/blog/tag/onboarding) - [P-user (1)](https://www.aglea.com/blog/tag/p-user) - [Portale SAP note (1)](https://www.aglea.com/blog/tag/portale-sap-note) - [Privilege Access Management (1)](https://www.aglea.com/blog/tag/privilege-access-management) - [S-user (1)](https://www.aglea.com/blog/tag/s-user) - [SAP ABAC (1)](https://www.aglea.com/blog/tag/sap-abac) - [SAP Assurance and Compliance Software (1)](https://www.aglea.com/blog/tag/sap-assurance-and-compliance-software) - [SAP C4C (1)](https://www.aglea.com/blog/tag/sap-c4c) - [SAP DAM (1)](https://www.aglea.com/blog/tag/sap-dam) - [SAP DLP (1)](https://www.aglea.com/blog/tag/sap-dlp) - [SAP DRM (1)](https://www.aglea.com/blog/tag/sap-drm) - [SAP ERP cloud private (1)](https://www.aglea.com/blog/tag/sap-erp-cloud-private) - [SAP FKOM (1)](https://www.aglea.com/blog/tag/sap-fkom) - [SAP Fraud Management (1)](https://www.aglea.com/blog/tag/sap-fraud-management) - [SAP RBAC (1)](https://www.aglea.com/blog/tag/sap-rbac) - [SAP RECON (1)](https://www.aglea.com/blog/tag/sap-recon) - [SAP Sales (1)](https://www.aglea.com/blog/tag/sap-sales) - [SAP Table (1)](https://www.aglea.com/blog/tag/sap-table) - [SECURITY PATTERN ANALYSIS (1)](https://www.aglea.com/blog/tag/security-pattern-analysis) - [SLA (1)](https://www.aglea.com/blog/tag/sla) - [SOX (1)](https://www.aglea.com/blog/tag/sox) - [SPOOL (1)](https://www.aglea.com/blog/tag/spool) - [ST01 (1)](https://www.aglea.com/blog/tag/st01) - [STAUTHTRACE (1)](https://www.aglea.com/blog/tag/stauthtrace) - [Statistiche security SAP (1)](https://www.aglea.com/blog/tag/statistiche-security-sap) - [admin (1)](https://www.aglea.com/blog/tag/admin) - [aglea tribe (1)](https://www.aglea.com/blog/tag/aglea-tribe) - [analisi dei rischi (1)](https://www.aglea.com/blog/tag/analisi-dei-rischi) - [azure (1)](https://www.aglea.com/blog/tag/azure) - [backup (1)](https://www.aglea.com/blog/tag/backup) - [biolock sap (1)](https://www.aglea.com/blog/tag/biolock-sap) - [biometria (1)](https://www.aglea.com/blog/tag/biometria) - [blacklist sap (1)](https://www.aglea.com/blog/tag/blacklist-sap) - [bot (1)](https://www.aglea.com/blog/tag/bot) - [brand (1)](https://www.aglea.com/blog/tag/brand) - [certificazioni sap (1)](https://www.aglea.com/blog/tag/certificazioni-sap) - [chatGPT (1)](https://www.aglea.com/blog/tag/chatgpt) - [ciso (1)](https://www.aglea.com/blog/tag/ciso) - [cloud connector (1)](https://www.aglea.com/blog/tag/cloud-connector) - [codice sicuro SAP (1)](https://www.aglea.com/blog/tag/codice-sicuro-sap) - [compatibility packs (1)](https://www.aglea.com/blog/tag/compatibility-packs) - [continuità del servizio (1)](https://www.aglea.com/blog/tag/continuità-del-servizio) - [customization sap (1)](https://www.aglea.com/blog/tag/customization-sap) - [cyber security deception (1)](https://www.aglea.com/blog/tag/cyber-security-deception) - [data access subject request (1)](https://www.aglea.com/blog/tag/data-access-subject-request) - [data subject request gdpr (1)](https://www.aglea.com/blog/tag/data-subject-request-gdpr) - [delete user (1)](https://www.aglea.com/blog/tag/delete-user) - [developer (1)](https://www.aglea.com/blog/tag/developer) - [documentazione SAP GRC (1)](https://www.aglea.com/blog/tag/documentazione-sap-grc) - [documentazione di progetto (1)](https://www.aglea.com/blog/tag/documentazione-di-progetto) - [dsr (1)](https://www.aglea.com/blog/tag/dsr) - [dynamic authorization management (1)](https://www.aglea.com/blog/tag/dynamic-authorization-management) - [esg (1)](https://www.aglea.com/blog/tag/esg) - [esterni (1)](https://www.aglea.com/blog/tag/esterni) - [exchange rates (1)](https://www.aglea.com/blog/tag/exchange-rates) - [external users management (1)](https://www.aglea.com/blog/tag/external-users-management) - [falsi positivi (1)](https://www.aglea.com/blog/tag/falsi-positivi) - [feedback (1)](https://www.aglea.com/blog/tag/feedback) - [firefighter (1)](https://www.aglea.com/blog/tag/firefighter) - [firefighter HANA (1)](https://www.aglea.com/blog/tag/firefighter-hana) - [flash (1)](https://www.aglea.com/blog/tag/flash) - [fornitori sap (1)](https://www.aglea.com/blog/tag/fornitori-sap) - [ftp (1)](https://www.aglea.com/blog/tag/ftp) - [go-live (1)](https://www.aglea.com/blog/tag/go-live) - [grc ram (1)](https://www.aglea.com/blog/tag/grc-ram) - [handover autorizzazioni (1)](https://www.aglea.com/blog/tag/handover-autorizzazioni) - [hardening (1)](https://www.aglea.com/blog/tag/hardening) - [horsa (1)](https://www.aglea.com/blog/tag/horsa) - [integrazioni sap (1)](https://www.aglea.com/blog/tag/integrazioni-sap) - [intune (1)](https://www.aglea.com/blog/tag/intune) - [lavoro agile (1)](https://www.aglea.com/blog/tag/lavoro-agile) - [libri (1)](https://www.aglea.com/blog/tag/libri) - [malware (1)](https://www.aglea.com/blog/tag/malware) - [mandanti (1)](https://www.aglea.com/blog/tag/mandanti) - [metodologia sap activate (1)](https://www.aglea.com/blog/tag/metodologia-sap-activate) - [microsoft planner (1)](https://www.aglea.com/blog/tag/microsoft-planner) - [microsoft stream (1)](https://www.aglea.com/blog/tag/microsoft-stream) - [multicompany sap security (1)](https://www.aglea.com/blog/tag/multicompany-sap-security) - [multiple logon (1)](https://www.aglea.com/blog/tag/multiple-logon) - [naming convention (1)](https://www.aglea.com/blog/tag/naming-convention) - [nist (1)](https://www.aglea.com/blog/tag/nist) - [nuovi assunti (1)](https://www.aglea.com/blog/tag/nuovi-assunti) - [ob08 (1)](https://www.aglea.com/blog/tag/ob08) - [pa20 (1)](https://www.aglea.com/blog/tag/pa20) - [parameter sap (1)](https://www.aglea.com/blog/tag/parameter-sap) - [partner sap (1)](https://www.aglea.com/blog/tag/partner-sap) - [pfud (1)](https://www.aglea.com/blog/tag/pfud) - [podcast sap security (1)](https://www.aglea.com/blog/tag/podcast-sap-security) - [postmand sap api (1)](https://www.aglea.com/blog/tag/postmand-sap-api) - [progetti security sap (1)](https://www.aglea.com/blog/tag/progetti-security-sap) - [quantum (1)](https://www.aglea.com/blog/tag/quantum) - [remediation (1)](https://www.aglea.com/blog/tag/remediation) - [remote access (1)](https://www.aglea.com/blog/tag/remote-access) - [rfc destination (1)](https://www.aglea.com/blog/tag/rfc-destination) - [risorse umane (1)](https://www.aglea.com/blog/tag/risorse-umane) - [role transport (1)](https://www.aglea.com/blog/tag/role-transport) - [s_tabu_nam (1)](https://www.aglea.com/blog/tag/s_tabu_nam) - [s_tabu_rfc (1)](https://www.aglea.com/blog/tag/s_tabu_rfc) - [sailpoint (1)](https://www.aglea.com/blog/tag/sailpoint) - [sap TechEd (1)](https://www.aglea.com/blog/tag/sap-teched) - [sap access control (1)](https://www.aglea.com/blog/tag/sap-access-control) - [sap acronimi (1)](https://www.aglea.com/blog/tag/sap-acronimi) - [sap activate (1)](https://www.aglea.com/blog/tag/sap-activate) - [sap add on (1)](https://www.aglea.com/blog/tag/sap-add-on) - [sap antivirus (1)](https://www.aglea.com/blog/tag/sap-antivirus) - [sap asap (1)](https://www.aglea.com/blog/tag/sap-asap) - [sap assure (1)](https://www.aglea.com/blog/tag/sap-assure) - [sap backup (1)](https://www.aglea.com/blog/tag/sap-backup) - [sap bis (1)](https://www.aglea.com/blog/tag/sap-bis) - [sap business continuity (1)](https://www.aglea.com/blog/tag/sap-business-continuity) - [sap business integrity screening (1)](https://www.aglea.com/blog/tag/sap-business-integrity-screening) - [sap business partner (1)](https://www.aglea.com/blog/tag/sap-business-partner) - [sap bw (1)](https://www.aglea.com/blog/tag/sap-bw) - [sap covid (1)](https://www.aglea.com/blog/tag/sap-covid) - [sap cua (1)](https://www.aglea.com/blog/tag/sap-cua) - [sap cva (1)](https://www.aglea.com/blog/tag/sap-cva) - [sap earlywatch (1)](https://www.aglea.com/blog/tag/sap-earlywatch) - [sap frodi (1)](https://www.aglea.com/blog/tag/sap-frodi) - [sap gamification (1)](https://www.aglea.com/blog/tag/sap-gamification) - [sap grc app (1)](https://www.aglea.com/blog/tag/sap-grc-app) - [sap grc fiori (1)](https://www.aglea.com/blog/tag/sap-grc-fiori) - [sap grc rm (1)](https://www.aglea.com/blog/tag/sap-grc-rm) - [sap grc tables (1)](https://www.aglea.com/blog/tag/sap-grc-tables) - [sap gui history (1)](https://www.aglea.com/blog/tag/sap-gui-history) - [sap ilm gdpr (1)](https://www.aglea.com/blog/tag/sap-ilm-gdpr) - [sap ips (1)](https://www.aglea.com/blog/tag/sap-ips) - [sap masking (1)](https://www.aglea.com/blog/tag/sap-masking) - [sap penetration test (1)](https://www.aglea.com/blog/tag/sap-penetration-test) - [sap personalization (1)](https://www.aglea.com/blog/tag/sap-personalization) - [sap roll out (1)](https://www.aglea.com/blog/tag/sap-roll-out) - [sap scp logon (1)](https://www.aglea.com/blog/tag/sap-scp-logon) - [sap security MEME (1)](https://www.aglea.com/blog/tag/sap-security-meme) - [sap security checklist (1)](https://www.aglea.com/blog/tag/sap-security-checklist) - [sap security integrator (1)](https://www.aglea.com/blog/tag/sap-security-integrator) - [sap security teal (1)](https://www.aglea.com/blog/tag/sap-security-teal) - [sap signavio (1)](https://www.aglea.com/blog/tag/sap-signavio) - [sap splunk (1)](https://www.aglea.com/blog/tag/sap-splunk) - [sap standard role (1)](https://www.aglea.com/blog/tag/sap-standard-role) - [sap support package (1)](https://www.aglea.com/blog/tag/sap-support-package) - [sap tabelle custom (1)](https://www.aglea.com/blog/tag/sap-tabelle-custom) - [sap tdms (1)](https://www.aglea.com/blog/tag/sap-tdms) - [sap tipo utente (1)](https://www.aglea.com/blog/tag/sap-tipo-utente) - [sap translate (1)](https://www.aglea.com/blog/tag/sap-translate) - [sap_all_only_view (1)](https://www.aglea.com/blog/tag/sap_all_only_view) - [sap_gui (1)](https://www.aglea.com/blog/tag/sap_gui) - [sap_new (1)](https://www.aglea.com/blog/tag/sap_new) - [scc4 (1)](https://www.aglea.com/blog/tag/scc4) - [scoodo log (1)](https://www.aglea.com/blog/tag/scoodo-log) - [scrambling (1)](https://www.aglea.com/blog/tag/scrambling) - [scrum sap (1)](https://www.aglea.com/blog/tag/scrum-sap) - [secpol (1)](https://www.aglea.com/blog/tag/secpol) - [security bridge (1)](https://www.aglea.com/blog/tag/security-bridge) - [security operation center (1)](https://www.aglea.com/blog/tag/security-operation-center) - [security template (1)](https://www.aglea.com/blog/tag/security-template) - [security tools (1)](https://www.aglea.com/blog/tag/security-tools) - [security weaver (1)](https://www.aglea.com/blog/tag/security-weaver) - [self service (1)](https://www.aglea.com/blog/tag/self-service) - [semplificare (1)](https://www.aglea.com/blog/tag/semplificare) - [sentinel (1)](https://www.aglea.com/blog/tag/sentinel) - [sicurezza codice ABAP (1)](https://www.aglea.com/blog/tag/sicurezza-codice-abap) - [sicurezza dati (1)](https://www.aglea.com/blog/tag/sicurezza-dati) - [sistema integrato (1)](https://www.aglea.com/blog/tag/sistema-integrato) - [sod ruleset (1)](https://www.aglea.com/blog/tag/sod-ruleset) - [sondaggi (1)](https://www.aglea.com/blog/tag/sondaggi) - [sost (1)](https://www.aglea.com/blog/tag/sost) - [sql (1)](https://www.aglea.com/blog/tag/sql) - [sticker (1)](https://www.aglea.com/blog/tag/sticker) - [su21 (1)](https://www.aglea.com/blog/tag/su21) - [system integrator (1)](https://www.aglea.com/blog/tag/system-integrator) - [tabelle SAP grc access control (1)](https://www.aglea.com/blog/tag/tabelle-sap-grc-access-control) - [tassi di cambio (1)](https://www.aglea.com/blog/tag/tassi-di-cambio) - [test autorizzazioni (1)](https://www.aglea.com/blog/tag/test-autorizzazioni) - [traduzione ruoli (1)](https://www.aglea.com/blog/tag/traduzione-ruoli) - [traduzione sap (1)](https://www.aglea.com/blog/tag/traduzione-sap) - [ust04 (1)](https://www.aglea.com/blog/tag/ust04) - [utenti sap (1)](https://www.aglea.com/blog/tag/utenti-sap) - [utenze di sistema (1)](https://www.aglea.com/blog/tag/utenze-di-sistema) - [virtual forge (1)](https://www.aglea.com/blog/tag/virtual-forge) - [vpn (1)](https://www.aglea.com/blog/tag/vpn) - [xiting (1)](https://www.aglea.com/blog/tag/xiting) [Visualizza tutti](https://www.aglea.com/blog/quanti-e-quali-workflow-definire-in-sap-grc-access-control#) ## [SAP Security Blog AGLEA RSS Feed](https://www.aglea.com/blog/rss.xml) Aglea s.r.l. - Soggetta alla direzione e coordinamento di Horsa S.p.A. - P. IVA: IT 03868780960 - 2026 | [Privacy Policy](https://www.aglea.com/privacy-policy/) - [Cookie Policy](https://www.aglea.com/cookie-policy) - [Whistleblowing](https://whistleblowing.horsa.it/) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Massimo Manara", "url" : "https://www.aglea.com/blog/author/massimo-manara" }, "dateModified" : "2024-06-14T09:13:22.367Z", "datePublished" : "2020-05-05T22:00:00.000Z", "headline" : "Quanti e quali workflow definire in SAP GRC Access Control?", "image" : [ "https://www.aglea.com/hubfs/Aglea/Imported_Blog_Media/SAP%20GRC%20Workflow-2.jpg" ], "mainEntityOfPage" : { "@id" : "https://www.aglea.com/blog/quanti-e-quali-workflow-definire-in-sap-grc-access-control", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject" }, "name" : "Horsa S.p.A." } } ```