MSMP Workflow in SAP GRC: Mastering Access Request Configuration

Governance, Risk, and Compliance (GRC) solutions safeguard organizations’ assets and streamline their compliance processes. Within SAP’s GRC suite, the Multi-Step Multi-Process (MSMP) workflow engine is a powerful tool for customizing and automating access request management. Let’s delve into MSMP and its role in streamlining SAP GRC processes.

What is MSMP?

MSMP is a flexible workflow configuration framework introduced in SAP GRC 10.0. It sits on top of SAP’s standard workflow engine and can tailor access requests to match an organization’s unique approval processes. With MSMP, you can:

• Split Requests: Route a single request to multiple approvers simultaneously for parallel processing.
• Multiple Approval Steps: Integrate various approval stages within a request, creating a sequential chain.
• Customizable Notifications: Tailor email notifications at different stages of the workflow.

Key Elements of MSMP

To understand MSMP configuration, let’s break down its key components:

1. Process ID: A unique identifier for a specific workflow scenario (e.g., SAP_GRAC_ACCESS_REQUEST for standard access requests).
2. Initiator Rule: The starting point of the workflow, triggered by a condition and determining the approval path.
3. Paths: Predefined sequences of stages that a request follows.
4. Stages: Individual steps within a path where an approver acts.
5. Agents: Users or roles responsible for approvals (e.g., managers, role owners).
6. Notifications: Customizable email templates triggered at various workflow points.

Configuring MSMP Workflow

The configuration process occurs primarily in SPRO (SAP Reference IMG). Here’s a simplified outline:

1. Maintain Process Settings: Link a Process ID to an Initiator Rule.
2. Maintain Rules: Set conditions for the Initiator Rule, determining approval paths.
3. Maintain Agents: Define approvers based on roles or other logic.
4. Maintain Paths: Create approval sequences consisting of stages.
5. Maintain Route Mappings: Connect rule results from the Initiator Rule to specific paths.
6. Maintain Stage Configurations: Designate each stage’s agents, notifications, and actions.

Benefits of Using MSMP

• Enhanced Flexibility: MSMP lets you model complex workflows to align with your organization’s approval requirements.
• Improved Efficiency: Streamline and automate request processes, saving time and resources.
• Increased Transparency: Visualize and track the progress of each access request, improving visibility.
• Enhanced Auditability: Maintain detailed logs of approvals for compliance tracking.

Example: User Access Request

A typical workflow example would involve a user requesting access to a SAP system. Using MSMP, you can configure the following flow:

1. The user submits a request.
2. The Initiator Rule checks the requested roles/systems.
3. A path is selected based on the type of access (e.g., standard user access path, critical access path).
4. The request moves through stages (e.g., manager approval, role owner approval, security team approval).
5. At each stage, designated agents are notified and take necessary actions.

In Conclusion

The MSMP workflow engine offers vast personalization in the SAP GRC Access Control module. By understanding its elements and the configuration process, you can effectively implement MSMP to build robust and efficient access request workflows that align with your organization’s needs.