{"id":11194,"date":"2024-05-08T10:29:59","date_gmt":"2024-05-08T08:29:59","guid":{"rendered":"https:\/\/www.inprosec.com\/?p=11194"},"modified":"2024-05-27T12:42:57","modified_gmt":"2024-05-27T10:42:57","slug":"how-to-configure-iag-access-analysis-service","status":"publish","type":"post","link":"https:\/\/www.inprosec.com\/en\/how-to-configure-iag-access-analysis-service\/","title":{"rendered":"How to Configure IAG Access Analysis Service"},"content":{"rendered":"<p><span style=\"font-weight: 400;\">Within SAP\u00ae&#8217;s portfolio of solutions for access and identity control, since 2018, there exists a solution named <\/span><b>SAP IAG<\/b><span style=\"font-weight: 400;\"> (Identity Access Governance). This solution, similarly to GRC AC, allows for centralized access management for clients in their SAP environments. However, one of the main innovations of this recent tool is that it is <\/span><b>natively connectable to SAP On-Premise systems<\/b><span style=\"font-weight: 400;\"> (just like GRC AC), <\/span><b>but also to SAP&#8217;s public <\/b><b><i>cloud<\/i><\/b><b> systems<\/b><span style=\"font-weight: 400;\">, such as Ariba, Fieldglass, S\/4 HANA Cloud; among others; whereas GRC AC does not (only, as an exception, SFEC).<\/span><\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-11238\" src=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-1.jpg\" alt=\"\" width=\"700\" height=\"362\" srcset=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-1.jpg 1097w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-1-300x155.jpg 300w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-1-1024x529.jpg 1024w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-1-600x310.jpg 600w\" sizes=\"(max-width: 700px) 100vw, 700px\" \/><\/p>\n<p><span style=\"font-weight: 400;\">Focusing now on SAP IAG, we can also draw certain equivalences between the modules of GRC AC, and the (now services) of SAP IAG. Below, a graph shows the main functionalities of SAP IAG:<\/span><\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-11240\" src=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-2.jpg\" alt=\"\" width=\"701\" height=\"414\" srcset=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-2.jpg 1069w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-2-300x177.jpg 300w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-2-1024x604.jpg 1024w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-2-600x354.jpg 600w\" sizes=\"(max-width: 701px) 100vw, 701px\" \/><\/p>\n<p><span style=\"font-weight: 400;\">In this article, we will only explain in detail the <\/span><b>Access Analysis<\/b><span style=\"font-weight: 400;\"> service, whose purpose is to monitor the access risks present in the users in the monitored systems, in the same way as the mitigation and\/or remediation of these risks.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">The first thing to understand is that <\/span><b>SAP IAG<\/b><span style=\"font-weight: 400;\"> is a product that exists <\/span><b>within SAP BTP<\/b><span style=\"font-weight: 400;\"> (Business Technology Platform). Therefore, clients who wish to have SAP IAG, must have access to this platform.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Moreover, SAP IAG currently has <\/span><b>2 contracting models:<\/b><\/p>\n<ol>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">As the sole access control tool (i.e., without GRC AC).<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">As an extension of SAP GRC AC for Cloud environments.<\/span><\/li>\n<\/ol>\n<p><b>In this article<\/b><span style=\"font-weight: 400;\">, we will only address the first point, assuming that <\/span><b>SAP IAG is the sole tool designated for access control<\/b><span style=\"font-weight: 400;\">. Additionally, we will monitor access control in an On-Premise system (SAP S\/4 HANA).<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Before this, it is necessary to understand that SAP IAG, is a product that exists in the public cloud of SAP, and thus is not within the internal network of clients.<\/span><\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-11200\" src=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-3.png\" alt=\"\" width=\"701\" height=\"378\" srcset=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-3.png 901w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-3-300x162.png 300w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-3-600x324.png 600w\" sizes=\"(max-width: 701px) 100vw, 701px\" \/><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">To facilitate this task, clients are provided with the <\/span><i><span style=\"font-weight: 400;\">software<\/span><\/i> <b>Cloud Connector<\/b><span style=\"font-weight: 400;\"> which allows <\/span><b>exposing those function modules that will be used by IAG<\/b><span style=\"font-weight: 400;\"> (in this case) to carry out the risk analyses.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Once the software is installed and configured, the next step is to create the connection in SAP BTP, which will then be used by SAP IAG. This is, in a manner similar to what would be done in SAP GRC AC, creating an RFC connection.<\/span><\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-11202\" src=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-4.png\" alt=\"\" width=\"700\" height=\"384\" srcset=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-4.png 1057w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-4-300x165.png 300w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-4-1024x562.png 1024w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-4-600x329.png 600w\" sizes=\"(max-width: 700px) 100vw, 700px\" \/><\/p>\n<p><span style=\"font-weight: 400;\">Once this step is completed, you can begin the specific configuration of the application within the SAP IAG tool itself.<\/span><\/p>\n<h2><b>Configuration AAS<\/b><b><\/b><\/h2>\n<h3><b><\/b><b>Application Creation<\/b><\/h3>\n<ol>\n<li style=\"list-style-type: none;\"><\/li>\n<\/ol>\n<p><span style=\"font-weight: 400;\">Thus, <\/span><b>the first step would be the creation in IAG of the application<\/b><span style=\"font-weight: 400;\"> to be monitored. For this, you can access the path:<\/span><\/p>\n<p><i><span style=\"font-weight: 400;\">Administration Applications<\/span><\/i><\/p>\n<p><span style=\"font-weight: 400;\">You must choose the type of system (as previously mentioned, it will be an S\/4 HANA On-Premise, in this case), and cover the <\/span><i><span style=\"font-weight: 400;\">HCP Destination<\/span><\/i><span style=\"font-weight: 400;\">, which must match the connector created in BTP previously.<\/span><\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-11204\" src=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-5.png\" alt=\"\" width=\"697\" height=\"398\" srcset=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-5.png 748w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-5-300x171.png 300w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-5-600x343.png 600w\" sizes=\"(max-width: 697px) 100vw, 697px\" \/><\/p>\n<h3><b>Creation of Business Function Groups<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">Another configuration option is the creation of <\/span><b>Business Function Groups:<\/b><\/p>\n<p><i><span style=\"font-weight: 400;\">Administration <\/span><\/i><i><\/i><i><span style=\"font-weight: 400;\"> Business Function Groups<\/span><\/i><\/p>\n<p><span style=\"font-weight: 400;\">In a <\/span><b>similar manner<\/b><span style=\"font-weight: 400;\"> to SAP GRC AC with the <\/span><b>connector groups<\/b><span style=\"font-weight: 400;\">, it allows creating system groups to cluster the different natures of risks by application. In this case, such a group would be created, and associated with the necessary application:<\/span><\/p>\n<p><img decoding=\"async\" class=\"aligncenter size-full wp-image-11206\" src=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-6.png\" alt=\"\" width=\"599\" height=\"395\" srcset=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-6.png 599w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-6-300x198.png 300w\" sizes=\"(max-width: 599px) 100vw, 599px\" \/><\/p>\n<h3><b>Risk Levels and Business Processes<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">It is also possible to create <\/span><b>own risk levels<\/b><span style=\"font-weight: 400;\">, and <\/span><b>own business processes<\/b><span style=\"font-weight: 400;\"> in the options:<\/span><\/p>\n<p><i><span style=\"font-weight: 400;\">Administration Risk Level<\/span><\/i><\/p>\n<p><i><span style=\"font-weight: 400;\">Administration Business Processes<\/span><\/i><\/p>\n<h3><b>Parameters<\/b><\/h3>\n<p><span style=\"font-weight: 400;\">Also, as in GRC AC (although to a considerably lesser extent) there are <\/span><b>certain parameters<\/b><span style=\"font-weight: 400;\"> of configuration that allow <\/span><b>adapting the operation of risk analysis<\/b><span style=\"font-weight: 400;\"> to the needs of each client. This option can be accessed through the path:<\/span><\/p>\n<p><i><span style=\"font-weight: 400;\">Administration Application Parameters<\/span><\/i><\/p>\n<p><span style=\"font-weight: 400;\">For more information about these parameters, the OSS Note can be consulted: <\/span><a href=\"https:\/\/me.sap.com\/notes\/3278498\/E\"><span style=\"font-weight: 400;\">3278498 &#8211; IAG &#8211; Optimization of Access Analysis job &#8211; SAP for Me<\/span><\/a><\/p>\n<p><span style=\"font-weight: 400;\">Once these steps are completed, all the necessary IAG configuration would be ready to begin performing risk analyses.<\/span><\/p>\n<h2><b>Risk Matrix<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">To be able to <\/span><b>have a risk matrix<\/b><span style=\"font-weight: 400;\">, it is important to understand that in <\/span><b>SAP IAG<\/b><span style=\"font-weight: 400;\"> we do not have BC Sets as happens in SAP GRC AC (SCPR20) where the client can activate the risk matrix for themselves. In the case of IAG; it is <\/span><b>necessary to contact SAP<\/b><span style=\"font-weight: 400;\"> so that they can register the risk matrix in the IAG system of the client. In the following <\/span><b>OSS Note<\/b><span style=\"font-weight: 400;\">, the details are explained: <\/span><a href=\"https:\/\/me.sap.com\/notes\/2782388\"><span style=\"font-weight: 400;\">2782388 &#8211; IAG &#8211; How to load default standard ruleset?<\/span><\/a><\/p>\n<p><span style=\"font-weight: 400;\">However, a client may also equally edit or create their own risk matrix from scratch. Below are the existing alternatives:<\/span><\/p>\n<p><i><span style=\"font-weight: 400;\">Administration Rule Setup<\/span><\/i><\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-11208\" src=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-7.png\" alt=\"\" width=\"700\" height=\"537\" srcset=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-7.png 783w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-7-300x230.png 300w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-7-600x461.png 600w\" sizes=\"(max-width: 700px) 100vw, 700px\" \/><\/p>\n<p><span style=\"font-weight: 400;\">Here, you can first download the rules and adjust them to the specific needs of each client, by connector group or directly all, to then load them again.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">It is important to understand that, once these rules are loaded, the upload file must have a predefined structure. <\/span><\/p>\n<p><span style=\"font-weight: 400;\">Below, the <\/span><span style=\"font-weight: 400; color: #339966;\">correct<\/span><span style=\"font-weight: 400;\"> setup is shown where the upload file does not have nested subfolders<\/span><\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-11210\" src=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-8.png\" alt=\"\" width=\"700\" height=\"215\" srcset=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-8.png 759w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-8-300x92.png 300w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-8-600x184.png 600w\" sizes=\"(max-width: 700px) 100vw, 700px\" \/><\/p>\n<p><span style=\"font-weight: 400;\">And below, an <\/span><span style=\"font-weight: 400; color: #ff0000;\">incorrect<\/span><span style=\"font-weight: 400;\"> way:<\/span><\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-11212\" src=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-9.png\" alt=\"\" width=\"701\" height=\"214\" srcset=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-9.png 714w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-9-300x92.png 300w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-9-600x183.png 600w\" sizes=\"(max-width: 701px) 100vw, 701px\" \/><\/p>\n<h2><b>Execution of Risk Analysis<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">At this point, the next step, as also happens in SAP GRC AC, is to perform the <\/span><b>synchronization of users, roles, and profiles in SAP IAG<\/b><span style=\"font-weight: 400;\">. This can be done from the option:<\/span><\/p>\n<p><i><span style=\"font-weight: 400;\">Administration Job Scheduler<\/span><\/i><\/p>\n<p><span style=\"font-weight: 400;\">You select the type of program (Repository Sync), the type of system (S\/4 HANA On-Prem) and the application to synchronize.<\/span><\/p>\n<p><img decoding=\"async\" class=\"aligncenter size-full wp-image-11214\" src=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-10.png\" alt=\"\" width=\"635\" height=\"332\" srcset=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-10.png 635w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-10-300x157.png 300w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-10-600x314.png 600w\" sizes=\"(max-width: 635px) 100vw, 635px\" \/><\/p>\n<p><span style=\"font-weight: 400;\">From the option:<\/span><\/p>\n<p><i><span style=\"font-weight: 400;\">Administration Job History List<\/span><\/i><\/p>\n<p><span style=\"font-weight: 400;\">You can consult the result of the scheduled job, marked as \u201cCompleted\u201d if it finished successfully<\/span><\/p>\n<p><img decoding=\"async\" class=\"aligncenter size-full wp-image-11216\" src=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-11.png\" alt=\"\" width=\"552\" height=\"235\" srcset=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-11.png 552w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-11-300x128.png 300w\" sizes=\"(max-width: 552px) 100vw, 552px\" \/><\/p>\n<p><span style=\"font-weight: 400;\">Finally, only <\/span><b>launching the risk analysis,<\/b><span style=\"font-weight: 400;\"> remains to be done in order to know the risks present in the users in the desired system. Just like the job of synchronizing users, roles, and profiles, this is done from the option:<\/span><\/p>\n<p><i><span style=\"font-weight: 400;\">Administration Job Scheduler<\/span><\/i><\/p>\n<p><span style=\"font-weight: 400;\">Although in this case, the type of program to be launched will be <\/span><i><span style=\"font-weight: 400;\">Access Analysis<\/span><\/i><\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-11218\" src=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-12.png\" alt=\"\" width=\"685\" height=\"226\" srcset=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-12.png 688w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-12-300x99.png 300w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-12-600x198.png 600w\" sizes=\"(max-width: 685px) 100vw, 685px\" \/><\/p>\n<p><span style=\"font-weight: 400;\">And will appear as completed if it finished successfully.<\/span><\/p>\n<p><img decoding=\"async\" class=\"aligncenter size-full wp-image-11220\" src=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-13.png\" alt=\"\" width=\"570\" height=\"292\" srcset=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-13.png 570w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-13-300x154.png 300w\" sizes=\"(max-width: 570px) 100vw, 570px\" \/><\/p>\n<h2><b>Risk Analysis Results<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">Thus, it will now be possible <\/span><b>to consult the risks present in the users<\/b><span style=\"font-weight: 400;\">, and proceed with the mitigation and\/or remediation of these. For this, reports are available in the Access Analysis section.<\/span><\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-11222\" src=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-14.png\" alt=\"\" width=\"700\" height=\"305\" srcset=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-14.png 865w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-14-300x131.png 300w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-14-600x262.png 600w\" sizes=\"(max-width: 700px) 100vw, 700px\" \/><\/p>\n<p><span style=\"font-weight: 400;\">In this case, we can see what risks are present in which users, and through which permissions (roles, groups, etc.).<\/span><\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-11224\" src=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-15.png\" alt=\"\" width=\"701\" height=\"264\" srcset=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-15.png 897w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-15-300x113.png 300w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-15-600x226.png 600w\" sizes=\"(max-width: 701px) 100vw, 701px\" \/><\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-11226\" src=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-16.png\" alt=\"\" width=\"701\" height=\"328\" srcset=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-16.png 898w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-16-300x140.png 300w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-16-600x281.png 600w\" sizes=\"(max-width: 701px) 100vw, 701px\" \/><\/p>\n<p><span style=\"font-weight: 400;\">As for the <\/span><b>remediation<\/b><span style=\"font-weight: 400;\">, one of the advantages of IAG is that it proposes a simple framework for carrying out such remediation actions. Traditionally, one of the main remediation actions is to eliminate the risks present in users who have not been used for a certain period of time. IAG already incorporates this logic, and proposes to IAG users the elimination of such accesses, as well as other series of conditions to facilitate remediation:<\/span><\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-11228\" src=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-17.png\" alt=\"\" width=\"698\" height=\"287\" srcset=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-17.png 803w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-17-300x123.png 300w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-17-600x247.png 600w\" sizes=\"(max-width: 698px) 100vw, 698px\" \/><\/p>\n<p><span style=\"font-weight: 400;\">In case the risk cannot be remedied, <\/span><b>it is also possible to mitigate the risk<\/b><span style=\"font-weight: 400;\"> through mitigating controls created in the option:<\/span><\/p>\n<p><i><span style=\"font-weight: 400;\">Administration Mitigating Control<\/span><\/i><\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-11230\" src=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-18.png\" alt=\"\" width=\"701\" height=\"206\" srcset=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-18.png 830w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-18-300x88.png 300w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-18-600x176.png 600w\" sizes=\"(max-width: 701px) 100vw, 701px\" \/><\/p>\n<h2><b>Conclusions<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">In summary, it has been demonstrated how <\/span><b>SAP IAG<\/b> <b>Access Analysis Service<\/b><span style=\"font-weight: 400;\"> allows, in a manner similar to SAP GRC AC ARA, <\/span><b>to perform risk analyses<\/b><span style=\"font-weight: 400;\"> to be able to know the presence of these in the users, and to carry out the <\/span><b>remediation and\/or mitigation<\/b><span style=\"font-weight: 400;\">.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Additionally, the great novelty of <\/span><b>IAG<\/b><span style=\"font-weight: 400;\"> is to be able to analyze, in a <\/span><b>natively<\/b><span style=\"font-weight: 400;\"> manner to SAP <\/span><b>Cloud systems<\/b><span style=\"font-weight: 400;\">, whereas GRC AC can only be natively integrated with SFEC.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Currently, the tool is under development by SAP, progressively incorporating functionalities. To consult, access can be had to the <\/span><a href=\"https:\/\/roadmaps.sap.com\/board?range=2023Q3-2024Q4&amp;PRODUCT=73555000100800000334#Q3%202023\"><i><span style=\"font-weight: 400;\">roadmap<\/span><\/i><\/a><span style=\"font-weight: 400;\"> of the tool:<\/span><\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-11232\" src=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-19.png\" alt=\"\" width=\"700\" height=\"293\" srcset=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-19.png 1600w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-19-300x126.png 300w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-19-1024x429.png 1024w, https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/access-analysis-IAG-19-600x251.png 600w\" sizes=\"(max-width: 700px) 100vw, 700px\" \/><\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Within SAP\u00ae&#8217;s portfolio of solutions for access and identity control, since 2018, there exists a solution named SAP IAG (Identity Access Governance). This solution, similarly to GRC AC, allows for centralized access management for clients in their SAP environments. However, one of the main innovations of this recent tool is that it is natively connectable&#8230;<\/p>\n","protected":false},"author":6,"featured_media":11247,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":""},"categories":[60,52],"tags":[152,151],"class_list":["post-11194","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-sap-grc-en","category-technical-article","tag-cloud-identity-governance-en","tag-sap-grc-en"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v26.3 (Yoast SEO v27.3) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>How to Configure IAG Access Analysis Service - Inprosec<\/title>\n<meta name=\"description\" content=\"Discover the importance of Access Analysis in SAP IAG, an essential tool for centralized identity and access management in both SAP environments and the cloud. Learn how to optimize security and efficiency in our detailed article.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.inprosec.com\/en\/how-to-configure-iag-access-analysis-service\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How to Configure IAG Access Analysis Service\" \/>\n<meta property=\"og:description\" content=\"Discover the importance of Access Analysis in SAP IAG, an essential tool for centralized identity and access management in both SAP environments and the cloud. Learn how to optimize security and efficiency in our detailed article.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.inprosec.com\/en\/how-to-configure-iag-access-analysis-service\/\" \/>\n<meta property=\"og:site_name\" content=\"Inprosec\" \/>\n<meta property=\"article:published_time\" content=\"2024-05-08T08:29:59+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-05-27T10:42:57+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/Como-Configurar-Access-Analysis-Service-IAG.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Fernando Mosquera\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Fernando Mosquera\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"10 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/how-to-configure-iag-access-analysis-service\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/how-to-configure-iag-access-analysis-service\\\/\"},\"author\":{\"name\":\"Fernando Mosquera\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/#\\\/schema\\\/person\\\/b05a40c0c3e81b819075dd95a10532e2\"},\"headline\":\"How to Configure IAG Access Analysis Service\",\"datePublished\":\"2024-05-08T08:29:59+00:00\",\"dateModified\":\"2024-05-27T10:42:57+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/how-to-configure-iag-access-analysis-service\\\/\"},\"wordCount\":1218,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/how-to-configure-iag-access-analysis-service\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.inprosec.com\\\/wp-content\\\/uploads\\\/2024\\\/05\\\/Como-Configurar-Access-Analysis-Service-IAG.jpg\",\"keywords\":[\"Cloud Identity Governance\",\"SAP GRC\"],\"articleSection\":[\"SAP GRC\",\"Technical Article\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.inprosec.com\\\/en\\\/how-to-configure-iag-access-analysis-service\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/how-to-configure-iag-access-analysis-service\\\/\",\"url\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/how-to-configure-iag-access-analysis-service\\\/\",\"name\":\"How to Configure IAG Access Analysis Service - Inprosec\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/how-to-configure-iag-access-analysis-service\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/how-to-configure-iag-access-analysis-service\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.inprosec.com\\\/wp-content\\\/uploads\\\/2024\\\/05\\\/Como-Configurar-Access-Analysis-Service-IAG.jpg\",\"datePublished\":\"2024-05-08T08:29:59+00:00\",\"dateModified\":\"2024-05-27T10:42:57+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/#\\\/schema\\\/person\\\/b05a40c0c3e81b819075dd95a10532e2\"},\"description\":\"Discover the importance of Access Analysis in SAP IAG, an essential tool for centralized identity and access management in both SAP environments and the cloud. Learn how to optimize security and efficiency in our detailed article.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/how-to-configure-iag-access-analysis-service\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.inprosec.com\\\/en\\\/how-to-configure-iag-access-analysis-service\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/how-to-configure-iag-access-analysis-service\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.inprosec.com\\\/wp-content\\\/uploads\\\/2024\\\/05\\\/Como-Configurar-Access-Analysis-Service-IAG.jpg\",\"contentUrl\":\"https:\\\/\\\/www.inprosec.com\\\/wp-content\\\/uploads\\\/2024\\\/05\\\/Como-Configurar-Access-Analysis-Service-IAG.jpg\",\"width\":1200,\"height\":630},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/how-to-configure-iag-access-analysis-service\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How to Configure IAG Access Analysis Service\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/\",\"name\":\"Inprosec\",\"description\":\"Information security is our priority.\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.inprosec.com\\\/en\\\/#\\\/schema\\\/person\\\/b05a40c0c3e81b819075dd95a10532e2\",\"name\":\"Fernando Mosquera\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/199e6c54b14f5b5ddf7e11a9bb0b455c3bed7a9a1a738b7be5c2572878e69d1a?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/199e6c54b14f5b5ddf7e11a9bb0b455c3bed7a9a1a738b7be5c2572878e69d1a?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/199e6c54b14f5b5ddf7e11a9bb0b455c3bed7a9a1a738b7be5c2572878e69d1a?s=96&d=mm&r=g\",\"caption\":\"Fernando Mosquera\"}}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"How to Configure IAG Access Analysis Service - Inprosec","description":"Discover the importance of Access Analysis in SAP IAG, an essential tool for centralized identity and access management in both SAP environments and the cloud. Learn how to optimize security and efficiency in our detailed article.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.inprosec.com\/en\/how-to-configure-iag-access-analysis-service\/","og_locale":"en_US","og_type":"article","og_title":"How to Configure IAG Access Analysis Service","og_description":"Discover the importance of Access Analysis in SAP IAG, an essential tool for centralized identity and access management in both SAP environments and the cloud. Learn how to optimize security and efficiency in our detailed article.","og_url":"https:\/\/www.inprosec.com\/en\/how-to-configure-iag-access-analysis-service\/","og_site_name":"Inprosec","article_published_time":"2024-05-08T08:29:59+00:00","article_modified_time":"2024-05-27T10:42:57+00:00","og_image":[{"width":1200,"height":630,"url":"https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/Como-Configurar-Access-Analysis-Service-IAG.jpg","type":"image\/jpeg"}],"author":"Fernando Mosquera","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Fernando Mosquera","Est. reading time":"10 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.inprosec.com\/en\/how-to-configure-iag-access-analysis-service\/#article","isPartOf":{"@id":"https:\/\/www.inprosec.com\/en\/how-to-configure-iag-access-analysis-service\/"},"author":{"name":"Fernando Mosquera","@id":"https:\/\/www.inprosec.com\/en\/#\/schema\/person\/b05a40c0c3e81b819075dd95a10532e2"},"headline":"How to Configure IAG Access Analysis Service","datePublished":"2024-05-08T08:29:59+00:00","dateModified":"2024-05-27T10:42:57+00:00","mainEntityOfPage":{"@id":"https:\/\/www.inprosec.com\/en\/how-to-configure-iag-access-analysis-service\/"},"wordCount":1218,"commentCount":0,"image":{"@id":"https:\/\/www.inprosec.com\/en\/how-to-configure-iag-access-analysis-service\/#primaryimage"},"thumbnailUrl":"https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/Como-Configurar-Access-Analysis-Service-IAG.jpg","keywords":["Cloud Identity Governance","SAP GRC"],"articleSection":["SAP GRC","Technical Article"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.inprosec.com\/en\/how-to-configure-iag-access-analysis-service\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.inprosec.com\/en\/how-to-configure-iag-access-analysis-service\/","url":"https:\/\/www.inprosec.com\/en\/how-to-configure-iag-access-analysis-service\/","name":"How to Configure IAG Access Analysis Service - Inprosec","isPartOf":{"@id":"https:\/\/www.inprosec.com\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.inprosec.com\/en\/how-to-configure-iag-access-analysis-service\/#primaryimage"},"image":{"@id":"https:\/\/www.inprosec.com\/en\/how-to-configure-iag-access-analysis-service\/#primaryimage"},"thumbnailUrl":"https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/Como-Configurar-Access-Analysis-Service-IAG.jpg","datePublished":"2024-05-08T08:29:59+00:00","dateModified":"2024-05-27T10:42:57+00:00","author":{"@id":"https:\/\/www.inprosec.com\/en\/#\/schema\/person\/b05a40c0c3e81b819075dd95a10532e2"},"description":"Discover the importance of Access Analysis in SAP IAG, an essential tool for centralized identity and access management in both SAP environments and the cloud. Learn how to optimize security and efficiency in our detailed article.","breadcrumb":{"@id":"https:\/\/www.inprosec.com\/en\/how-to-configure-iag-access-analysis-service\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.inprosec.com\/en\/how-to-configure-iag-access-analysis-service\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.inprosec.com\/en\/how-to-configure-iag-access-analysis-service\/#primaryimage","url":"https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/Como-Configurar-Access-Analysis-Service-IAG.jpg","contentUrl":"https:\/\/www.inprosec.com\/wp-content\/uploads\/2024\/05\/Como-Configurar-Access-Analysis-Service-IAG.jpg","width":1200,"height":630},{"@type":"BreadcrumbList","@id":"https:\/\/www.inprosec.com\/en\/how-to-configure-iag-access-analysis-service\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.inprosec.com\/en\/"},{"@type":"ListItem","position":2,"name":"How to Configure IAG Access Analysis Service"}]},{"@type":"WebSite","@id":"https:\/\/www.inprosec.com\/en\/#website","url":"https:\/\/www.inprosec.com\/en\/","name":"Inprosec","description":"Information security is our priority.","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.inprosec.com\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.inprosec.com\/en\/#\/schema\/person\/b05a40c0c3e81b819075dd95a10532e2","name":"Fernando Mosquera","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/199e6c54b14f5b5ddf7e11a9bb0b455c3bed7a9a1a738b7be5c2572878e69d1a?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/199e6c54b14f5b5ddf7e11a9bb0b455c3bed7a9a1a738b7be5c2572878e69d1a?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/199e6c54b14f5b5ddf7e11a9bb0b455c3bed7a9a1a738b7be5c2572878e69d1a?s=96&d=mm&r=g","caption":"Fernando Mosquera"}}]}},"_links":{"self":[{"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/posts\/11194","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/comments?post=11194"}],"version-history":[{"count":1,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/posts\/11194\/revisions"}],"predecessor-version":[{"id":11248,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/posts\/11194\/revisions\/11248"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/media\/11247"}],"wp:attachment":[{"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/media?parent=11194"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/categories?post=11194"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.inprosec.com\/en\/wp-json\/wp\/v2\/tags?post=11194"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}