Download Identity Management

Managing an SAP R/3 Environment
user accounts can be locked when the employee is disabled, deleted or rated as a security risk so that
authorizations are immediately withdrawn. If an employee is re-enabled at a later date, the user accounts can also be reactivated. This behavior is controlled by the properties:
•
Disable user accounts if permanently disabled
•
Disable user accounts if temporarily disabled
•
Disable user accounts if deletion is delayed
•
Disable user accounts if security is at risk
Group membership inheritance can be defined for a user account resource for an area of a target system. Inheritance may be discontinued if the employee’s user account is locked and therefore may not
become a member in a global group. During this time, no inheritance processes should be calculated for
this employee. Existing group memberships are deleted! This behavior is controlled by the properties:
•
Group inheritance if permanently disabled
•
Group inheritance if temporarily disabled
•
Group inheritance if deletion is delayed
•
Group inheritance if security is at risk
You can find further information in the section Handling Disabling and Deletion of Employees and User
Accounts on page 44.
Deleting User Account Resources
Tool: Manager
You can delete user account resource if they are no longer assigned to an client or any employee or
role. Proceed as follows:
1.
Select category <Resources & Groups>\<Resources>\<Accounts>
2.
Remove user account resource assignments to employees and roles
3.
Select category <SAP R/3>\<Clients>
4.
Remove user account resource assignments to clients
5.
Select category <Resources & Groups>\<Resources>\<Accounts>
6.
Select the user account resource in the result list and delete it
379