Information SOD and AAG module

[GiuseppeDM]

Hi all,

we configure the SOD Module to run some simulations and evaluations and we encounter some issues. We kindly request your support to better understand if we are missing some configuration on our end or there is a limitation because we don't have the AAG module yet. 

All the configuration were done using the basic SOD module, can you please help us understand what the implementation of AAG module will add to basic SOD?

Without AAG module we are able to:

• Run Simulation (on account level and we able to see the conflicts by adding new SAP roles, including tcodes details. However if we try to simulate adding tcodes only it's showing no conflicts even if we specifically defined them as conflicting in the ruleset) - With AAG module we will be able to simulate conflicts by adding tcodes only?
• SOD Evaluation
  • Single System ( with ruleset defined for single endpoint the sod evaluation was run successfully)
  • Cross System (with ruleset defined for two or more endpoints the sod evaluation was not working

Thank you so much,

Giuseppe

[rushikeshvartak]

Can you provide example / Screenshot to better assist on your issue

[sudeshjaiswal]

Hello @GiuseppeDM,

• Run Simulation (on account level and we able to see the conflicts by adding new SAP roles, including tcodes details. However if we try to simulate adding tcodes only it’s showing no conflicts even if we specifically defined them as conflicting in the ruleset) - With AAG module we will be able to simulate conflicts by adding tcodes only? —
  We have 3 types of simulations. If you are looking to simulate at the account level, then you need to add the saprole in the simulation. The tcode should be part of the saprole. You can simulate at a tcode level by using the entitlement simulation.

• SOD Evaluation

• Single System ( with ruleset defined for single endpoint the sod evaluation was run successfully)
• Cross System (with ruleset defined for two or more endpoints the sod evaluation was not working

— What are the job parameters you are giving? Cross system SOD trigger should not have the system selected. You can also use the account query by selecting the list of accounts you want to evaluate for specific endpoints. Please refer to job best practices here - https://forums.saviynt.com/t5/sod/detective-sod-best-practices/ta-p/39192

For Ref:- 
https://docs.saviyntcloud.com/bundle/EIC-Admin-v23x/page/Content/Chapter06-EIC-Configurations/Config... 

Thanks

[GiuseppeDM]

Thank you for your promptly answer.

We just run some simulations (simulation based on users) about it and it works with just the Sap role inserted in the simulation, the problem is when on user level I want to add just Tcode and simulate if there is some SOD violation about that based on Ruleset we have configured.

I posted a screenshot below for your reference.

Thank you.

[sai_sp]

@GiuseppeDM You will not be able to add tcode directly in the user account simulation. Only saproles can be added. Even in SAP all tcodes are assigned to the account only through saproles.