RBAC in Saviynt

[rgupta34]

Hi,

Our clien tis currently having 3 level role model in SAP IDM (i.e. role -> activity -> authorization object) where roles are requestable for end users and SOD is defined at the activity level and authorization objects are provisioned in the application.

Can Saviynt have three levels in role heirarchy? I know enterprise/application role just allows mapping entitlements but is there any possibility or only role - entitlement model is supported in Saviynt

[rushikeshvartak]

Only role - Entitlement model is supported.

however sod can be defined at any level of entitlement as long as entitlement exists

[rgupta34]

Thanks! What are the disadvantages of using parent - child role model ? Can we do SOD checks, certifications at child role level?

[rushikeshvartak]

• SOD Checks are performed on Entitlement hence no issues.
• Certification can be performed on child entitlement mapping