Overview
In GRC Access control as part of Workflow approvals and reviews Managers, Role Owners, FF ID Owners and Controllers, Function/Risk/Mitigation Approvers, Monitors, Users, Requestors etc. receive various Email notifications. Based on the client’s requirements these Email notifications are enhanced and maintained. This blog is to discuss about various customizing options available for GRC notifications as well as notification variables and their limitations and scope π
For beginners below document gives details on how to customize email notifications templates in GRC
AC 10.0 – How to Customize Notification Templates for AC Workflow
Email Notification Templates – HTML Tags
1. HREF (For Email ID and URLs)
Business Scenario:
Notification variables which gets converted to URLs in the notification emails will have a very big URL with Path ID, Stage ID etc. Basically when the URL is not maintained as HREF using HTML tags, in most of the cases Emails get routed to JUNK folder in mailbox because of various special characters in the URL. Hence it is suggested to use HREF tag and make these GRC URLs as links which will avoid routing to JUNK folder issue as well as avoids end users directly seeing all technical details of the URL. Below are some of the variables which gets converted to URLs in notification Emails.
LINK_APPROVE_REJECT Link to Approve/Reject by Email
LINK_GET_APPROVERS Link to get Approvers
LINK_GET_REQ_STATUS Link to get Request Status
Example: How the above variables look in notification emails with and without HTML tags
a. %LINK_APPROVE_REJECT%
b. Click <A HREF = %LINK_APPROVE_REJECT% > here </A> to approve/reject the request
2. To Include GRC Help-desk Email
Business Scenario:
When end users receive email notifications for GRC related requests then most of the times we observed that users will have queries with the Emails or about their GRC requests and wanted to contact concerned GRC Admin/Help-desk for clarifications. In order to make it easy for end users to contact HELP-DESK, we can include Email ID in notification emails.
Example: How to include Email link in notifications
Please contact GRC Admin at <A href=”mailto:Test@test.com“> GRC Helpdesk </A>
3. BOLD, UNDERLINE and ITALICIZE
Reason behind sharing details about BOLD, UNDERLINE and ITALICIZE tags is because these doesn’t work with traditional HTML tags like <B> <U> and <I> in notification templates.
Example: <strong> <span style=”text-decoration: underline;”> Quick Reference for approvers: </span> </strong>
Example:
<span style=”font-style: italic;”>
Select the approval status as “REJECT” beside the role that you wish to reject.
</span>
How to insert Company Logo in Email Notification Templates
First you need to store the Logo which you want to use in Email notifications in GRC MIME repository
Go to SE80 Tcode and click on MIME REPOSITORY. Import the Logo which you wanted to use into MIME objects repository as shown below:
Once the above activities are completed, the next step is to use the LOGO in Email notification Templates.
Note: URL for logo is no transportable and need to be individually changed in each system when notification template is transported.
Use the image source tag as shown below:
<img src = “http://my_server.my_domain/sap/public/bc/ur/MyLogo.png“>
Example: <img src = “http://myserver_mydomain/sap/public/bc/ur/MyLogo.png“>
How to create New Message Class for Notification Templates
How to create new Message Class for any workflow in GRC ?
Very common requirement is customers request to have specific Email notifications at each stage individually and for such scenarios it might require creation of Custom message classes to be used at various stages in workflow and you can follow below process for creating new message classes π
Example: For EAM Log Review Workflow there are no FORWARD and RETURN Message Class available.
Execute Tcode SM30
Open table GRFNVNOTIFYMSG and click on Maintain button and then click on “NEW ENTRIES” and maintain as below and once done click on SAVE button
Execute Tcode SM30
Open table GRFNVNOTIFYMSGC and click on Maintain button and then click on “NEW ENTRIES” and maintain as below and once done click on SAVE button
Once the above mentioned activities are completed, now the newly created Message Class can be added to your MSMP Variables & Templates Notification Templates section as shown below
Notification Variables in GRC
Each workflow process comes with a number of notification variables that are available to all notification templates that belong to it. They are displayed on the bottom of the screen in step 4, ”Variables & Templates”, in the customizing activity Maintain MSMP Workflows.
Few queries regarding Notification Variables customization especially %PROVISIONING% and %PROVISIONING_WITHOUT_PASSWORD%
For ARQ provisioning there are 2 variables which are sent along with END OF REQUEST notification( with Roles and Password details) PROVISIONING and PROVISIONING_WITHOUT_PASSWORD
These variables are standard variables which are calculated run-time.. if you are not happy with the formatting, please raise a CSS message and let SAP developer fix that for you.. there is no customizing available for it..
Other option can be to have your own custom variable created, but again that require development π
2012041 – Is it possible to suppress the role details in the variable %PROVISIONING%
1854408 – Potential information disclosure relating to user password
How to create custom notification variables in GRC
In the MSMP configuration, Select the process ID and goto Step 4 Variables & Templates kindly add a Z variable.
Now in the backend GRC system goto transaction SE37 and enter the function module GRAC_NOTIF_VAR_RULE_AR. and copy this function module and
create a custom Z Function Module and add the logic for the Z variable in the function module.
Once done activate the Function Module
Open the MSMP configuration and goto Step 2. Maintain Rules. Add this newly create Z function module as a Notification Variables Rule. Also maintain this Z Function Module in the Notification Rule under Global Rules in Step 2.
Save and Activate the MSMP workflow configuration.
Now you can use the custom Z variable in the document objects.
How to modify URL shown in GRC notification variables to enable SSO
First setup Single Sing On (SSO) between Enterprise Portal and GRC system.
Once done, create a Portal iView in Content Adminstration -> Portal Content Management using standard GRC Access Control iView Template.
In the template, Application Name, Configuration Name, System, Location etc fields are maintained and once the template is maintained then PERMISSIONS need to be maintained for iView.
Once the above steps for creation of portal iview are completed, modify the URL used in the notification variables by creating a Custom Notification Variable Function module and replace the URL with Portal iView which you can work with ABAPer and Portal guys to get the details.
Once all above steps are done even the approvers can access all Approval Links in Email notifications via SSO without entering UserID and Password π
Note:Deactivate password for all users in GRC System including approvers UserIDs π
Looking forward for all your inputs in improving this blog with all other additional details π
Thanks for reading.
Best Regards,
Madhu Babu Sai
HI Madhu
Great to see you targeting topics like this and showing the technical configuration.
Ways your could make this document even better would be to give a business example (and when/why you would do this) as well as a screen shot of before/after of what it looks like to the end users. That is why put the effort into configuring it and how does it improve communication for the requester/approver/etc?
It’ll greatly help the non-technical and those new to MSMP/notifications see what it’s all about.
Regards
Colleen
Hi Colleen,
Thanks a lot for your feedback π
Even I was thinking that the blog was missing something and as you suggested adding some screenshots on how notifications look with HTML tags and explaining the business purpose will add more value. I will update the blog accordingly.
Regards,
Madhu.
yeah – it’s a great bit of information but you’ll get a lot more response where people can see what you are impacting on the system π
Thanks again for your contributions.
Wow, such a nice article. I believe the author must be very smart and technically competitive. I will use this article for my future configuration reference, thank you so much for spending efforts on this topic!
Great article, clear and easy to understand!!!
Hi Madhu,
Great effort Madhu….Really it’s good document.
Regards,
Venu
Hi Madhu,
Excellent Document.
Could you let know, how to see the content of the below variables. The function module GRAC_NOTIF_VAR_RULE_AR has below links, but it does not show,whether HREF tag is available or not.
LINK_APPROVE_REJECT Link to Approve/Reject by Email
LINK_GET_APPROVERS Link to get Approvers
LINK_GET_REQ_STATUS Link to get Request Status
Regards
Plaban
Hi Plaban,
In GRAC_NOTIF_VAR_RULE_AR you can see the variables and by debugging you can see the URL or once the notifcation is recieved you can see URL from the template as well.
HREF is just to make the big URL as small link in Email notification display.
Regards,
Madhu.
Hello Madhu,
Great document and really helpful.
Thanks
GRC Admin
Hi Madhu,
Thanks for the information sharing. It is helpful.
Regards,
Fabian
Hi Fabian,
Thanks for the feedback π
Regards,
Madhu.
Thanks Madhu.
I think there is some problem with program, it’s not converting the %LINK_GET_REQ_STATUS% value in mail.
however link_approve_reject value is reflecting in the mail.
I have one more issue, when user submit Access request, 2 notofication events get trigger , 1 is REQUEST_SUBMISSION to GRAC_REQUESTER and NEW_WORK_ITEM to GRAC_MANAGER but email triggers for only one event, which system selects randomly.
I check in the SOST, sometimes mail trigger to GRAC_MANAGER & sometimes to GRAC_REQUESTER.
Could you please help me to resolve this issue.
Regards,
Pavan
Hi Madhu,
Great work.Very well defined documents.
However LINK_GET_REQ_STATUS could not be converted into URL in my receipt mail.
It’s showing %LINK_GET_REQ_STATUS% only.
Please help me on that.
And also How to define variable for End user name if I am submitting request on behalf of other person. He gets a mail if I fill the email field , I want first & last name field value to be reflected on mail.
Regards,
Pavan
Hi Pawan,
I just checked and it is working properly.
Click <A href=”%LINK_GET_REQ_STATUS%”>here</A> to view request status
For using User Name already there are standard variables provided by SAP π
Regards,
Madhu.
Hi Madhu,
fine documentation, very helpful. Thanks for this.
I have one question left:
How is it possible to get the notifications in (for example) 4 languages?
Shall I login seperately in the 4 different languages and maintain the notifications in the different languages. Could this be an solution?
Thanks and best regards
René
Hi Madhu
Thanks for sharing the doc.
Im looking for the comments entered on the Access Request when Rejecting a Request to be displayed on the Notification for Rejection mail.
Has anyone configured a variable for this?
If you have please share steps.
Thanks
Mustafa
Hi Mustafa,
There is a variable called COMMENTS which gets filled based on the comments entered during REQUEST REJECTION and FORWARD scenarios.
Just use it %COMMENTS% in your notification template.
Check below note if the variable is missing.
1917639 – UAM: Adding Comments and approver name variables in Access Request approval mail
Regards,
Madhu.
Thanks Madhu
I had to follow the SAP Note as i did not have the COMMENTS Variable.
However its not working.
Followed the steps in the note, Added variable %COMMENTS% on the Rejection Notification and still not working.
When i receive the notification it does not show the comments but shows %COMMENTS% instead.
I also went to MSMP to generate a new version but still no luck.
Regards
Mustafa
Hello Mustafa,
Please confirm how you are sending reject notification in EAM as there is no option to reject logs. Kindly refer to Note: 2151950.
Also Comments variable is not applicable for EAM log review. You can refer to Note:1660261 for available variables.
Thanks & Regards,
Chandani kaur
Hi Chandani
This is not for EAM. Its an Access Request that gets rejected and sends an email notification.
Regards
Mustafa
Hi Madhu
Any help here or should I log a message with SAP.
Regards
Mustafa
Hi Madhu,
Nice document! It’s helping me a lot but I have a question.
Can we use standard variables that are not on the list provided by SAP but are on the function module GRAC_NOTIF_VAR_RULE_AR?
An example is APPROVER_FULL_NAME.
I’ve tried to add this variable to the list on step 4 but got an error that said that the variable had to begin with x*, y* or z*.
Best regards,
Denise
Hi Denise,
You can add but you cannot do it from MSMP workflow configuration Step 4.
Execute GRFNMW_CONFIGURE Tcode (Expert Mode). From here you can add, you will get a warning to select correct namespace but you just click enter and it will allow you to save the changes π Just try and let me know if you face any issue.
Regards,
Madhu.
Thank you Madhu
It worked perfectly! π
Best regards,
Denise
Hi Madhu,
I manage to configure the variables via GRFNMW_CONFIGURE like you said but here is the catch: for the rejection notification I had no problems with the variables but for the approval one, the variables are not showing on the message.
I am a little confused because I copied both object documents from the standard and just added the variable %APPROVER_FULL_NAME%. For one document it works perfectly and for the other, it doesn’t.
Has it ever happened to you?
Thanks.
Regards,
Denise.
When this happens, have you ever used the MSMP Instance Monitor and the Messages Log to see what is happening on the calculation of that particular variable. You are able to see the calculation start and result in this tool.
Thank,
Kevin Tucholke
Madhu,
You have been a great help. Another awesome post which will help many other.
Many Thanks,
Richa Sharma
Hi Madhu,
Is there any template apart from the given
ο· GRAC_EMAILRMDR_CUP: used for Access Request Approval workflows
ο· GRAC_EMAILRMDR_SOD: used for SOD Risk Review Workflow
ο· GRCC_EMAILRMDR
to send email reminders to the affected users to follow-up with the approves of their request? these templates are used for sending reminder to approves it seems.
How to send email reminders to the requester or affected users about the status or their request periodically?
kindly shed some light…..
Thanks
Hi Experts,
Is there any variable for access request “Due Date”.
We need to include this value in the notification email to role owners.