Skip to Content

Overview

In GRC Access control as part of Workflow approvals and reviews Managers, Role Owners, FF ID Owners and Controllers, Function/Risk/Mitigation Approvers, Monitors, Users, Requestors etc. receive various Email notifications. Based on the client’s requirements these Email notifications are enhanced and maintained. This blog is to discuss about various customizing options available for GRC notifications as well as notification variables and their limitations and scope πŸ™‚


For beginners below document gives details on how to customize email notifications templates in GRC


AC 10.0 – How to Customize Notification Templates for AC Workflow


Email Notification Templates – HTML Tags


1. HREF (For Email ID and URLs)


Business Scenario:


Notification variables which gets converted to URLs in the notification emails will have a very big URL with Path ID, Stage ID etc. Basically when the URL is not maintained as HREF using HTML tags, in most of the cases Emails get routed to JUNK folder in mailbox because of various special characters in the URL. Hence it is suggested to use HREF tag and make these GRC URLs as links which will avoid routing to JUNK folder issue as well as avoids end users directly seeing all technical details of the URL. Below are some of the variables which gets converted to URLs in notification Emails.


LINK_APPROVE_REJECT    Link to Approve/Reject by Email

LINK_GET_APPROVERS    Link to get Approvers

LINK_GET_REQ_STATUS    Link to get Request Status


Example: How the above variables look in notification emails with and without HTML tags

a. %LINK_APPROVE_REJECT%

b. Click <A HREF = %LINK_APPROVE_REJECT% > here </A> to approve/reject the request

                                                                     

2. To Include GRC Help-desk Email

Business Scenario:


When end users receive email notifications for GRC related requests then most of the times we observed that users will have queries with the Emails or about their GRC requests and wanted to contact concerned GRC Admin/Help-desk for clarifications. In order to make it easy for end users to contact HELP-DESK, we can include Email ID in notification emails.


Example: How to include Email link in notifications


Please contact GRC Admin at <A href=”mailto:Test@test.com“> GRC Helpdesk </A>


3. BOLD, UNDERLINE and ITALICIZE


Reason behind sharing details about BOLD, UNDERLINE and ITALICIZE tags is because these doesn’t work with traditional HTML tags like <B> <U> and <I> in notification templates.


Example: <strong> <span style=”text-decoration: underline;”> Quick Reference for approvers: </span> </strong>

Example:

<span style=”font-style: italic;”>

Select the approval status as “REJECT” beside the role that you wish to reject.

</span>


How to insert Company Logo in Email Notification Templates


First you need to store the Logo which you want to use in Email notifications in GRC MIME repository


Go to SE80 Tcode and click on MIME REPOSITORY. Import the Logo which you wanted to use into MIME objects repository as shown below:

Mime1.png

Mime 2.png

Mime 3.png

Once the above activities are completed, the next step is to use the LOGO in Email notification Templates.

Note: URL for logo is no transportable and need to be individually changed in each system when notification template is transported.

Use the image source tag as shown below:

<img src = “http://my_server.my_domain/sap/public/bc/ur/MyLogo.png“>

Example: <img src = “http://myserver_mydomain/sap/public/bc/ur/MyLogo.png“>

How to create New Message Class for Notification Templates


How to create new Message Class for any workflow in GRC ?

Very common requirement is customers request to have specific Email notifications at each stage individually and for such scenarios it might require creation of Custom message classes to be used at various stages in workflow and you can follow below process for creating new message classes πŸ™‚

Example: For EAM Log Review Workflow there are no FORWARD and RETURN Message Class available.

Execute Tcode SM30

Open table GRFNVNOTIFYMSG and click on Maintain button and then click on “NEW ENTRIES” and maintain as below and once done click on SAVE button

Execute Tcode SM30

Open table GRFNVNOTIFYMSGC and click on Maintain button and then click on “NEW ENTRIES” and maintain as below and once done click on SAVE button

Once the above mentioned activities are completed, now the newly created Message Class can be added to your MSMP Variables & Templates Notification Templates section as shown below

Notification Variables in GRC


Each workflow process comes with a number of notification variables that are available to all notification templates that belong to it. They are displayed on the bottom of the screen in step 4, ”Variables & Templates”, in the customizing activity Maintain MSMP Workflows.


Few queries regarding Notification Variables customization especially %PROVISIONING% and %PROVISIONING_WITHOUT_PASSWORD%


For ARQ provisioning there are 2 variables which are sent along with END OF REQUEST notification( with Roles and Password details) PROVISIONING and PROVISIONING_WITHOUT_PASSWORD

These variables are standard variables which are calculated run-time.. if you are not happy with the formatting, please raise a CSS message and let SAP developer fix that for you.. there is no customizing available for it..

Other option can be to have your own custom variable created, but again that require development πŸ™‚

2012041 – Is it possible to suppress the role details in the variable %PROVISIONING%


1854408 – Potential information disclosure relating to user password


How to create custom notification variables in GRC


In the MSMP configuration, Select the process ID and goto Step 4 Variables & Templates kindly add a Z variable.

Now in the backend GRC system goto transaction SE37 and enter the function module GRAC_NOTIF_VAR_RULE_AR. and copy this function module and

create a custom Z Function Module and add the logic for the Z variable in the function module.

Once done activate the Function Module

Open the MSMP configuration and goto Step 2. Maintain Rules. Add this newly create Z function module as a Notification Variables Rule. Also maintain this Z Function Module in the Notification Rule under Global Rules in Step 2.

Save and Activate the MSMP workflow configuration.

Now you can use the custom Z variable in the document objects.


How to modify URL shown in GRC notification variables to enable SSO


First setup Single Sing On (SSO) between Enterprise Portal and GRC system.


Once done, create a Portal iView in Content Adminstration -> Portal Content Management using standard GRC Access Control iView Template.


In the template, Application Name, Configuration Name, System, Location etc fields are maintained and once the template is maintained then PERMISSIONS need to be maintained for iView.


Once the above steps for creation of portal iview are completed, modify the URL used in the notification variables by creating a Custom Notification Variable Function module and replace the URL with Portal iView which you can work with ABAPer and Portal guys to get the details.


Once all above steps are done even the approvers can access all Approval Links in Email notifications via SSO without entering UserID and Password πŸ™‚


Note:Deactivate password for all users in GRC System including approvers UserIDs πŸ™‚


Looking forward for all your inputs in improving this blog with all other additional details πŸ™‚

Thanks for reading.

Best Regards,

Madhu Babu Sai


To report this post you need to login first.

29 Comments

You must be Logged on to comment or reply to a post.

  1. Colleen Hebbert

    HI Madhu

    Great to see you targeting topics like this and showing the technical configuration.

    Ways your could make this document even better would be to give a business example (and when/why you would do this) as well as a screen shot of before/after of what it looks like to the end users. That is why put the effort into configuring it and how does it improve communication for the requester/approver/etc?

    It’ll greatly help the non-technical and those new to MSMP/notifications see what it’s all about.

    Regards

    Colleen

    (0) 
    1. Madhu Babu Post author

      Hi Colleen,

      Thanks a lot for your feedback πŸ™‚

      Even I was thinking that the blog was missing something and as you suggested adding some screenshots on how notifications look with HTML tags and explaining the business purpose will add more value. I will update the blog accordingly.

      Regards,

      Madhu.

      (0) 
      1. Colleen Hebbert

        yeah – it’s a great bit of information but you’ll get a lot more response where people can see what you are impacting on the system πŸ™‚

        Thanks again for your contributions.

        (0) 
  2. Bokun Ma

    Wow, such a nice article. I believe the author must be very smart and technically competitive. I will use this article for my future configuration reference, thank you so much for spending efforts on this topic!

    (0) 
  3. Plaban Sahoo

    Hi Madhu,

    Excellent Document.

    Could you let know, how to see the content of the below variables. The function module GRAC_NOTIF_VAR_RULE_AR has below links, but it does not show,whether HREF tag is available or not.

    LINK_APPROVE_REJECT    Link to Approve/Reject by Email

    LINK_GET_APPROVERS    Link to get Approvers

    LINK_GET_REQ_STATUS    Link to get Request Status


    Regards

    Plaban

    (0) 
    1. Madhu Babu Post author

      Hi Plaban,

      In GRAC_NOTIF_VAR_RULE_AR you can see the variables and by debugging you can see the URL or once the notifcation is recieved you can see URL from the template as well.


      HREF is just to make the big URL as small link in Email notification display.


      Regards,

      Madhu.

      (0) 
      1. pavan amarnani

        Thanks Madhu.

        I think there is some problem with program, it’s not converting the %LINK_GET_REQ_STATUS% value in mail.


        however link_approve_reject value is reflecting in the mail.

        I have one more issue, when user submit Access request, 2 notofication events get trigger , 1 is REQUEST_SUBMISSION to GRAC_REQUESTER and NEW_WORK_ITEM to GRAC_MANAGER but email triggers for only one event, which system selects randomly.

        I check in the SOST, sometimes mail trigger to GRAC_MANAGER & sometimes to GRAC_REQUESTER.

        Could you please help me to resolve this issue.

        Regards,

        Pavan

        (0) 
  4. pavan amarnani

    Hi Madhu,

    Great work.Very well defined documents.

    However LINK_GET_REQ_STATUS could not be converted into URL in my receipt mail.

    It’s showing %LINK_GET_REQ_STATUS% only.

    Please help me on that.

    And also How to define variable for End user name if I am submitting  request on behalf of other person. He gets a mail if I fill the email field , I want first & last name field value to be reflected on mail.

    Regards,

    Pavan

    (0) 
    1. Madhu Babu Post author

      Hi Pawan,

      I just checked and it is working properly.

      Click <A href=”%LINK_GET_REQ_STATUS%”>here</A> to view request status

      For using User Name already there are standard variables provided by SAP πŸ™‚

      Regards,

      Madhu.

      (0) 
  5. RenΓ© SchrΓΆder

    Hi Madhu,

    fine documentation, very helpful. Thanks for this.

    I have one question left:

    How is it possible to get the notifications in (for example) 4 languages?

    Shall I login seperately in the 4 different languages and maintain the notifications in the different languages. Could this be an solution?

    Thanks and best regards

    René

    (0) 
  6. Mustafa Motalib

    Hi Madhu

    Thanks for sharing the doc.

    Im looking for the comments entered on the Access Request when Rejecting a Request to be displayed on the Notification for Rejection mail.

    Has anyone configured a variable for this?

    If you have please share steps.

    Thanks

    Mustafa

    (0) 
      1. Mustafa Motalib

        Thanks Madhu

        I had to follow the SAP Note as i did not have the COMMENTS Variable.

        However its not working.

        Followed the steps in the note, Added variable %COMMENTS% on the Rejection Notification and still not working.

        When i receive the notification it does not show the comments but shows %COMMENTS% instead.

        I also went to MSMP to generate a new version but still no luck.

        Regards

        Mustafa

        (0) 
        1. Chandani Kaur

          Hello Mustafa,

          Please confirm how you are sending reject notification in EAM as there is no option to reject logs. Kindly refer to Note: 2151950.

          Also Comments variable is not applicable for EAM log review.  You can refer to Note:1660261 for available variables.

          Thanks & Regards,
          Chandani kaur

          (0) 
  7. Denise Martins

    Hi Madhu,


    Nice document! It’s helping me a lot but I have a question.

    Can we use standard variables that are not on the list provided by SAP but are on the function module GRAC_NOTIF_VAR_RULE_AR?

    An example is APPROVER_FULL_NAME.

    I’ve tried to add this variable to the list on step 4 but got an error that said that the variable had to begin with x*, y* or z*.

    Best regards,

    Denise

    (0) 
    1. Madhu Babu Post author

      Hi Denise,

      You can add but you cannot do it from MSMP workflow configuration Step 4.

      Execute GRFNMW_CONFIGURE Tcode (Expert Mode). From here you can add, you will get a warning to select correct namespace but you just click enter and it will allow you to save the changes πŸ™‚ Just try and let me know if you face any issue.

      Regards,

      Madhu.

      (0) 
      1. Denise Martins

        Hi Madhu,

        I manage to configure the variables via GRFNMW_CONFIGURE like you said but here is the catch: for the rejection notification I had no problems with the variables but for the approval one, the variables are not showing on the message.

        I am a little confused because I copied both object documents from the standard and just added the variable %APPROVER_FULL_NAME%. For one document it works perfectly and for the other, it doesn’t.

        Has it ever happened to you?

        Thanks.

        Regards,

        Denise.

        (0) 
        1. Kevin Tucholke

          When this happens, have you ever used the MSMP Instance Monitor and the Messages Log to see what is happening on the calculation of that particular variable.  You are able to see the calculation start and result in this tool.

          Thank,

          Kevin Tucholke

          (0) 
  8. Ivan Wee

    Madhu,

    You have been a great help. Another awesome post which will help many other.

    Many Thanks,

    Richa Sharma

    (0) 
  9. Basis Kaar

    Hi Madhu,

    Is there any template apart from the given

    ο‚· GRAC_EMAILRMDR_CUP: used for Access Request Approval workflows

    ο‚· GRAC_EMAILRMDR_SOD: used for SOD Risk Review Workflow

    ο‚· GRCC_EMAILRMDR

    to send email reminders to the affected users to follow-up with the approves of their request? these templates are used for sending reminder to approves it seems.

    How to send email reminders to the requester or affected users about the status or their request  periodically? 

    kindly shed some light…..

    Thanks

    (0) 
  10. Achala Khare

    Hi Experts,

     

    Is there any variable for access request “Due Date”.

    We need to include this value in the notification email to role owners.

     

    (0) 

Leave a Reply