When an IAM tool provisions access, users are not assigned ERP roles directly. They are assigned business roles: named bundles that point at ERP roles in one or more systems. A business role carries no permissions of its own, so a conflict inside one is invisible to anybody looking only at the IAM tool, and invisible to anybody looking only at the ERP system in the absence of the bundle definitions.
This data source imports those definitions. Once loaded, the risk engine treats IAM-granted access exactly like a direct ERP grant, and reports, simulation and remediation all stay aware of the business role behind the access.
Setup
- Click Add → IAM business roles
- Select the folder holding the two tables
- Click Save
One IAM data source represents one IAM system. Load several to analyze a multi-IAM landscape.
The ERP systems the business roles point at must be loaded as their own data sources. On its own, an IAM source has bundle definitions but no permissions to resolve them against.
Table format
Both tables are CSV or TSV, matched on header content, with the delimiter detected from semicolon, tab, comma, or pipe.
Business role composition
Defines each business role and the ERP roles it bundles.
| Column | Meaning |
|---|---|
Business Role | Name of the business role |
Description | What it is for |
Target System | The ERP system the role lives in, matching a loaded data source name |
Target Role | The ERP single or composite role |
One row per bundled role, so a business role spanning three ERP roles is three rows sharing a Business Role value.
Business role assignment
Maps users to the business roles assigned to them.
| Column | Meaning |
|---|---|
Canonical Name | The user's canonical identity |
Business Role | The business role assigned |
Valid From | Start of the assignment |
Valid To | End of the assignment |
Iam System | The IAM system the assignment came from |
Canonical identity matters here
Assignments key on the canonical user, not on a per-system account name. This is how one business role links to the same person across several ERP systems where their account names differ.
If your IAM tool reports an identity that does not match the account names in your ERP extracts, supply a USER_CANONICAL_MAPPING file on the ERP data sources so both resolve to the same person. Without it, IAM-granted access is attributed to a user who appears to hold nothing in the ERP system, and no risk fires. See Supplementary Data Files.
Target System values are matched against loaded data source names, with aliasing available where the IAM tool reports a different name than the one you gave the data source.
Running the analysis
IAM business roles are not analyzed by default. Enable IAM analysis in the analysis criteria and select which IAM systems to include. See Running User Analysis.
Scope
MTC Skopos analyzes and simulates business roles. It never writes back to your IAM tool and never triggers provisioning. The output is evidence you act on in your own tooling.