Automate Service Request creation for SAP authorization requests

The problem

A significant part of SAP tickets are related to authorizations. End users may need access to additional transactions, additional functions in certain transactions or access to more data.

At some companies, 50% of SAP tickets are Service Requests for additional SAP authorizations, and the other 50% are incidents.

The classic way of requesting authorization is writing an email to the service desk or maybe calling them on the phone. Sometimes these calls are not logged in a ticketing system which is problematic when you have an audit, and of course in this case your reporting will be incomplete.

Partial solution

A better approach is to let the users request the new authorizations using a portal. Many companies have implemented this in ServiceNow, by setting up a Service Catalog Item dedicated for SAP authorization requests.

However, it is still a half-baked solution, as the SAP end users must manually specify all data (affected SAP system, client, user, transaction etc.).

Additionally, in case of a more complex authorization request, the required authorization is not obvious.

The security team must spend a lot of time figuring out exactly what SAP authorization the user needs.

Automation using an SAP add-on

Many of our customers have requested custom developments to automate the creation of Service Requests in ServiceNow using our ITSM Connector for SAP.

Most of the time, that product is used for submitting incidents from SAP GUI and Fiori. However, we made it possible to submit Service Requests based on user selection.

Earlier this was delivered as a custom development, but now it is part of our standard product.

When you start the ticket creation in SAP GUI, you can now find a radio button that the user can use to select the ticket type. If the user selects "I have an Issue", the ITSM Connector will create an incident in ServiceNow.

If the user chooses "I need additional SAP access" then a Service Request will be created. The Service Catalog Item to use can be specified in a customizing transaction as well as the variables to populate.

Even more automation

You can also define templates for specific error messages, so even the short and the long description can be filled automatically.

So, let's start with a common example: request authorization for a transaction. The end user most likely receives the following error:

When the user starts the ITSM Connector from the Help menu in SAP GUI, the program detects that a template exists for this error message and will offer you the use the template:

These templates can contain dynamic values, like the SAP system name, client, username and so on. This feature works with all ticket types, but in this article, I'll focus on the authorization-specific Service Requests.

By choosing to use the template, the subject will be populated automatically, and the ticket type (Service Request) will be selected by default.

The user only needs to specify the reason for the request and press the Send button.

Result for the end user

The user receives a success message with the Requested Item number and has the option to open it in the ServiceNow portal:

If the user opens the Requested Item, it will be displayed using the ServiceNow portal (configurable URL):

Result for the support team

Technically, there will be a Request (REQ) and a Requested Item (RITM) created. Both will be routed and categorized automatically. All fields are populated as you define in a simple configuration in SAP. For example, the affected Configuration Item and Business Service fields are filled. Naturally the ticket is assigned directly to the relevant resolver group, in this case it is called "SAP Security":

All the variables are filled automatically by the program, so there is no chance of error:

Here is a screenshot of the Request:

SU53 to the rescue

Finally, the output of transaction SU53 is automatically attached (along with a screenshot, system, user and program details) to the Requested Item, which greatly helps the security team to solve the ticket faster:

If the user requests authorization for a new transaction, then it is fairly simple.

However, if the user needs access to more data in for example in the SD module, the security team may must search for the required authorizations. This may take significant time.

Here is an example how the ITSM Connector can help you with that. You can see on the screenshot below that the SU53 output (attached to the ServiceNow ticket automatically as a HTML file) clearly shows what authorization is missing:

Benefits

As you can see, the ITSM Connector for SAP can:

• Fully automate the process of requesting SAP authorizations
• Help SAP end users to submit the relevant Service Request
• Help the service desk by routing and categorizing the tickets automatically
• Help the SAP security team by attaching the SU53 authorization report so they will know exactly which authorizations to provide

Coming up

I will write about a similar topic: creating Service Requests from SAP which are related to business.

If you like this article, please share it and subscribe to my newsletter. Additionally, ?If you like my posts, please follow me Tamás Holics and press the????icon on my profile so you get notified about my new posts: