According to the SAP wiki2, you can use the Reaffirm Approval option in the MSMP Workflow stage configuration to confirm the identity of an approver when processing an access request. This option requires the approver to enter their user ID and password again before approving or rejecting a request.

According to the SAP wiki, you can enable three change logs to make all changes to access rules auditable in the SAP Access Control application: access rule, rule set, and function. The access rule change log records changes made to individual access rules. The rule set change log records changes made to rule sets and their assignments. The function change log records changes made to functions and their assignments.

According to the SAP Press blog3, the data synchronized with GRAC_AUTH_SYNCH can be used to populate the Role Analysis Dashboard, which is a tool that provides an overview of roles and authorizations across connected systems. The data can also be used to populate authorization object text descriptions, which are labels that describe what an authorization object does or controls. The data cannot be used to define a new function or roles in Business Role Management, as these tasks require manual input or configuration.

According to the SAP Blogs1, Business Role Management provides several capabilities for managing roles in SAP Access Control. Some of these capabilities are: Facilitate role creation at the function level (A), Align role definitions with business processes , and Standardize methodology for role assignment (D). These capabilities help to simplify and automate the role design and maintenance process. Therefore, A, C and D are the correct answers. B and E are not valid capabilities of Business Role Management, as they are related to other scenarios, such as Role Certification and Emergency Access Management. Reference: 1 https://blogs.sap.com/2019/03/14/sap-access-control-12-role-certification/

According to the SAP Help Portal1, two of the methods that can be used to notify a controller of a new EAM session log are: Email and Workflow (D). These methods can be configured in the Customizing activities for Emergency Access Management. Email notifications can be enabled by setting parameter 4009 to Yes and customizing the notification messages and text. Workflow notifications can be enabled by configuring the Agent ID GRAC_SPM_CNTL_AGENT and assigning it to the relevant workflow paths and stages. Therefore, C and D are the correct answers. A and B are not valid methods for notifying a controller of a new EAM session log, as they are related to other scenarios, such as Support Message (A) and Log Display (B). Reference: 1 https://help.sap.com/doc/e2ccae7ee6354b169cf845cd665e07fe/1.0%202016-07/en-US/frameset.htm?frameset.htm