Thank you Peter for the quick response! Just to clarify though, if you were to go with option 1 and add these "position" (role) objects to users in the target ECC system, using the SAP provisioning framework, and 7.2's sap_abap_getNameOfPendingPrivileges script, it would result in the associated roles / privs being directly assigned to the user in the target ECC system, unlike a role / priv assignment that would come from TCODE PO13; where instead of it being a direct assignment, it is an indirect assignment (or as seen in the screenshot, it is seen that the "Assignment comes from HR organization management").
Peter / Matt, I have attached the screenshots taken from a user's profile in the target ECC system, and to clearly show the two different possibilities for a role / priv assignment in the ECC target system, through the roles tab of SU01; DIRECT & INDIRECT
Looking at the first screenshot (DirectAssignment.png) it can be seen that a standard role assigned to the user via SU01 (standard IDM role provisioning, will also assign the role / priv to a user in this manner), shows up as a direct assignment ("=" symbol).
Instead when looking at the second screenshot (IndirectAssignment.png), for a role that is assigned to the user not via SU01, but via TCODE PO13; the role rather than being directly assigned to the user, is inherited / indirectly assigned to the user by way of assigning a position to the user in TCODE PO13 (in SU01, it shows up as a symbol of a person, instead of the "=" symbol).
An overview of the user's SU01 Roles tab can be seen in the third screenshot (overview.png), where the 2 different types of assignments can be clearly seen in the "Indirect" column, highlighted in red.
How can IDM 7.2 be used to provision a role / priv in this second manner? so that it does NOT show up as a direct assignment in SU01, but be seen that the "Assignment comes from HR organization management".
Thanks a ton for your help so far!
Best regards,
Sandeep