SAP Identity Management ends in 2027: Entra ID, SailPoint or Saviynt?
SAP stops regular fixes for Identity Management in 2027, and there's no version 9 to move to. We read what SAP and Microsoft actually said, compared how Entra ID Governance, SailPoint and Saviynt would take over, and put the work in the order that keeps logins working.
part 4 of 9 · Before you sign an identity contractthe ideaSAP IdM retires in 2027. Move its work one system at a time.
after reading, you can- Tell what changes when SAP stops fixing IdM. Then weigh what paying until 2030 really buys you
- Pick between Entra ID Governance, SailPoint and Saviynt using your own IdM jobs
- Plan the move one SAP system at a time without two systems writing at once
SAP stops regular fixes for Identity Management in 2027, and there won't be a version 9 to upgrade to. If your company runs SAP IdM, pick its replacement this quarter and start moving the HR feed and SAP provisioning in 2026. Below we go through what SAP and Microsoft really said and where the usual replacements differ. Then we lay out an order of work that keeps people's access intact while you switch.
The tool that creates and removes everyone's SAP logins is being retired
SAP Identity Management (IdM) is the software many SAP customers use to give staff their logins. When HR hires someone, IdM creates their SAP user and assigns roles. When they change jobs it adjusts that access, and when they leave it locks the account. SAP will stop regular fixes for it in 2027 and has no newer version to move to. So the work IdM does every day has to move to another product before then, or the company pays extra for a few more years of support.
Think of the person at the front desk who issues and cancels building badges. The agency that supplies them has said it's closing. The badges keep working for now, but nobody will train a replacement or fix the badge printer, so you need to hire someone new and hand over the visitor book before the last day.
- Companies running SAP IdM 8.0
- SAP Basis and security teams
- IAM leads with SAP in scope
- Auditors who test SAP access
- CIOs budgeting for 2026–2027
Why it matters to you
When mainstream maintenance ends, IdM keeps running. What stops is SAP's regular flow of fixes. SAP offers extended maintenancedefinitionSupport SAP sells after mainstream maintenance ends. For IdM it runs to 2030 and costs extra, so ask SAP what it covers. until 2030 at extra cost, so you can buy time. But it's still a product on its way out, and every new SAP or cloud system you add has to be wired into it anyway.
The real risk sits in the leaver process. IdM is often the only thing that locks a departing employee out of SAP. If it breaks after support ends and nobody can fix it, ex-staff keep their SAP access, and auditors may find that before you do.
Analysts at KuppingerCole were blunt about it back then. They didn't think three years was enough time to swap out an identity governance platform. Whatever you pick will probably run for 10 to 15 years, too. They also noted the extra years cost only a little more than the normal fee. So 2030 is a real fallback. Budget for it on purpose instead of drifting into it.
-
01 Read the Identity Store
Export people, roles, privileges, jobs and scripts, and note which system each job feeds.
-
02 Move the HR feed
Joiners, movers and leavers start flowing from SuccessFactors or SAP HCM into the new platform.
-
03 Move SAP provisioning
The new platform takes over creating users and roles in ECC and S/4HANA. You switch one system, check it, then do the next.
-
04 Rebuild roles and approvals
IdM business roles become access packages or roles, with approvals, risk checks and reviews.
-
05 Switch off IdM
When no system depends on IdM any more and its history is saved, you shut it down. Nobody should notice.
For engineers: connectors are the well-documented part. The harder part is logic hidden in IdM job scripts, things like username rules, client handling, license types and contractor end dates. Each one needs an owner and a decision, or it quietly disappears at cut-over and the first leaver after go-live exposes it.
What SAP and Microsoft actually said
SAP put out the end-of-maintenance notice first. Microsoft followed nine days later, saying the two were building a path to Microsoft Entra ID and that SAP had picked Entra to recommend. Plenty of people read that as SAP backing one product. KuppingerCole pointed out that SAP's own post says something narrower: SAP keeps investing in its own SAP Cloud Identity ServicesdefinitionSAP's cloud service that signs people in, keeps a user directory and pushes accounts into SAP apps. Entra goes through it to reach S/4HANA, and SailPoint to reach SAP cloud apps. and SAP Cloud Identity Access Governance (IAG), and makes them easier to connect to partner tools such as Entra.
The changes that shape your options
SAP's public pages say mainstream maintenance ends in 2027. Your exact date sits in SAP's Product Availability Matrix, behind the customer login, so check it there.
SAP sells a few more years of support at extra cost. Ask SAP what that support covers before you count on it, because the end date doesn't move.
There's no IdM 9.0. Replacing it means a migration to a different product, and you can't do it as an in-place upgrade.
Microsoft and SAP wrote a guide that takes each IdM job and names the Entra feature that replaces it. Microsoft still updates it, most recently in July 2026. It also admits the hookup to SAP Access Control and IAG is still changing, so test it before you lean on it.
Microsoft's July 2026 post covers the newer SAP pieces. Entra can now send custom SAP attributes and find SAP accounts that don't match an Entra user yet. Its connector also signs in with OAuth client credentials. Expect to lean on that account matching during the parallel run.
SAP IAG business roles can sit inside Entra access packages. A request goes to IAG, which runs its own approvals and further checks. It needs Entra ID Governance or Entra Suite licences.
SailPoint pitches both Identity Security Cloud and IdentityIQ at teams leaving SAP IdM. Its SAP connectors talk to GRC and IAG for risk checks, and to SAP Cloud Identity Services for the cloud apps.
Saviynt markets its Identity Cloud as an IdM replacement covering governance, privileged access and application GRC, with access analysis down to SAP transaction codes.
The dates behind the decision
- Feb 2024SAP announces end of maintenance
SAP sets 2027 as the end of regular fixes and sells extra years to 2030. That's when the clock started for everyone on IdM.
- Feb 2024Microsoft and SAP collaboration
Microsoft says it's working with SAP on a way to move IdM scenarios to Entra ID.
- Jun 2024First migration guidance
Microsoft's first guide covers the common jobs, like sign-in, the HR feed and provisioning. Deeper governance topics were promised for later.
- Jul 2026Entra SAP integration roundup
Microsoft posts a summary of the SAP pieces it has added, including the IAG link. Worth reading before you design anything.
- 2027Mainstream maintenance ends
Regular fixes stop. Anything still on IdM runs on extended maintenance or with no support at all.
- 2030Extended maintenance ends
The end of SAP's announced extended maintenance. Plan to be off IdM by then.
The options side by side
Most teams end up choosing between four routes. SAP's own cloud services are one of them, and they're the base layer for two of the others, since Entra reaches S/4HANA through SAP Cloud Identity Services, and SailPoint uses it for SAP cloud apps.
| Question | SAP Cloud Identity Services + IAG | Entra ID Governance | SailPoint | Saviynt |
|---|---|---|---|---|
| What it is | SAP's own cloud identity and access governance services | Microsoft's identity governance add-on to Entra ID | Identity Security Cloud (SaaS) or IdentityIQ (self-hosted) | Identity Cloud, a SaaS identity platform |
| HR feed from SuccessFactors | Check SAP's docs for your setup | Native inbound connector | Through SAP Identity Provisioning | Confirm with Saviynt per system |
| Provision SAP ECC | Check SAP's docs for your release | Provisioning agent and web services connector calling ECC BAPIs | Governance for on-premises ECC and S/4HANA | Says it covers hybrid SAP estates |
| Provision S/4HANA and SAP cloud apps | Check SAP's docs | Through SAP Cloud Identity Services | SAP cloud apps through SAP Cloud Identity Services; governance for on-premises S/4HANA | Says it supports S/4HANA moves |
| SAP risk and SoD checks | IAG, or Access Control on-premises | Hands off to SAP IAG or a partner such as Pathlock | SAP GRC, the GRC-IAG bridge, or SailPoint Access Risk Management | Says it has its own cross-application SoD, down to transaction codes |
| Strongest fit | Mostly SAP, few non-SAP systems | Microsoft-heavy shops where SAP is one of many apps | Large role models and many non-Microsoft systems | Teams that want governance and SAP access risk in one product |
Entra is often the cheapest place to start if you own a Microsoft 365 enterprise suite, because those include Entra ID P1 and basic provisioning runs on P1. Lifecycle workflows, automatic access packagedefinitionA bundle of access in Entra ID Governance, such as groups and app roles, that people request or get automatically. IdM business roles usually become access packages. assignment and the IAG integration need Entra ID Governance, which also comes with Entra Suite and Microsoft 365 E7. The gap shows up in SAP risk. Entra checks separation of dutiesdefinitionA control that stops one person from getting two powers that shouldn't go together. Creating a vendor and approving its payment is the classic pair. between access packages, but SAP-level checks on transactions and authorization objects come from SAP IAGdefinitionSAP Cloud Identity Access Governance. Staff ask for SAP access there, and IAG checks the request against separation-of-duties rules before anyone gets it., SAP Access Control or a partner tool.
SailPoint and Saviynt are full governance platforms with deep SAP connectors, and they make sense when SAP is one large piece of a much bigger estate. SailPoint's SAP GRC connector creates access requests in GRC and waits for GRC to approve or reject them, so GRC stays in charge of risk. Its documentation says the connector needs extra licensing, and the GRC-IAG bridge needs separate SAP licences for both GRC and IAG. Saviynt pitches its own application GRC, with cross-application SoD checks, as part of the same product.
KuppingerCole's rule of thumb is a useful tiebreaker. SAP Cloud Identity Services leans on SCIM for provisioning, and SCIM is rare in older on-premises applications. The more non-SAP and legacy systems you have, and the bigger the company, the more likely you need a broader platform than SAP's own.
- Runs in the Entra tenant you already have. You may own some licences already
- One admin team runs the HR feed and Microsoft 365 access. Fewer consoles to learn
- SAP risk checks handed to IAG or a partner
- Business roles become access packages
- Check whether the SAP IAG link is still in preview
- A new platform, contract and admin team to stand up
- Goes deep into SAP and reaches well past Microsoft's world
- SAP access certifications and SoD options
- SoD through SAP GRC (SailPoint) or built in (Saviynt)
- Extra connector or module licences to price
How IdM pieces map to the new platform
| SAP IdM today | In Entra | In SailPoint or Saviynt | Watch out for |
|---|---|---|---|
| Identity Store (MX_PERSON) | Users in the Entra tenant, with extension attributes for SAP fields | Identities on the platform | Attributes Entra's schema lacks need extensions before you load users |
| Business role (MX_ROLE) | Entitlement management access package | Role, or business role in IdentityIQ | Roles nobody holds any more, carried over by habit |
| Privilege (MX_PRIVILEGE) | App role or security group | Entitlement on the SAP account | Privileges per SAP client and system |
| Jobs and custom JavaScript | Built-in provisioning rules, lifecycle workflows, Logic Apps | Rules, workflows and connector settings | Naming and end-date logic nobody wrote down |
| SuccessFactors or HCM read | SuccessFactors inbound provisioning; HCM through SAP Integration Suite | SAP HR connectors | Pre-hires, rehires and contractor records |
| Logon Help password reset | Self-service password reset with writeback to AD | Platform password management | Users who need to register before the switch |
| SPML provisioning | SCIM or the web services connector | SCIM or native connectors | Microsoft recommends moving apps off SPML |
| Approvals and GRC checks | Access package approvals, plus SAP IAG or a partner for SAP risk | SAP GRC connector or the platform's own SoD | Where the risk check runs, and who signs off |
Before: SAP IdM sits between HR and every SAP system
SAP IdM reads the HR feed and runs jobs with custom JavaScript that create users and assign roles in ECC and S/4HANA. SAP GRC Access Control checks risk on requests. Non-SAP apps are often already governed separately in Entra ID.
After: IdM is gone and SAP risk checks still run where they did
The HR feed goes into the new governance platform. It provisions ECC directly and S/4HANA and SAP cloud apps through SAP Cloud Identity Services. SAP risk checks run in IAG or GRC, and IdM is gone.
A detail that catches people out: in Microsoft's design, S/4HANA doesn't get users straight from Entra. Users have to be in Entra ID first, then Entra provisions them to SAP Cloud Identity Services, and that service provisions S/4HANA. For S/4HANA on-premises, the path runs through the SAP Cloud Identity Directory and the SAP cloud connector. ECC is different again: Entra calls ECC's user BAPIs through the provisioning agent, so someone on the Basis team has to expose those BAPIs first.
What to do now
What to do now, by who you are
- Ask your SAP account team for your exact IdM maintenance end date and the price of extended maintenance to 2030.
- Pick a target platform before the 2027 budget closes. Waiting for the S/4HANA project to finish is how teams end up on extended maintenance.
- Put one person in charge of the whole replacement. Basis, identity and HR all touch it, and without an owner each waits for the others.
- Export the Identity Store entry types, repositories, jobs, tasks and scripts, and list which SAP system and client each job writes to.
- Mark jobs that haven't run in a year. Many can go without replacing them.
- Check which ECC systems will need user BAPIs exposed for the new platform, and on what NetWeaver release.
- Write down every script's logic in plain words: usernames, email creation, license types, contractor end dates.
- Map each IdM business role to a target role or access package, and flag roles nobody holds.
- Decide where SAP separation-of-duties checks will run after IdM: IAG, Access Control, a partner tool or the new platform.
- Agree which IdM provisioning and approval history you need to keep, and for how long.
- Ask for that history to be exported before IdM is switched off. Entra keeps its own audit log for 30 days unless you send it to Azure Monitor.
- Plan one access review on the new platform soon after go-live, so you have evidence the switch didn't widen access.
- Readiness check: someone has your exact end date from SAP in writing. You've also decided whether to buy the extra years, so the budget isn't a surprise.
- Each IdM job and script has an owner who has decided its fate. Anything marked rebuild is written down in plain words first.
- The HR source of record is agreed: SuccessFactors, SAP HCM, or both through SAP Integration Suite.
- You know how each SAP system and client will get its users. ECC is usually direct, S/4HANA and cloud apps go through SAP Cloud Identity Services, and the rest get a ticket.
- You know where SAP risk checks run after IdM, and the licences for it are priced.
- There's a parallel-run plan with one writer per target system at any time.
- Audit history export and retention are agreed with the auditors.
The order that keeps people's access working
- 01Inventory and decide
Export the Identity Store and job definitions. Give every job and script a keep, rebuild or retire decision, and record which target system it writes to.
- 02Stand up the new platform beside IdM
Set up the tenant or platform, extend the user schema for the SAP attributes you need, and load identities without provisioning anything yet. Compare identity counts against IdM.
- 03Move the HR feed
Connect SuccessFactors or SAP HCM to the new platform. Run it read-only first and compare joiners, movers and leavers with what IdM did the same week.
- 04Move SAP targets one at a time
Pick a low-risk SAP system and client, stop IdM writing to it, and turn on the new platform. Check that users get created, roles get assigned and leavers get locked, then move to the next one.
- 05Rebuild roles, approvals and risk checks
Bring business roles across as access packages or roles. Connect SAP risk checks to IAG, Access Control or the new platform, and test approvals with real approvers from request to provisioning.
- 06Retire IdM
Once no system has IdM as its writer, export the provisioning and approval history, stop the jobs, and decommission the servers and database.
Harden so the next move hurts less
Durable fixes worth making during the migration
- 01Write the logic down once
Every rule you dig out of an IdM script goes into a short design document with an owner. The next platform change starts from that, and nobody has to read old JavaScript again.
- 02Keep risk checks where SAP knowledge lives
SAP authorization objects and transaction-level conflicts need a tool that understands them. Decide that home explicitly so it doesn't fall between two teams.
- 03Govern technical users too
SAP technical and RFC users that may never have been under IdM should get owners and regular reviews on the new platform, the same as service accounts and AI agents calling SAP APIs.
- 04Send audit logs somewhere durable
Route the new platform's audit and provisioning logs to your SIEM or Azure Monitor from day one. A short default retention is a bad surprise during an audit.
- 05Prefer standard protocols
Move apps off SPML and custom scripts to SCIM or supported connectors where you can. That's what makes the next swap a configuration job and not a rewrite.
If the switch goes wrong
If a target system breaks after cut-over
Most failures show up as people missing access on Monday morning, or as leavers who still have it. Because IdM is still installed during the parallel run, you can usually fall back one system at a time.
- 01Stop the damagefirst hour
- Pause the new platform's provisioning to the affected SAP system so it stops writing.
- Give the service desk a short note on which system broke and what users will see. They'll get the calls before you do.
- Lock any accounts that should have been disabled but weren't, by hand if needed.
- 02Find the causefirst hours
- Read the provisioning logs for the failed users and compare their attributes with what IdM used to send.
- Look for a script rule that got left behind. A username format or an SAP client setting is the usual culprit.
- Check that IdM's old job for that system is really off. If it still runs, the two platforms will keep undoing each other.
- 03Fall back or fixfirst day
- Is the fix small? Correct the mapping or the rule, then run the failed users through again.
- If not, re-enable the IdM job for that one system and leave the others on the new platform.
- 04Check accessfirst week
- Compare SAP users and roles in that system against the HR feed and the role design.
- Run a quick access review with the system owner before you try the cut-over again.
- 05Learn and adjustnext sprint
- Add the missed rule to the design document and a test for it to the cut-over checklist.
- Walk the auditors through what happened. Show them the before and after access lists, so the finding closes with evidence.
What this looks like in practice
Three SAP IdM estates you might recognise, and what we'd do in each
- the setup
- A manufacturer runs ECC with SuccessFactors, and Microsoft 365 already sits behind Entra ID. SAP IdM only handles the SAP side, and a handful of roles cover most staff.
- what happens
- IdM's leaver job is the only thing locking ECC accounts. Once fixes stop, any break leaves departed staff with SAP access until someone notices.
- what to do
- Move the SuccessFactors feed and ECC provisioning to Entra ID Governance, rebuild the few roles as access packages, and decide whether SAP risk checks stay in Access Control or move to IAG. Switch IdM off before 2027.
- the setup
- A group runs ECC and S/4HANA side by side, with GRC Access Control, Workday in some regions, and hundreds of business roles in IdM driven by custom scripts.
- what happens
- An Entra-only design can't express the role model or the SAP risk checks. The team stalls in design, and 2027 arrives with IdM still in charge.
- what to do
- Shortlist SailPoint and Saviynt against the real job inventory. Keep GRC for SAP risk in the first phase (SailPoint's GRC connector works that way), buy extended maintenance as a fallback, and move SAP systems over one at a time.
- the setup
- An ECC customer is midway through an S/4HANA programme and plans to replace IdM once the new ERP is live.
- what happens
- The ERP go-live slips, IdM's end date doesn't, and the cut-over weekend now needs identity changes nobody tested.
- what to do
- Do identity first. The new platform can provision ECC now and S/4HANA through SAP Cloud Identity Services later, which takes a dependency off the ERP cut-over.
How Cohash helps: we read your IdM jobs and roles first and recommend a platform from what they actually do. After that we move the work across with your Basis and identity teams, one SAP system at a time. See our work on Microsoft Entra ID, SailPoint and Saviynt, hire SailPoint engineers, or book an identity assessment to get the inventory done first.
What to take from this
- 01
SAP IdM leaves mainstream maintenance in 2027 and there's no IdM 9.0. Extended maintenance to 2030 costs extra and only buys time.
- 02
Microsoft says SAP recommended Entra ID, but SAP's own message is about connecting its cloud identity services and IAG to partner tools. SailPoint and Saviynt are real options too.
- 03
Entra fits Microsoft-heavy estates. SAP risk checks still run in IAG, Access Control or a partner tool.
- 04
Hundreds of roles and lots of non-SAP systems usually point to SailPoint or Saviynt. Test that against your own job list, not a demo.
- 05
The work is mostly the logic in IdM scripts. Inventory it first and give every script an owner.
- 06
Move one SAP system at a time with one writer each, and export IdM's audit history before you switch it off.
- How Cohash delivers Microsoft Entra ID: scope, roles and architecture
- How Cohash delivers SailPoint: scope, roles and architecture
- How Cohash delivers Saviynt: scope, roles and architecture
- Hire vetted Microsoft Entra ID engineers
- Identity governance
- Book a 30-minute working session with a senior engineer
01When does SAP Identity Management support end?
SAP says regular maintenance stops in 2027. You can pay for extended maintenance to 2030. The exact date for your release sits behind the SAP customer login, in the Product Availability Matrix, so ask your Basis team to pull it. IdM won't switch itself off, but nobody at SAP will keep fixing it on the normal schedule.
02Is there an SAP IdM 9.0 we can upgrade to?
No. SAP isn't releasing a successor version. Replacing IdM means moving its work to another product, such as Microsoft Entra ID Governance, SailPoint, Saviynt or SAP's own Cloud Identity Services with IAG.
03Does SAP recommend Microsoft Entra ID?
Sort of. Microsoft says SAP picked Entra ID to recommend, and the two wrote the migration guide together. SAP's own post is more careful: it keeps building its cloud identity services and IAG, and makes them easier to plug into tools like Entra. Nothing stops you from choosing another platform.
04Is Entra ID enough to replace SAP IdM on its own?
For many Microsoft-heavy companies, Entra ID Governance covers the HR feed, provisioning, access packages and reviews. SAP-level risk checks on transactions and authorization objects still need SAP IAG, Access Control or a partner tool. Large role models and many non-Microsoft systems often favour SailPoint or Saviynt.
05Which Entra licence do we need?
Basic provisioning from the HR system and to SAP needs at least Entra ID P1 for each worker. Lifecycle workflows, automatic access package assignment and the SAP IAG integration need Entra ID Governance, which also comes with Entra Suite and Microsoft 365 E7.
06Should we wait until our S/4HANA migration is done?
Usually not. The new platform can provision ECC now and S/4HANA later through SAP Cloud Identity Services. Moving identity first takes one risky dependency off the ERP cut-over.
07What happens to our IdM audit history?
Export the provisioning and approval history before you switch IdM off, and agree the format and retention with your auditors. Don't count on the new platform to hold it. Entra, for example, keeps its own audit log for 30 days unless you send it somewhere longer-lived.
08Should we buy extended maintenance?
If you can't move every SAP system before mainstream maintenance ends, extended maintenance is a sensible fallback. Analysts at KuppingerCole noted the premium is only slightly above the regular fee. Budget for it on purpose, and keep moving systems while you have it.
Three questions, about a minute
Pick an answer and we'll tell you if it's right, and why it is or isn't. The score stays in this browser.
-
Q1Your IdM leaver job is the only thing that locks ECC accounts, and your S/4HANA go-live has just slipped a year. What's the sound plan?
show the answer
B. Move the HR feed and ECC provisioning to the new platform now, and add S/4HANA later There's no IdM version to upgrade to, and tying identity to a slipping ERP date is how teams run out of time. The new platform can provision ECC now and S/4HANA later through SAP Cloud Identity Services.
-
Q2A team plans to run IdM and Entra side by side, both writing to the same SAP client for a month. What goes wrong?
show the answer
C. They fight over the same accounts and roles. A leaver can even get re-enabled Two writers to one system fight each other. Each SAP system and client should move completely to the new platform, with the matching IdM job disabled in the same change.
-
Q3You've picked Entra ID Governance, and your auditors want SAP risk checked on every request. What else do you need?
show the answer
A. Something that knows SAP risk, like IAG, Access Control or a partner tool Entra checks separation of duties between its own access packages. SAP-level risk analysis comes from SAP IAG, Access Control or a partner such as Pathlock that integrates with access packages.