SAP Identity Management replacement with Entra ID or SailPoint
Cohash replaces SAP Identity Management with Microsoft Entra ID Governance or SailPoint. We inventory the Identity Store, jobs and custom scripts, then rebuild the HR feed from SuccessFactors or SAP HCM and move provisioning to SAP ECC, S/4HANA and non-SAP targets. Business roles become access packages or SailPoint roles, SAP GRC is connected where it depends on IdM, and both systems run in parallel before IdM goes.
- 01Inventory the Identity Store
- 02HR source and identity model
- 03SAP provisioning
- 04Roles and access requests
- 05GRC and parallel run
The story
Told without the client's name or anything that could identify them.
A logistics company's identity team ran SAP Identity Management 8.0 on a database and operating system that security wanted retired, with jobs full of custom JavaScript nobody had touched in years. SAP's 2027 end of maintenance, and the lack of a direct SAP successor, made a replacement unavoidable. We exported the Identity Store entry types, jobs and scripts first and recorded which target each job fed. The HR feed, SAP provisioning and business roles were rebuilt in Microsoft Entra ID Governance, both platforms ran in parallel with one writer per SAP system, and IdM was shut down once every system and client had switched.
why it was urgentThere's no SAP product to upgrade to. SAP Identity Management loses maintenance at the end of 2027, paid extended maintenance runs to 2030, and SAP has no successor product of its own. What exists is a migration path SAP and Microsoft collaborated on, plus Microsoft's guidance for moving IdM scenarios to Microsoft Entra.
- openIdM jobs contain custom JavaScript that nobody has touched in years.
- recurringSAP GRC Access Control still gets its identity data from IdM. Someone has to plan where it comes from next.
- blockedThe IdM server runs on a database and OS version that security wants retired.
- openNon-SAP applications are already provisioned from Entra ID or SailPoint, and IdM only covers SAP.
The estate, before and after
Before: SAP Identity Management feeding the SAP estate
SAP IdM took the HR feed and provisioned SAP systems through jobs with custom JavaScript, and SAP GRC used it as its identity source. Non-SAP apps were already governed separately in Entra ID.
After: one HR feed, with Entra ID Governance provisioning SAP and non-SAP apps
Everything starts from one HR feed into Entra ID Governance. SAP S/4HANA is provisioned via SAP Cloud Identity Services, SAP ECC and non-SAP apps directly, and IdM business roles are now access packages with reviews.
How we run it, phase by phase.
5 phases take you from SAP Identity Management 8.0 (on-premises) to Microsoft Entra ID Governance or SailPoint. Each one ends with something you can check before the next starts. As you scroll, the blocks show the estate moving across.
- phase 01
Inventory the Identity Store
Export entry types like MX_PERSON, MX_ROLE and MX_PRIVILEGE, along with repositories, jobs, tasks and scripts. Note which target each job feeds, and which jobs nobody uses any more.
- phase 02
HR source and identity model
Rebuild the joiner, mover and leaver feed from SuccessFactors or SAP HCM into the new platform, extend the user schema for SAP attributes, and match identity counts against IdM.
- phase 03
SAP provisioning
Hook SAP ECC and S/4HANA up directly, or via SAP Cloud Identity Services. Then test, per system and client, that users get created, roles get assigned and leavers get locked.
- phase 04
Roles and access requests
IdM business roles become Entra access packages or SailPoint roles, and privileges map to app roles or groups. Rebuild the approval flows and access reviews alongside.
- phase 05
GRC and parallel run
Decide how SAP Access Control or IAG gets identity data and risk checks, run both platforms in parallel, and switch systems one at a time before IdM is decommissioned.
What the client got
What changed for the client once the work was done. Described, not scored: we don't publish client figures.
- result 01
One platform provisions SAP and non-SAP systems
HR's joiner, mover and leaver feed goes into Entra ID Governance, which now provisions SAP ECC and S/4HANA as well as the non-SAP apps it already covered.
- result 02
Every IdM script has an owner or was retired
Every custom JavaScript in the job inventory got a decision. Naming rules, client handling and license type logic were rebuilt deliberately or dropped knowingly.
- result 03
Business roles became access packages
Business roles became Entra access packages and privileges became app roles or groups. Approvals and access reviews moved across with them.
- result 04
GRC gets identity data by a tested design
We designed and tested how SAP Access Control gets identity data and risk checks before cut-over, because Microsoft's GRC integrations are still evolving.
- result 05
IdM is off and its history is kept
Auditors can still read the provisioning and approval history. It was exported before the IdM servers and database went.
Risks we plan for
-
GRC integration gaps
By Microsoft's own account, Entra's integrations with SAP Access Control and IAG are still evolving. Teams that depend on GRC risk analysis at provisioning time need a design they've tested before cut-over.
-
Logic hidden in scripts
IdM jobs often carry custom JavaScript for naming rules, client handling or license types. Each script needs an owner and a decision, or the behavior quietly disappears.
-
Double provisioning during parallel run
Two platforms writing to one SAP system is how accounts and roles end up flapping. Each target gets one writer at a time, no exceptions.
Where AI helps, and where it needs guardrails
Neither target needs AI to complete the move. An LLM is useful for reading old IdM job scripts and drafting a plain description of what each one does, which an identity engineer then checks. As AI agents start calling SAP APIs, their SAP technical users should be governed in the new platform with owners, narrow roles and regular access reviews, the same as service accounts.
forward deployed engineers →What you're left with
We write these for your setup, and they're working documents. Your team should be able to keep things running from them long after we've gone.
- inventory01
Identity Store and job inventory. Each script gets an owner and a keep-or-drop call
yours to keep - design02
Target design for the HR feed, SAP provisioning and how GRC gets its data
yours to keep - document03
Role map showing which access package or SailPoint role replaces each IdM business role
yours to keep - document04
Parallel-run comparison per SAP system and client
yours to keep - plan05
Decommission plan with audit data retained
yours to keep
Platforms and services on this move
Learn the background
Terms from this page in plain English. If you want the why, the field note behind it is right there.
- 01Rules
- The JavaScript snippets Auth0 used to run at login. Someone would write one to add a role to the token or block a sign-in, and each one ran after the last.in context →
- 02provisioning
- Creating, updating and removing accounts in an app automatically, based on who's assigned to it in Entra ID.in context →
- 03Extended Maintenance
- InterSystems' slower release track, the one 2025.1 and 2026.1 sit on. These lines keep getting maintenance builds for years, so they usually get fixes like this one first.in context →
- 04SAP Cloud Identity Services
- SAP's cloud service that signs people in, keeps a user directory and pushes accounts into SAP apps. Entra goes through it to reach S/4HANA, and SailPoint to reach SAP cloud apps.in context →
- 05Identity Store
- The database inside SAP IdM where people, roles, privileges and their history live. Start your inventory here, because everything else hangs off it.in context →
Certified engineers, wherever you need them.
Some clients want a project team, some want a couple of engineers on theirs. Either works. Onsite, nearshore or offshore, with handovers across time zones that keep things moving.
Onsite
Engineers at your sites in the US
Nearshore
Overlapping hours with US teams
Offshore
Overnight progress on your backlog
All time zones
Coverage handed over across time zones
01Entra ID Governance or SailPoint?
It depends on what else you govern. If most applications already sit behind Entra ID and SAP is the main IGA need, Entra ID Governance is often enough. Large role models, complex separation-of-duties rules and many non-Microsoft targets tend to favor SailPoint. We compare both against your actual IdM jobs.
02Does this have to wait for our S/4HANA move?
No. The new platform can provision to ECC now and to S/4HANA later. Doing identity first often removes a dependency from the ERP cut-over.
03What happens to IdM audit history?
We export provisioning and approval history before shutdown and keep it in a format auditors can read.
Often on the same roadmap
On-premises Active Directory to cloud-first Microsoft Entra ID
We shrink on-premises Active Directory one application at a time, moving groups, users and app authentication to Microsoft Entra ID as each app is ready.
read the case studyAD FS federation to Entra ID authentication
Converting federated domains from AD FS to Entra ID cloud authentication, moving relying parties app by app and retiring the AD FS farm.
read the case studyMoving Auth0 Rules and Hooks to Actions before Auth0 switches them off
Moving Auth0 Rules and Hooks to Actions before Hooks stop on 30 April 2027 and Rules on 31 January 2028, with token claims checked before and after each change.
read the case studyf16f8047 - 01Book a 30-minute working sessionsenior engineer
- 02Talk to an engineer about your setupreply within 24 hours
- 03See how similar projects wentcase studies
Planning this move?
A 30-minute working session with a senior engineer. No slides.
- The platform and the version you're on
- Where you need to get to, and by when
- What's custom: rules, plugins, integrations
- Any audit finding or deadline driving it