SAP Identity Management replacement with Entra ID or SailPoint
Cohash replaces SAP Identity Management with Microsoft Entra ID Governance or SailPoint. We inventory the Identity Store, jobs and custom scripts, then rebuild the HR feed from SuccessFactors or SAP HCM and move provisioning to SAP ECC, S/4HANA and non-SAP targets. Business roles become access packages or SailPoint roles, SAP GRC is connected where it depends on IdM, and both systems run in parallel before IdM goes.
- 01Inventory the Identity Store
- 02HR source and identity model
- 03SAP provisioning
- 04Roles and access requests
- 05GRC and parallel run
The story
Told without the client's name or anything that could identify them.
A logistics company's identity team ran SAP Identity Management 8.0 on a database and operating system that security wanted retired, with jobs full of custom JavaScript nobody had touched in years. SAP's 2027 end of maintenance, and the lack of a direct SAP successor, made a replacement unavoidable. We exported the Identity Store entry types, jobs and scripts first and recorded which target each job fed. The HR feed, SAP provisioning and business roles were rebuilt in Microsoft Entra ID Governance, both platforms ran in parallel with one writer per SAP system, and IdM was shut down once every system and client had switched.
why it was urgentThere's no SAP product to upgrade to. SAP Identity Management loses maintenance in 2027, extended maintenance runs to 2030, and SAP has no direct successor. What exists is a migration path SAP and Microsoft collaborated on, plus Microsoft's guidance for moving IdM scenarios to Microsoft Entra.
- openIdM jobs contain custom JavaScript that nobody has touched in years.
- recurringSAP GRC Access Control relies on IdM as its identity source.
- blockedThe IdM server runs on a database and OS version that security wants retired.
- openNon-SAP applications are already provisioned from Entra ID or SailPoint, and IdM only covers SAP.
The estate, before and after
Before: SAP Identity Management feeding the SAP estate
SAP IdM took the HR feed and provisioned SAP systems through jobs with custom JavaScript, and SAP GRC used it as its identity source. Non-SAP apps were already governed separately in Entra ID.
Read the diagram as text
- SuccessFactors or SAP HCM → SAP Identity Management 8.0: HR feed
- Custom JavaScript jobs → SAP Identity Management 8.0: job logic
- SAP Identity Management 8.0 → SAP ECC: provision
- SAP Identity Management 8.0 → SAP S/4HANA: provision
- SAP Identity Management 8.0 → SAP GRC Access Control: identity data
- SuccessFactors or SAP HCM → Entra ID: separate feed
- Entra ID → Non-SAP applications: provision
After: Entra ID Governance provisions SAP and non-SAP apps
Everything starts from one HR feed into Entra ID Governance. SAP systems are provisioned via SAP Cloud Identity Services, non-SAP apps directly, and IdM business roles are now access packages with reviews.
Read the diagram as text
- SuccessFactors or SAP HCM → Entra ID Governance: joiner · mover · leaver
- Entra ID Governance → SAP Cloud Identity Services: SCIM
- SAP Cloud Identity Services → SAP ECC: users and roles
- SAP Cloud Identity Services → SAP S/4HANA: users and roles
- Entra ID Governance → SAP Access Control or IAG: identity data
- Entra ID Governance → Non-SAP applications: provision
How we run it, phase by phase.
5 phases take you from SAP Identity Management 8.0 (on-premises) to Microsoft Entra ID Governance or SailPoint. Each one ends with something you can check before the next starts. As you scroll, the blocks show the estate moving across.
- phase 01
Inventory the Identity Store
Export entry types like MX_PERSON, MX_ROLE and MX_PRIVILEGE, along with repositories, jobs, tasks and scripts. Note which target each job feeds, and which jobs nobody uses any more.
- phase 02
HR source and identity model
Rebuild the joiner, mover and leaver feed from SuccessFactors or SAP HCM into the new platform, extend the user schema for SAP attributes, and match identity counts against IdM.
- phase 03
SAP provisioning
Hook SAP ECC and S/4HANA up directly, or via SAP Cloud Identity Services. Then test, per system and client, that users get created, roles get assigned and leavers get locked.
- phase 04
Roles and access requests
IdM business roles become Entra access packages or SailPoint roles, and privileges map to app roles or groups. Rebuild the approval flows and access reviews alongside.
- phase 05
GRC and parallel run
Decide how SAP Access Control or IAG gets identity data and risk checks, run both platforms in parallel, and switch systems one at a time before IdM is decommissioned.
What the client got
What changed for the client once the work was done. Described, not scored: we don't publish client figures.
- result 01
One platform provisions SAP and non-SAP systems
HR's joiner, mover and leaver feed goes into Entra ID Governance, which now provisions SAP ECC and S/4HANA as well as the non-SAP apps it already covered.
- result 02
Every IdM script has an owner or was retired
Every custom JavaScript in the job inventory got a decision. Naming rules, client handling and license type logic were rebuilt deliberately or dropped knowingly.
- result 03
Business roles became access packages
Business roles became Entra access packages and privileges became app roles or groups. Approvals and access reviews moved across with them.
- result 04
GRC gets identity data by a tested design
We designed and tested how SAP Access Control gets identity data and risk checks before cut-over, because Microsoft's GRC integrations are still evolving.
- result 05
IdM is off and its history is kept
Auditors can still read the provisioning and approval history. It was exported before the IdM servers and database went.
Risks we plan for
-
GRC integration gaps
By Microsoft's own account, Entra's integrations with SAP Access Control and IAG are still evolving. Teams that depend on GRC risk analysis at provisioning time need a design they've tested before cut-over.
-
Logic hidden in scripts
IdM jobs often carry custom JavaScript for naming rules, client handling or license types. Each script needs an owner and a decision, or the behavior quietly disappears.
-
Double provisioning during parallel run
Two platforms writing to one SAP system is how accounts and roles end up flapping. Each target gets one writer at a time, no exceptions.
Where AI helps, and where it needs guardrails
Neither target needs AI to complete the move. An LLM is useful for reading old IdM job scripts and drafting a plain description of what each one does, which an identity engineer then checks. As AI agents start calling SAP APIs, their SAP technical users should be governed in the new platform with owners, narrow roles and regular access reviews, the same as service accounts.
forward deployed engineers →What you're left with
We write these for your setup, and they're working documents. Your team should be able to keep things running from them long after we've gone.
- inventory01
Identity Store and job inventory with a decision per script
yours to keep - design02
Target design for HR feed, SAP provisioning and GRC integration
yours to keep - inventory03
Role mapping from IdM business roles to access packages or SailPoint roles
yours to keep - document04
Parallel-run comparison per SAP system and client
yours to keep - plan05
Decommission plan with audit data retained
yours to keep
Platforms and services on this move
Certified engineers, wherever you need them.
Some clients want a project team, some want a couple of engineers on theirs. Either works. Onsite, nearshore or offshore, with handovers across time zones that keep things moving.
Onsite
Engineers at your sites in the US
Nearshore
Overlapping hours with US teams
Offshore
Overnight progress on your backlog
All time zones
Coverage handed over across time zones
01Entra ID Governance or SailPoint?
It depends on what else you govern. If most applications already sit behind Entra ID and SAP is the main IGA need, Entra ID Governance is often enough. Large role models, complex separation-of-duties rules and many non-Microsoft targets tend to favor SailPoint. We compare both against your actual IdM jobs.
02Does this have to wait for our S/4HANA move?
No. The new platform can provision to ECC now and to S/4HANA later. Doing identity first often removes a dependency from the ERP cut-over.
03What happens to IdM audit history?
We export provisioning and approval history before shutdown and keep it in a format auditors can read.
Often on the same roadmap
On-premises Active Directory to cloud-first Microsoft Entra ID
We shrink on-premises Active Directory one application at a time, moving groups, users and app authentication to Microsoft Entra ID as each app is ready.
read the case studyAD FS federation to Entra ID authentication
Converting federated domains from AD FS to Entra ID cloud authentication, moving relying parties app by app and retiring the AD FS farm.
read the case studyAuth0 Rules and Hooks to Actions before end of life
Rewriting Auth0 Rules and Hooks as Actions before their 18 November 2026 end of life, with token claims compared before and after each change.
read the case studyc7ecbc40 - 01SAP blog: preparing for SAP Identity Management end of maintenance in 2027blogs.sap.com ↗
- 02Microsoft Learn: migrate identity management scenarios from SAP IDM to Microsoft Entralearn.microsoft.com ↗
Planning this move?
A 30-minute working session with a senior engineer. No slides.
- The platform and the version you're on
- Where you need to get to, and by when
- What's custom: rules, plugins, integrations
- Any audit finding or deadline driving it