How to design a secure SAP authorization strategy

Regulatory requirements for SAP authorization strategies are constantly increasing. At the same time, the move to SAP S/4HANA is changing the technical foundation for roles, profiles, and access control. This guide outlines the key components of a secure authorization strategy and highlights what companies should keep in mind in this regard.

Key takeaways:

• An SAP authorization concept governs who is permitted to perform which actions in the system, based on the principle of least privilege. It protects sensitive data and ensures the authorization structure is transparent for audits.

• With SAP S/4HANA, catalogs and groups are introduced as additional levels within the SAP Fiori framework. These must be consistent with the backend authorizations.

• A role model consisting of small, granular individual roles that are bundled into job profiles via composite roles has proven effective.

• The authorization redesign should be launched early on as a strategic project and maintained and kept up to date over the long term through recertifications, role lifecycle management, and emergency user concepts.

• Providing AI agents with the appropriate authorizations is becoming a key security consideration. They require their own identities in accordance with the principle of least privilege. The SAP AI Agent Hub provides the necessary transparency and governance for this.

Control who has access to what in your SAP landscape

What an SAP authorization concept achieves

An SAP authorization concept defines which users are permitted to perform which actions in an SAP system. It is based on the principle of least privilege: Each user is granted only the authorizations necessary to perform their tasks. Authorization objects, roles, and profiles form the technical architecture on which this principle is based.

The strategy protects sensitive data from unauthorized access and targeted misuse. Additionally, it documents the authorization structure for audits and reviews related to identity & access management. A clearly defined authorization strategy is essential for verifiably meeting compliance requirements.

Setting up roles and profiles correctly in SAP S/4HANA

The move to SAP S/4HANA involves changes to role management. SAP Fiori introduces additional levels: catalogs control which apps are available; groups determine visibility on the SAP Fiori Launchpad. Both levels must be consistent with the backend authorizations.

A role model consisting of small, granular individual roles that are grouped into job profiles via composite roles has proven effective. Consistent naming conventions and a clear separation of organizational data through derived roles simplify maintenance and improve traceability.

Establishing segregation of duties and avoiding SoD conflicts

Segregation of duties (SoD) is based on the principle that no single user should have complete control over sensitive systems, processes, or activities. A typical example: Anyone authorized to create a vendor should not be authorized to approve payments to that vendor. SoD conflicts are considered one of the most common findings in authorization audits. The correct configuration of authorization objects forms the foundation of any access control.

When moving to SAP S/4HANA, it is not enough to simply copy existing SoD rules. Rather, new authorization objects, OData services, and the central business partner model make a revision of the SoD matrix absolutely necessary.

Implementing a structured approach to authorization redesign

In practice, an authorization redesign follows a phased approach that ranges from analyzing existing roles to designing a new role model and culminating in a validated go-live. The process typically consists of five steps: first, evaluating the current state and creating a written concept; second, system preparation, including the optimization of SU24 default values; third, the design of granular functional roles; fourth, coordination with business units and role implementation; and fifth, a simulation and a secure go-live, during which users can fall back on previous authorizations for a defined period if a business-critical process is affected.

Ongoing maintenance of authorizations after go-live

An authorization concept loses its quality and accuracy over time because organizational structures, business processes, or regulatory frameworks change. Regular recertifications ensure that granted authorizations still align with the actual job profile. Department heads should check at fixed intervals to ensure that their employees’ roles remain up to date. If this is no longer the case, the authorization concept must be adjusted accordingly.

In addition, it is recommended to implement a role lifecycle management system that maps the creation, modification, and deletion of roles within a consistent process. Emergency user concepts ensure access to broad authorizations such as SAP_ALL and log every action performed under this profile.

Outlook: Authorizations for AI agents

With the increasing use of AI agents, a new dimension will be added to the authorization concept in the future: Agents will independently access SAP data and initiate actions without a human triggering every single decision. At least, that is how SAP envisions the Autonomous Enterprise. Consequently, the same principles apply to AI agents as to human users. Every agent requires a clearly defined identity, authorizations based on the principle of least privilege, and traceable logging. SoD conflicts can also arise if an agent combines rights that would never be assigned to a human at the same time. Tailored authorizations for AI agents must therefore be an integral part of any future-proof authorization concept.

The SAP AI Agent Hub provides support at the governance level. It serves as a central hub for recording, managing, and controlling AI agents within the enterprise – even beyond the SAP landscape. With the SAP AI Agent Hub, you can ensure transparency regarding the AI agents in use, prevent the emergence of shadow AI, document approvals, and support the agents throughout their entire lifecycle. The actual assignment of rights remains the responsibility of the authorization concept, while the SAP AI Agent Hub provides an overview of exactly which agents are present and approved. By integrating both approaches, you maintain control at all times – even in an SAP landscape dominated by agent-based AI.

Conclusion: The authorization concept as the foundation of SAP security

An audit-proof SAP authorization strategy protects sensitive corporate data, meets compliance requirements, and lays the groundwork for a controlled SAP system landscape. Anyone planning to move to SAP S/4HANA should establish the authorization redesign early on as a strategic project rather than addressing it as an afterthought following the go-live.

It is essential to consider AI agents right now: Those who embed identities, roles, and approval processes for agents into their authorization strategy from the very beginning – and support this with governance tools such as the SAP AI Agent Hub – will be ideally prepared for SAP Business AI. However, the Autonomous Enterprise is not yet a reality. It’s up to SAP to bring the promised functionalities to market as quickly as possible. Instead of waiting, companies should do their homework and prepare their own infrastructure for the future of agent-based AI.