What will Identity & Access Management (IAM) look like in SAP environments after 2027? This is the question companies currently using SAP Identity Management (IdM) are asking themselves. On December 31, 2027, the end of support for SAP IdM will become a reality. Although extended maintenance through 2030 is available for an additional fee, this option is suitable at best as a temporary solution and not as a robust IAM strategy. For this reason, it is important to begin the process of replacing SAP IdM and implementing an alternative IAM tool as soon as possible.
SAP Identity Management (IdM) will reach end-of-maintenance on December 31, 2027; even extended maintenance (through 2030) does not offer a long-term IAM solution.
Potential successor solutions include Microsoft Entra ID, One Identity, Omada, and Sailpoint.
SAP Cloud Identity Services (SAP IAS and SAP IPS) will play a central role in identity & access management within SAP landscapes in the future and are also essential for AI applications using SAP Joule.
Best practices for replacing SAP IdM and avoiding common pitfalls ensure smooth project execution.
The end of support for SAP Identity Management has significant consequences for companies. After 2027, security updates will no longer be provided, meaning critical vulnerabilities in the system will remain unpatched. Companies will continue to pay license fees without receiving adequate value in return. Furthermore, it is likely to become increasingly difficult to find SAP IdM experts to provide continuous support. Using an IAM system that is no longer supported by the vendor can lead to compliance violations. Another challenge is that modern systems can no longer be easily integrated into the legacy IAM solution.
The SAP reference architecture specifies SAP Cloud Identity Services for integration into the entire SAP landscape – this applies to both on-premises and cloud systems. Similarly, Microsoft Entra ID has a firm place in the SAP reference architecture. This is based on a strategic partnership between Microsoft and SAP that designates Microsoft as a preferred supplier.
However, this does not mean that Microsoft Entra ID is the only alternative for replacing SAP IdM. In general, any IAM tool available on the market can be used for SAP environments. The key question is to what extent it can ensure the necessary connectivity to SAP systems. Well-known IGA platforms include, for example, One Identity, Omada, Sailpoint, and the open-source solution Midpoint. One thing is certain, however: Regardless of the chosen IAM system, SAP Cloud Identity Services remain highly relevant.
The critical importance of SAP Cloud Identity Services stems not only from the SAP reference architecture. Rather, SAP Cloud Identity Services play a decisive role in conjunction with the use of artificial intelligence via SAP Joule. This is because AI agents should not be allowed to access any resource at will; instead, they must be authenticated, audited, and authorized just like human users.
This is where SAP Cloud Identity Services come into play. SAP Joule uses them for authentication. Without SAP Cloud Identity Services, SAP Joule is unable to connect to the ecosystem and operate across applications – consequently, AI cannot deliver the desired added value. AI-powered processes require centralized identity management. SAP Cloud Identity Services provide this.
In addition, SAP Business Technology Platform (BTP) requires SAP Cloud Identity Services as the default identity provider. These services are needed to deploy SAP BTP apps. For SAP S/4HANA Cloud Private Edition and SAP S/4HANA Cloud Public Edition, the SAP Identity Authentication Service (a component of SAP Cloud Identity Services) is required for single sign-on integration. In general, connectivity with SAP systems is simplified thanks to SAP Cloud Identity Services, because SAP handles the maintenance of the connectors itself.
The key components of SAP Cloud Identity Services are the SAP Identity Authentication Service (IAS) and the SAP Identity Provisioning Service (IPS). These two components provide all the necessary core functionalities: While SAP IAS serves as the central single sign-on (SSO) and multi-factor authentication (MFA) solution for all SAP applications, SAP IPS handles automated user provisioning in SAP systems. Also relevant in this context – though not part of SAP Cloud Identity Services – is SAP Cloud Identity Access Governance (IAG), which enables the implementation of risk management and segregation of duties.
Using SAP Cloud Identity Services and an external IAM system in parallel is not a contradiction; rather, the solutions complement each other. The external IAM system provides the IGA foundation, while SAP Cloud Identity Services form the SAP-specific identity layer. In such a scenario, SAP IAG complements cloud governance.
Typical combinations from real-world practice:
Microsoft Entra ID and SAP Cloud Identity Services are considered the standard scenario for SAP cloud systems.
One Identity, SAP Cloud Identity Services, and SAP IAG are a proven approach in hybrid environments.
The combination of SAP GRC and SAP IAG is suitable for maintaining on-premises SoD audits and cloud governance in parallel.
When replacing SAP IdM, certain pitfalls can cause difficulties and hinder the smooth execution of the project. Among the most common mistakes are:
The authorization concept is copied 1:1 from the legacy system. It is better for companies to use the migration as an opportunity to revise the authorization concept and adapt it to current circumstances.
A purely technical migration is carried out without a process review.
The hypercare phase (intensive support after go-live) is planned too short.
IAM governance is viewed as an IT issue. In reality, it is a business issue, especially with regard to AI.
The migration is set up as an exclusively technical project.
If, on the other hand, companies rely on a set of best practices, they increase the likelihood of successfully implementing their successor solution for SAP IdM. These tips lay the groundwork for that:
Document the processes before the migration begins.
Consider the separation of duties (SoD check) from the very beginning.
Plan for test instances for all project phases.
Conduct training for end users who will be working with the new IAM system.
The end of support for SAP Identity Management is approaching, so it’s important to act promptly. The good news: There’s no shortage of alternatives. Whether it’s Microsoft Entra ID, One Identity, Omada, or SailPoint – companies can choose from a wide range of IAM tools to identify the solution that best fits their individual needs. Regardless, SAP Cloud Identity Services are the central SAP-specific identity layer and are essential, particularly for the AI agents of SAP Joule. Those who start their IAM migration project now will gain the necessary lead time to replace SAP IdM in a structured and future-proof manner.