SAP IDM end-of-life is forcing a broader IGA reset

At a glance

What this is: SAP IDM’s retirement is being framed as a trigger for organisations to rethink identity governance architecture across SAP and non-SAP estates, especially as cloud adoption and non-human identities expand the access surface.

Why it matters: IAM and IGA teams need to use the retirement window to determine whether their current governance model can still handle cross-application access, workflow, and policy enforcement at enterprise scale.

Context

SAP Identity Management is approaching end of life, and the governance problem is bigger than replacing one product. The article argues that identity estates have changed faster than SAP IDM’s original model, with cloud apps, line-of-business platforms, workforce users, external users, and non-human identities now all requiring coordinated control.

That shift matters because identity governance is no longer confined to SAP-centric administration. Organisations now have to evaluate how access reviews, role management, workflow automation, and policy enforcement will operate across mixed environments, including SAP, cloud, and third-party systems.

The article’s central point is that SAP IDM retirement should be treated as an architecture reset, not a like-for-like migration. The typical estate has already outgrown single-domain governance, so the replacement question is really about whether the new control plane can span the full identity lifecycle.

Key questions

Q: What breaks when SAP IDM is retired before its governance workflows are replaced?

A: The main failure is not authentication, it is lifecycle control. If provisioning, approvals, and revocation were embedded in SAP IDM, retiring it too early can leave joiner, mover, and leaver processes split across manual steps and disconnected systems. That increases privilege creep, weakens auditability, and makes offboarding incomplete. The migration target must preserve the control path, not just the user interface.

Q: Why does SAP IDM retirement force identity teams to rethink governance scope?

A: Because the identity estate has expanded beyond SAP-centric administration. Cloud applications, external users, and non-human identities now sit inside the same business processes, so governance has to span multiple systems, access models, and lifecycle patterns. A narrow replacement leaves the programme exposed to fragmented control and duplicated administration.

Q: When should organisations prioritise a converged IGA model over best-of-breed tools?

A: Prioritise convergence when manual reconciliation, audit prep, or inconsistent access state is becoming routine across provisioning, review, and SaaS visibility. If identity teams spend more time stitching records together than governing access, the architecture is already consuming the time it was meant to save. The deciding factor is control continuity, not tool variety.

Q: How should teams handle custom workflows during an SAP IDM migration?

A: Teams should treat custom workflows as control logic, not just configuration. If a workflow drives approvals, SoD checks, or provisioning exceptions, it needs to be redesigned and tested in the target state before cutover. Otherwise the organisation migrates technical functionality while preserving governance fragility.

Technical breakdown

Why SAP IDM retirement exposes governance sprawl

SAP IDM was built for a narrower era of identity control, when many organisations could centralise around SAP-centric workflows and fewer connected systems. That model weakens when the identity estate includes cloud applications, multiple business units, external users, and machine identities with different access patterns. The practical issue is not only retirement dates but the mismatch between old governance assumptions and current operating reality. A modern IGA design has to coordinate policy, certification, and provisioning across heterogeneous systems rather than isolate each system in its own administration lane.

Practical implication: Treat the retirement as a signal to inventory where governance is still system-specific instead of enterprise-wide.

Why converged identity platforms matter for mixed identity estates

The article argues that converged identity platforms combine IGA, application access governance, and PAM so organisations can govern more of the access lifecycle from one control plane. The technical value is not consolidation for its own sake. It is the ability to connect business roles, entitlements, access reviews, and privileged controls across applications that do not share the same authorisation model. That matters when SAP and non-SAP systems coexist, because different role structures, workflows, and control depths have to be reconciled without losing visibility or auditability.

Practical implication: Evaluate whether your replacement can preserve governance depth across SAP and non-SAP systems without splitting controls across separate tools.

How non-human identities change the IGA requirement

The article explicitly notes the rise of workforce, external, and non-human identities, which changes the governance scope of an IGA programme. Non-human identities such as service accounts, tokens, and workload access do not behave like human accounts, but they still need ownership, lifecycle control, and access oversight. The operational challenge is that tools built around only human workflows often struggle to represent machine access cleanly in reviews, approvals, and policy enforcement. When those identities are embedded in ERP, cloud, and application integrations, governance must handle both account lifecycle and application context.

Practical implication: Build the migration plan around all identity types in scope, not just human users and SAP roles.

Threat narrative

Attacker objective: The operational objective is to exploit fragmented governance and inconsistent access control across systems, increasing the chance of unauthorised or unreviewed access persisting.

1. Entry occurs through governance drift, where identity controls remain tied to an ageing SAP IDM model while cloud and non-SAP access expands beyond it.
2. Escalation happens when business roles, workflows, and policy enforcement become fragmented across point solutions, creating inconsistent control over who can access what.
3. Impact is broader administrative complexity, weaker visibility across the identity estate, and reduced ability to demonstrate compliant access governance at scale.

Breaches seen in the wild

• SAP Kubernetes secrets exposure 2023: Kubernetes secrets committed to GitHub exposed 203 valid registry credentials, including SAP artifact repository access. SAP closed it after Aqua's report.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

SAP IDM retirement is really an identity governance architecture problem, not a product swap. The article’s strongest point is that the governance model that worked for a SAP-centred estate no longer matches how organisations operate. Cloud adoption, LoB applications, and mixed identity types have turned IGA into an enterprise control-plane problem. The practitioner conclusion is to redesign for cross-application governance rather than recreate the old SAP boundary in a new tool.

Converged governance is becoming the default expectation for modern identity programmes. When IGA, AAG, and PAM sit in separate silos, access decisions fragment across multiple control surfaces and review artefacts lose context. That creates policy drift, duplicated administration, and poor visibility across SAP and non-SAP applications. The implication is that teams should evaluate whether their future-state architecture can unify access governance without collapsing control depth.

Non-human identities are now part of the IGA scope, not a separate side project. The article correctly places workforce, external, and non-human identities in the same migration conversation because they now coexist in the same business processes. A governance model that excludes machine accounts from lifecycle and certification leaves an obvious gap in hybrid estates. The practitioner takeaway is that identity governance must explicitly cover service and workload access, not only human joiner-mover-leaver workflows.

Cross-application visibility is the new compliance baseline. The article’s discussion of SoD, continuous controls monitoring, and tcodes shows that narrow SAP control is no longer enough when business processes span multiple platforms. Identity governance now has to prove it can track entitlement relationships and risk across the full application set. The conclusion for practitioners is that auditability depends on integrated governance evidence, not isolated system reports.

Unified identity control creates the only sustainable migration path for large SAP estates. The article shows that migration planning has to account for roles, workflows, integrations, and customisations all at once. That is a governance change management issue as much as a technology decision. Practitioners should treat the migration window as an opportunity to remove identity silos rather than rehome them one by one.

From our research library:

• Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
• Read next: NHI Lifecycle Management Guide

What this signals

Identity governance scope has expanded beyond any single business application. SAP IDM retirement is a reminder that governance programmes now have to represent human, external, and non-human identities across multiple control planes, not just one ERP backbone. The programme question is whether access reviews, role logic, and policy enforcement can survive in a mixed estate without becoming manual.

Converged control is increasingly about evidence quality, not just operational efficiency. When IGA, application access governance, and PAM are separated, the resulting audit trail becomes harder to interpret and defend. The practical signal for teams is that the replacement decision should be judged by how well it preserves traceable access decisions across SAP and non-SAP systems.

Migration windows are governance redesign windows. Organisations that simply swap tools will often re-create the same silos in a new wrapper. The better outcome is to use the transition to standardise entitlement ownership, lifecycle handling, and certification scope across the full identity estate.

For practitioners

• Map the full identity estate before replacement planning Inventory SAP, cloud, external, and non-human identities together so the target architecture reflects actual governance scope rather than the legacy SAP boundary.
• Reassess workflow and policy dependencies Document where roles, approvals, SoD checks, and provisioning logic are embedded in SAP IDM customisations so you can judge what must be rebuilt, not just migrated.
• Evaluate converged governance coverage Test whether the replacement can combine IGA, application access governance, and PAM without splitting review evidence or administrative ownership across tools.
• Include non-human identities in the migration scope Require the replacement plan to cover service accounts, application identities, and workload access alongside workforce and external users.
• Preserve audit evidence across SAP and non-SAP systems Confirm that the new platform can support continuous controls monitoring, entitlement traceability, and access review evidence across mixed application environments.

Key takeaways

• SAP IDM retirement is forcing organisations to confront whether their current governance model can still span a much broader identity estate.
• Cloud adoption and non-human access have changed the control problem enough that a narrow SAP replacement is unlikely to be sufficient.
• The most defensible migration approach is to rebuild governance scope around cross-application control, evidence, and lifecycle ownership.

Key terms

• Identity Governance and Administration (IGA): A framework of policies, processes, and technology to manage and govern digital identities and their access rights. Increasingly extended to cover non-human identities alongside human users.
• Application-Aware Access Governance: Application-Aware Access Governance is identity governance that understands the rules, data, and workflows of a specific business system. It goes beyond generic provisioning by connecting entitlements to process context, transaction behaviour, and cross-system evidence needed for defensible decisions.
• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
• Integrated Converged Identity Platform: An integrated converged identity platform is built on a single underlying codebase and managed through one central interface. It usually includes a shared repository for identity data, which helps teams correlate access across systems and apply governance more consistently across the environment.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.