Topic starter
25/06/2026 1:05 am
TL;DR: When SAP Fiori Launchpad role mapping drifts, Pathlock finds, visible tiles, spaces and app finder entries can no longer match current authorisation. Launchpad access then needs the same review as backend entitlements, timeout policy and content exposure.
Editorial analysis by NHI Mgmt Group, based on content published by Pathlock: “What is SAP Fiori Launchpad?”.
Key questions
Q: Why do session timeout settings matter in SAP Fiori Launchpad?
A: They matter because the launchpad keeps shell services and backend connections active for the duration of the session.
Q: How do spaces and pages affect SAP access governance?
A: Spaces and pages make access easier to understand, but they also make exposure more visible and therefore easier to assume is approved.
Q: What breaks when SAP Fiori Launchpad role mapping is stale?
A: Stale role mapping breaks the alignment between what the user can see and what the business still intends them to use.
Practitioner guidance
- Review launchpad role mappings Compare the tiles, pages and search results each role exposes against current business responsibilities, then remove any launchpad content that no longer matches the backend entitlement model.
- Audit spaces and pages by role Check whether hierarchical spaces, pages and app finder results still reflect department and job scope after role changes, mergers or process redesign.
- Align session timeout settings Set automatic sign-out and session expiration so the launchpad session ends before sensitive backend access remains useful beyond the intended work session.
Bottom line: SAP Fiori Launchpad becomes a governance risk when its visible content no longer tracks backend role changes.
Glossary terms: SAP Fiori, Role Mapping, Session Management, Spaces and pages
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 17 hours ago by NHI Mgmt Group
25/06/2026 10:15 am
Launchpad governance fails when presentation and entitlement drift apart: Fiori Launchpad is not a security boundary on its own. It is a visible projection of backend role decisions, so the real governance risk is when that projection remains stable while the underlying authorisation model changes. That means access review has to treat the launchpad as an access surface, not just a navigation layer. Practitioners should test for drift between what users see and what they should still be able to do.
A question worth separating out:
Q: Should IAM teams review the app finder separately from backend roles?
A: Yes. The app finder only lists applications the user is authorised to access, but that visible catalogue can still become outdated if the launchpad content and role model drift apart. Reviewing it separately helps teams catch overexposed apps, unused functions and role remnants that backend reviews alone may miss.
👉 Read our full editorial: SAP Fiori Launchpad role controls and session design under IAM pressure