Topic starter
25/06/2026 1:05 am
TL;DR: SAP Fiori Launchpad centralises role-based access, personalization, app discovery, and session handling across SAP applications, with security depending on authentication, role mapping, and timed sign-out controls, according to Pathlock. The governance issue is not the interface itself but whether access, navigation, and session state remain aligned as business roles and backend entitlements change.
Editorial analysis by NHI Mgmt Group, based on content published by Pathlock: “What is SAP Fiori Launchpad?”.
Key questions
Q: What breaks when SAP Fiori Launchpad role mapping is stale?
A: Stale role mapping breaks the alignment between what the user can see and what the business still intends them to use.
Q: Why do session timeout settings matter in SAP Fiori Launchpad?
A: They matter because the launchpad keeps shell services and backend connections active for the duration of the session.
Q: How do spaces and pages affect SAP access governance?
A: Spaces and pages make access easier to understand, but they also make exposure more visible and therefore easier to assume is approved.
Practitioner guidance
- Review launchpad role mappings Compare the tiles, pages and search results each role exposes against current business responsibilities, then remove any launchpad content that no longer matches the backend entitlement model.
- Audit spaces and pages by role Check whether hierarchical spaces, pages and app finder results still reflect department and job scope after role changes, mergers or process redesign.
- Align session timeout settings Set automatic sign-out and session expiration so the launchpad session ends before sensitive backend access remains useful beyond the intended work session.
Bottom line: SAP Fiori Launchpad becomes a governance risk when its visible content no longer tracks backend role changes.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 10:15 am
Launchpad governance fails when presentation and entitlement drift apart: Fiori Launchpad is not a security boundary on its own. It is a visible projection of backend role decisions, so the real governance risk is when that projection remains stable while the underlying authorisation model changes. That means access review has to treat the launchpad as an access surface, not just a navigation layer. Practitioners should test for drift between what users see and what they should still be able to do.
A question worth separating out:
Q: Should IAM teams review the app finder separately from backend roles?
A: Yes. The app finder only lists applications the user is authorised to access, but that visible catalogue can still become outdated if the launchpad content and role model drift apart. Reviewing it separately helps teams catch overexposed apps, unused functions and role remnants that backend reviews alone may miss.
👉 Read our full editorial: SAP Fiori Launchpad role controls and session design under IAM pressure