Topic starter
30/07/2026 10:51 pm
TL;DR: SAP Identity Management 8.0 mainstream maintenance ends on December 31, 2027 with no successor, forcing manufacturing firms to decide whether replacement preserves old gaps or redesigns governance across SAP, contractors, plant systems, and connected applications, according to OpenIAM. The real risk is treating the move as a migration project instead of a lifecycle, SoD, and audit-scope decision.
Editorial analysis by NHI Mgmt Group, based on content published by OpenIAM: “SAP IDM Replacement Is a Governance Decision, Not a Migration”.
Key questions
Q: What breaks when SAP IDM is retired before its governance workflows are replaced?
A: The main failure is not authentication, it is lifecycle control.
Q: When should manufacturing firms prioritise governance redesign over platform migration?
A: They should do it before vendor selection, because the right product depends on the control model it must support.
Q: How do teams know whether an SAP IDM replacement is working?
A: It is working when reviews, approvals, and evidence production cover SAP, connected applications, contractors, and site-specific lifecycle events without relying on manual exceptions.
Practitioner guidance
- Define the governance target before selecting a platform Map the controls the replacement must deliver across SAP, non-SAP applications, contractors, and audit evidence before any tool shortlist is approved.
- Separate SoD enforcement from lifecycle orchestration Preserve the risk logic that belongs in SAP GRC or equivalent controls, and make sure the replacement adds lifecycle and review coverage instead of duplicating detection logic.
- Model contractor and plant-transfer journeys explicitly Document how non-employee identities and site moves will be approved, provisioned, reviewed, and removed, because HR-driven joiner-mover-leaver logic will not cover them cleanly.
Bottom line: The core risk is not the loss of SAP IDM as software, but the temptation to replace it without fixing the governance model it never fully covered.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
30/07/2026 10:55 pm
Like-for-like SAP IDM replacement preserves the same governance debt the old platform carried. The article makes clear that SAP IDM handled lifecycle workflow, but not SoD enforcement, broad non-SAP governance, or contractor-scale lifecycle management. That means a straight migration can preserve the audit and control gaps that made the original environment fragile. The practitioner lesson is to treat replacement as debt retirement, not software continuity.
A few things that frame the scale:
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What is the difference between SAP Cloud Identity Services and a full IGA replacement?
A: SAP Cloud Identity Services covers SAP authentication and provisioning, but a full IGA replacement also governs lifecycle policy, access reviews, evidence, and cross-application control scope. Manufacturing environments need both layers if they want the governance model to match the real audit perimeter.
👉 Read our full editorial: SAP IDM replacement is a governance decision, not migration