Notifications
Clear all
Topic starter
17/08/2026 4:41 pm
TL;DR: SAP IDM’s 2027 end-of-life is pushing organisations to reassess identity governance architecture, especially where workforce, external, and non-human identities now span cloud, SAP, and non-SAP systems, according to Saviynt. The transition pressure is less about replacement software than about consolidating workflows, policy enforcement, and access governance across a larger identity estate.
NHIMG editorial — based on content published by Saviynt: From SAP to Saviynt: A Smart Move for Modern Identity Governance
By the numbers:
- 52% of security leaders cite the adoption of more cloud applications as the primary factor in the increasing number of identities within their organization.
- Only 5.7% of organisations have full visibility into their service accounts.
Questions worth separating out
Q: How should organisations approach SAP IDM replacement without losing governance coverage?
A: Start by mapping every access workflow, custom role, and integration currently controlled by SAP IDM.
Q: Why do identity migrations create access risk even when users keep the same jobs?
A: Because access risk often comes from broken governance paths, not changed job titles.
Q: What do security teams get wrong about moving from SAP IDM to a new IGA platform?
A: They often focus on provisioning and certification screens while underestimating the importance of transaction-level access, SoD rules, and custom workflow preservation.
Practitioner guidance
- Inventory all SAP IDM dependencies Document every workflow, custom role, integration, and downstream system that currently depends on SAP IDM before setting target-state scope.
- Test replacement coverage against non-SAP identities Validate that the target model governs workforce users, external users, service accounts, and application-specific entitlements in one policy framework.
- Preserve fine-grained access controls during migration Require the replacement path to retain transaction-level access visibility, segregation-of-duties logic, and certification evidence across applications.
What's in the full article
Saviynt's full blog covers the operational detail this post intentionally leaves for the source:
- Step-by-step migration framing for organisations moving off SAP IDM into a converged identity model.
- Product positioning around SAP and hybrid environment coverage that goes beyond the governance implications covered here.
- Implementation discussion of how IGA, AAG, and PAM are packaged together for enterprise deployment.
- Specific claims about reduction in onboarding time and access prediction accuracy that practitioners may want to validate separately.
👉 Read Saviynt's analysis of SAP IDM retirement and identity governance migration →
SAP IDM retirement: what identity teams need to re-evaluate?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
17/08/2026 4:46 pm
SAP IDM retirement is really an IGA architecture reset, not a product swap. When a central identity system no longer matches the application estate it was built to govern, organisations have to decide whether to preserve legacy role logic or re-platform governance around current identity sprawl. That decision affects certifications, SoD, and privileged access models at the same time, which is why migration planning is an identity architecture exercise, not a procurement exercise.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs.
- 91.6% of secrets remain valid five days after notification, according to Ultimate Guide to NHIs, which shows how slowly remediation can lag governance failure.
A question worth separating out:
Q: Which governance questions should leaders ask before retiring SAP IDM?
A: Ask where the authoritative role model will live, how non-SAP applications will be governed, and whether service accounts and external identities are fully included. Also ask how offboarding, exceptions, and privilege escalation will be handled after cutover. Those answers determine whether the new model reduces complexity or just redistributes it.
👉 Read our full editorial: SAP IDM end-of-life is forcing a broader IGA reset
