Topic starter
24/06/2026 10:38 pm
TL;DR: SAP’s end of mainstream maintenance for SAP Identity Management 8.0 on 31 December 2027, with extended support only through 2030, is forcing organisations to treat replacement as an 18 to 36 month programme rather than a tooling swap, according to Pathlock. The real issue is not just platform retirement but the operational debt, integration scope, and governance redesign that legacy IDM programmes now have to absorb.
Editorial analysis by NHI Mgmt Group, based on content published by Pathlock: “SAP Identity Management (IDM) Alternatives | Pathlock Cloud”.
By the numbers:
- Extended support is available until the end of 2030.
- Enterprise replacement timelines typically take 18 to 36 months.
Key questions
Q: What breaks when SAP IDM is retired before its governance workflows are replaced?
A: The main failure is not authentication, it is lifecycle control.
Q: Why does an SAP IDM sunset create compliance and operational risk?
A: Because identity controls do not stop being needed when the platform reaches end of support.
Q: What are the signs that an SAP IDM migration is carrying too much technical debt?
A: Look for deeply nested custom workflows, unclear ownership of old approval logic, undocumented integrations, and repeated efforts to mimic legacy behaviour exactly in the target platform.
Practitioner guidance
- Inventory the full IDM control surface Document every SAP IDM workflow, custom rule, connector, approval path, and exception so the migration scope includes governance logic as well as data objects.
- Rationalise legacy customisation before selection Separate current business requirements from inherited scripts and remove workflows that no longer support policy, audit, or operational value.
- Sequence the migration by control criticality Move identity lifecycle and access request flows first, then certifications, SoD, and emergency access, so the most sensitive controls are validated early.
Bottom line: SAP IDM sunset is a governance redesign problem as much as a platform retirement problem.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 7:24 am
Lifecycle governance breaks down when identity platforms are treated as interchangeable tools. SAP IDM sunset shows that provisioning, approvals, and certification flows are part of the control architecture, not just the software layer. If those flows are copied into a new platform without redesign, the organisation preserves the same governance debt under a different interface. The practitioner conclusion is that migration scope must include control design, not only platform selection.
A few things that frame the scale:
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: When should organisations prioritise SAP IDM replacement over other IAM work?
A: Organisations should prioritise SAP IDM replacement when the retirement timeline becomes shorter than the time needed to inventory, redesign, test, and cut over identity workflows. If migration typically takes 18 to 36 months, waiting until the final maintenance window creates avoidable operational and compliance risk.
👉 Read our full editorial: SAP IDM sunset is forcing a multi-year IAM migration rethink