Notifications
Clear all
Topic starter
24/07/2026 4:08 pm
TL;DR: Manufacturing SAP environments face 10 high-risk segregation of duties conflicts, led by combinations such as vendor master plus payment run and create user plus assign roles, because one user can initiate and complete sensitive transactions without independent oversight, according to OpenIAM. The governance problem is not just detection but preventing toxic combinations across SAP and adjacent identity systems before access goes live.
NHIMG editorial — based on content published by OpenIAM: The 10 Most Dangerous SAP Access Conflicts in Manufacturing
By the numbers:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities , 46% confirmed, 26% suspected.
Questions worth separating out
Q: What breaks when SAP users can create and approve their own transactions?
A: Independent control breaks down.
Q: Why do SAP access conflicts in manufacturing need process-level review?
A: Because the risk is created by combinations across business processes, not by one permission in isolation.
Q: How do security teams know if SoD controls are actually working?
A: SoD controls are working only if live access state matches the approved separation model across systems.
Practitioner guidance
- Define toxic SAP process pairs Build the SoD catalogue around business-process combinations such as vendor creation plus payment execution, not around isolated T-codes or module ownership.
- Review authorisation objects, not just roles Validate conflicting access at the authorisation-object level so hidden combinations do not survive role-name review.
- Block dangerous requests before assignment Move toxic combination checks into the request approval path so access that would create a conflict is flagged or stopped before it becomes active.
What's in the full article
OpenIAM's full article covers the operational detail this post intentionally leaves for the source:
- The 10 SAP conflict examples broken down by manufacturing process and transaction path.
- The remediation logic for split roles versus compensating controls when a conflict already exists.
- The evidence expectations auditors look for when a toxic combination is discovered.
- The broader governance argument for linking SAP decisions to adjacent identity systems.
👉 Read OpenIAM's analysis of the 10 most dangerous SAP access conflicts in manufacturing →
SAP SoD conflicts in manufacturing: where the governance gap sits?
Explore further
24/07/2026 4:13 pm
Cross-functional SAP access is the real SoD failure mode: The most dangerous risk is not a single toxic permission, but an identity that spans two separate business processes. That combination collapses the control model because the same user can initiate and finish a transaction without another reviewer ever seeing the full path. Manufacturing environments should treat cross-process overlap as a governance defect, not a narrow role design issue.
A few things that frame the scale:
- 88.5% of organisations acknowledge that their non-human IAM practices lag behind or are merely on par with their human identity and access management efforts, according to The 2024 Non-Human Identity Security Report.
- Only 19.6% of security professionals express strong confidence in their organisation's ability to securely manage non-human workload identities, according to The 2024 Non-Human Identity Security Report.
A question worth separating out:
Q: Who is accountable when SAP SoD findings are not remediated?
A: Accountability sits with both the access governance function and the business owners who accept the process risk. If a conflict is only reported as a technical issue, remediation stalls. When it is mapped to a business process and tied to an approval or exception path, ownership becomes much harder to defer.
👉 Read our full editorial: SAP access conflicts in manufacturing expose weak SoD governance
