What breaks when SAP role redesign is done manually during migration projects?

Why This Matters for Security Teams

Manual SAP role redesign is not just a project-management inconvenience. During migration, teams are trying to preserve business access while changing technical foundations, which creates a narrow window where errors become security defects. When role mapping is done by hand, inherited access often survives under new role names, while missing authorisations are added ad hoc and never normalized. That undermines least privilege, slows testing, and makes post-migration audit evidence weak. NIST’s control baseline for access enforcement in NIST SP 800-53 Rev 5 Security and Privacy Controls is useful here because it assumes disciplined authorization management, not improvised redesign under deadline pressure. NHIMG research on Ultimate Guide to NHIs shows why this matters operationally: 97% of NHIs carry excessive privileges, which is exactly the kind of risk manual redesign tends to preserve rather than remove. In practice, many security teams discover those over-entitlements only after go-live pressure has already locked them into production support cycles.

How It Works in Practice

In SAP migrations, manual role redesign usually starts with spreadsheet-based entitlement mapping, interviews with business owners, and one-off exceptions for edge cases. That looks controlled, but it creates a fragile chain of assumptions: which transactions are truly needed, which composite roles can be reused, and which access paths are only present for testing. Every manual judgment adds variance, and every variance becomes harder to reproduce in audit or UAT. A more reliable approach is to treat role redesign as a governed transformation problem:

• Inventory current SAP roles, derived roles, and technical users before changing the target model.
• Map access by actual usage, not by historical role labels, so unused authorisations can be removed.
• Separate business-critical access from temporary migration access, then time-box the temporary layer.
• Document exceptions with an approval path and a planned retirement date.
• Re-test after each mapping change so duplicate roles and missing authorisations are detected early.

That discipline aligns with the broader governance concerns documented in NHIMG’s NHI guidance, because SAP service accounts and integration identities often inherit the same privilege sprawl as human roles. It also fits the access governance logic in NIST SP 800-53 Rev 5 Security and Privacy Controls, where authorization is expected to be controlled, reviewed, and traceable. These controls tend to break down when the migration spans multiple SAP landscapes, because inconsistent transports and local overrides make role parity impossible to maintain manually.

Common Variations and Edge Cases

Tighter role control often increases migration effort, requiring organisations to balance speed against the cost of rework and business disruption. The standard answer changes when the SAP landscape includes custom transactions, cross-system integrations, or shared technical users, because those environments blur the line between functional access and system access. In those cases, manual redesign often expands into exception handling, and exception handling can quietly become the real authorization model. There is no universal standard for this yet, but current guidance suggests that migration teams should avoid treating temporary access as harmless. That is especially true for interfaces and batch jobs, where access is used indirectly and rarely shows up in business testing. Manual redesign also struggles when ownership is split across infrastructure, SAP basis, and application teams, because no one has a complete view of what each role actually enables. NHIMG’s reporting on the SAP Breach is a reminder that authorization weaknesses can persist beyond the project window and become operational exposure later. The practical takeaway is to constrain exceptions, review them after cutover, and retire them aggressively before they harden into permanent access.

Related resources from NHI Mgmt Group

• What breaks when healthcare teams rely on manual access reviews and role management?
• Why does SAP cloud migration create new access governance risk for enterprises with legacy ERP estates?
• What breaks when access certifications and lifecycle controls are missing from SAP identity governance?
• What breaks when organisations try to clean up machine accounts manually?