When should manufacturing companies decide between SAP-native replacement and broader IGA?

Why This Matters for Security Teams

Manufacturing firms rarely need to choose between SAP-native controls and broader IGA on pure feature count alone. The real question is whether the identity program is trying to govern a single ERP boundary or the full employee, contractor, machine, and partner access lifecycle across plant systems, finance, logistics, and engineering tools. Once access spans SAP plus non-SAP workloads, lifecycle gaps become operational risk, not an IT preference.

A SAP-native stack such as SAP IAS and IPS can be a sensible fit when the scope is limited to SAP-centric authentication and provisioning. But when identity teams are expected to join, move, recertify, and offboard access across heterogeneous applications, the operating model shifts toward broader governance. The NIST Cybersecurity Framework 2.0 frames this as an enterprise governance problem, not a single-platform configuration task.

NHIMG research shows the risk of delay is not theoretical: only 5.7% of organisations have full visibility into their service accounts, and NHI Mgmt Group’s Ultimate Guide to NHIs notes that NHIs outnumber human identities by 25x to 50x in modern enterprises. In practice, many manufacturing teams discover the boundary problem only after plant access reviews, supplier onboarding, or audit findings expose how much identity sprawl sits outside SAP.

How It Works in Practice

The decision usually comes down to governance scope. SAP-native replacement is strongest when the identity program is primarily about SAP users, SAP roles, and SAP-connected workflows. It can simplify administration if the organisation wants to standardise on one vendor boundary and avoid a second governance layer.

Broader IGA becomes the better operating model when manufacturing companies need consistent controls across SAP and non-SAP applications, especially where access changes are triggered by HR events, contractor status, plant assignments, or supplier relationships. That is where joiner-mover-leaver controls, access certification, segregation-of-duties checks, and approvals need to work across the whole environment, not just within SAP.

• Use SAP-native controls when SAP is the dominant system of record and other applications are minimal.
• Use broader IGA when identity approvals must cover ERP, MES, IAM, cloud, engineering, and service management tools.
• Prefer IGA when audit evidence must show consistent lifecycle control across the enterprise.
• Use SAP IAS and IPS as identity plumbing, but not as a substitute for enterprise governance where scope is wider.

The JetBrains GitHub plugin token exposure example is a reminder that identity risk often sits outside the core ERP stack, while NIST CSF 2.0 pushes organisations to align access governance with enterprise risk outcomes rather than tool boundaries. Current guidance suggests evaluating whether SAP is the endpoint or merely one of many governed systems before the next renewal cycle. These controls tend to break down when manufacturing identities are federated across legacy plants, outsourced maintenance, and cloud applications because ownership and lifecycle events no longer originate in one system.

Common Variations and Edge Cases

Tighter standardisation often reduces operating complexity, but it also creates a tradeoff: the more a company relies on SAP-native replacement, the more it must accept SAP-centred governance limits when the business grows beyond that boundary.

There is no universal standard for this yet, but current guidance suggests three common edge cases. First, a manufacturer with mostly SAP access but a small number of non-SAP systems may keep SAP-native controls and use a narrow companion process for exceptions. Second, a company with multiple plants, acquisitions, or regional business units often needs broader IGA because access models diverge quickly after merger activity. Third, organisations with heavy contractor, engineering, or OT-adjacent access often find that non-SAP governance matters as much as ERP governance, even if SAP remains the financial core.

Best practice is evolving toward a scope-based decision: choose the smallest platform that can enforce lifecycle control across the actual access estate, not the one that looks simplest on the procurement sheet. For manufacturing leaders, the renewal cycle is the right checkpoint to compare administrative simplicity against auditability, offboarding speed, and enterprise-wide policy consistency.

Related resources from NHI Mgmt Group

• How do organisations decide between team vaults and enterprise password platforms?
• What is the difference between attack surface management and NHI governance?
• What is the difference between reviewing human access and reviewing NHIs?
• When does secret exposure become a broader identity risk?