SAP Identity Management: How it works and how to migrate

SAP Identity Management (SAP IDM) is SAP's on-premises identity management product. It manages user and access data centrally, based on roles. You maintain an identity once, and SAP IDM creates, updates and removes the matching accounts in every connected system. The technology came from MaXware, a Norwegian vendor SAP acquired in 2007. It first shipped as SAP NetWeaver Identity Management 7.0 and became SAP Identity Management with release 8.0.

It was never a general-purpose identity governance suite, but for close to two decades it has been the default choice for organizations that wanted SAP user administration driven from one authoritative source, with deep reach into SAP ERP Human Capital Management (SAP HCM), ABAP authorizations and SAP Access Control.

That position, however, is changing. SAP has confirmed that maintenance for SAP Identity Management ends in 2027, with extended maintenance available until 2030. This makes version 8.0 the final functional release.

For most SAP customers, identity strategy is now tied directly to two major transformations: the move from ECC to SAP S/4HANA, and increasingly, the transition to RISE with SAP.

In this guide, we will look at the components SAP IDM is built from, the capabilities you can implement with it and how to migrate to a long-term replacement before support runs out.

Next, let's explore how the components above combine to deliver the capabilities SAP customers actually implement, and what any replacement therefore has to cover.

Central identity lifecycle management and governance during the move to SAP S/4HANA

Access changes are automated from a single authoritative record when someone joins, changes role or leaves.

You can:

• Create accounts automatically: Provision into ABAP, Java, database, directory and cloud targets from one identity record.
• Propagate changes: Push name, organizational, validity and attribute changes to every connected system.
• Deprovision on exit: Lock, expire or delete accounts across the landscape when an identity is terminated.
• Transition to SAP S/4HANA: Preserve governance, approvals, and auditability during the transition to SAP S/4HANA.

HR-driven provisioning and supporting workforce identity across on-premises and cloud SAP environments

HR-driven provisioning makes the HR system the trigger for access changes.

You can:

• Import employee master data: Bring organizational assignment, position, cost center and employment status from SAP HCM.
• Trigger joiner, mover and leaver events: Start provisioning, role changes and deprovisioning from HR events automatically.
• Read from SuccessFactors: Use the SuccessFactors connector where HR data lives in the cloud.
• SAP Support: Support both SAP and non-SAP applications from a single governance framework.

Rules and role-based provisioning

Role-based access control (RBAC) bundles technical privileges into business roles, so you assign the role rather than individual permissions.

You can:

• Define business roles: Group ABAP roles, profiles and other privileges into one role tied to a job function.
• S/4HANA transformation program: Reevaluate legacy ECC roles before migrating to S/4HANA.
• Assign privileges through roles: Assign the role and let the framework create the right accounts and entitlements.
• Use rule-based assignment: Build dynamic groups whose membership is calculated from attributes such as department or location.

Access request and approval workflows in modern SAP

The approval process is defined from business rules and policies in a web-based workflow engine.

You can:

• Route requests to the right approvers: Send a request to a line manager, role owner or system owner as appropriate.
• Build multi-step approvals: Require several approvals in sequence for higher-risk access.
• Migrating from SAP Legacy solutions: Ensure access requests remain auditable across legacy and modern SAP environments.
• Capture the decision trail: Record who approved what, when and on what basis, for later audit.

Password management and self-service password reset (Legacy)

This section covers both provisioning passwords into target systems and letting users recover access themselves. Although, Password synchronization is no longer a strategic discussion point for SAP transformation buyers.

Compliance checks and segregation of duties

Segregation of duties (SoD) stops one person holding permissions that let them complete a sensitive transaction end to end. SAP IDM does not evaluate the rules itself, it calls SAP Access Control.

You can:

• Validate requested permissions against SAP Access Control rules before anything is assigned.
• Stop a conflicting request, or route it for extra approval and mitigation.
• Use the GRC framework in the Identity Center with a Virtual Directory Server configuration.
• Maintain SoD controls as roles and authorizations are redesigned.
• Ensure compliance requirements survive infrastructure and operational changes.
• Support ongoing audit readiness across hybrid SAP landscapes.

Attestation and access reviews

Attestation is the periodic review in which an owner confirms that access already granted is still appropriate. In SAP IDM it is only partially surfaced.

You can:

• Run attestation tasks: Configure attestation tasks in the Identity Center to generate review activity.
• Have owners confirm or revoke: Ask managers and role owners to sign off on current assignments.
• Access it through REST version 2 only: Build the review interface against the API, because the HTML5 interface does not support attestations.

Provisioning across SAP environment and preparing for RISE non-SAP and cloud systems

One Identity record can drive account creation well beyond the SAP estate.

You can:

• Provision ABAP users and authorizations: Create and maintain SU01 users, roles and profiles in AS ABAP, SAP Business Suite and on-premises SAP S/4HANA.
• Identity governance: Govern identities consistently across SAP S/4HANA, RISE with SAP, SuccessFactors, and non-SAP platforms.
• Centralized identity management: Maintain centralized visibility and control as infrastructure ownership shifts under RISE with SAP.
• Manage directories, mail and databases: Provision to Active Directory, Exchange, generic LDAP directories and SAP HANA.
• Populate Identity Authentication: Create and maintain users in SAP Cloud Identity Services – Identity Authentication for cloud application access.

The migration itself runs on ASCONSIT FASTlane, an analysis tool and consulting service built specifically for moving from SAP IDM to Identity Manager by One Identity.

Instead of starting with an empty platform and rebuilding everything from documentation, FASTlane pulls your existing configuration out, lets you review it, then loads it into the new environment. The five steps:

1. Generate a new Identity Manager cloud tenant. A fresh Identity Manager On Demand tenant becomes the target environment, so nothing has to be installed before work begins.
2. Connect to that tenant. Migrated data then has somewhere to land and workflows can be built against real content.
3. Analyze and clean up your data. All existing SAP IDM data is extracted and reviewed in FASTlane: system data, connectors, custom workflows, connections, system size and customizations to entry types and attributes. Because the analysis runs on that extracted copy, no live connectivity is needed and your existing environment is untouched.
4. Use mapping to ensure the data lands where it should. Existing or customized mappings translate SAP IDM entry types, attributes and assignments into the Identity Manager data model.
5. Migrate your data. The mapped data is loaded into the tenant, with scheduled updates keeping it current as the project continues.

What this gives you on day one

ASCONSIT positions FASTlane as a scalable approach suiting large and small organizations alike. The benefits it is built to deliver are:

• Access to your data on day one: You work with your own identity data and a first workflow in the new platform immediately.
• Data analysis and clean-up: Dropping accounts, workflows and features that are no longer needed leaves the environment leaner than before.
• Migration based on existing or customized mappings: Configuration is translated through mappings and refreshed on a schedule, not retyped by hand.
• Industry-leading identity governance: The end state is a full IGA platform, not a copy of what SAP IDM did.

With mainstream maintenance ending in 2027, the question is not whether to move, but where to move and how.

Why this is a replacement, not an upgrade

There is no SAP IDM 9.0, so the target is a different platform with a different data model.

• Logic has to be rebuilt: SAP IDM logic lives in jobs, tasks and scripts, while a more modern identity governance and administration (IGA) platform expresses it as configuration and policy.
• Customization has to be assessed: Long-running deployments accumulate custom workflows, entry types, attributes and connectors, and not all of it is still needed.
• The landscape has moved on: Most organizations run a mix of on-premises SAP, SAP S/4HANA, SuccessFactors, SAP BTP and non-SAP SaaS, all of which the replacement has to govern.
• Timelines are long: SAPinsider puts a typical migration at 18 to 36 months for a large organization, which is why 2027 is closer than it looks.

Identity Manager by One Identity as the migration path

Identity Manager is the strongest fit for organizations replacing SAP IDM: it covers the SAP-specific depth those customers depend on and adds the governance layer SAP IDM lacked. When SAP looked for a partner solution to support customers leaving SAP IDM, it set stringent requirements covering SAML, OIDC, SCIM and X.509, on-premises and cloud workloads, and SAP Fieldglass, SAP SuccessFactors and SAP Cloud Identity Services. Identity Manager met all of them natively, the outcome of years as SAP's development partner around identity governance.

• Certified SAP integration: One Identity has held SAP certification since 2003 for user lifecycle management, governance and native connector integration, including a certified ABAP connector.
• Coverage of the SAP estate: Supported targets include SAP S/4HANA Cloud and Private Edition, SAP Business Suite (ECC and R/3), SAP HCM, SAP Business Intelligence, SAP SuccessFactors, SAP Cloud Identity Services and SAP Concur.
• SAP authorization depth: SAP groups, roles and profiles are mapped so they can be bundled into products and assigned to identities, with an add-on for structural profiles and personnel planning data.
• Segregation of duties built in: SoD controls are designed for SAP’s authorization model, so risk rules and mitigations sit in the same platform as provisioning.
• Governance out of the box: Attestation, access certification, IT Shop requests, privileged access governance and compliance reporting are configured rather than coded, and SAP accounts, Active Directory domains and Microsoft Entra ID tenants are governed from one console.
• Deployment choice: The platform runs on-premises or as SaaS through Identity Manager On Demand, which is what makes a fast, low-risk migration start possible.

SAP Identity Management is a distributed system whose components can be installed across separate hosts. Below are the main ones and what each does.

a. Identity Center

The Identity Center is the primary component for identity management. It uses a central repository, the identity store, to present a uniform view of identity data whatever its source. It comprises the Identity Management database, the runtime components and the Developer Studio.

b. Identity Management database and identity store

The database holds all information about managed users and their accounts and runs on a supported database management system. Inside it, the identity store is modeled as typed entries: MX_PERSON for people, MX_PRIVILEGE for technical privileges and MX_ROLE for business roles.

c. Identity Management Developer Studio

The Developer Studio is an Eclipse plug-in and the environment in which the configuration is built. For example, developers use it to maintain identity stores, the identity store schema, packages, repository types, processes, forms and jobs.

d. Provisioning framework and connectors

The provisioning framework supplies the standard processes and tasks for reading from and writing to connected systems, with connectors delivered as separate packages. SAP ships connectors for on-premises SAP S/4HANA, AS ABAP, AS Java, SAP HANA, SuccessFactors, SAP Cloud Identity Services, Microsoft Active Directory and Exchange, and generic LDAP directories.

e. Identity Management user interfaces and REST API

End users reach identity store data through the Identity Management user interface, which offers self-service and management functions. Administrators use a separate administration interface. A REST interface, currently at version 2, supports custom front ends.

f. Virtual Directory Server

The Virtual Directory Server (VDS) makes several separate directories, databases and repositories look like a single directory. You control which parts of that data each user and application sees. Running standalone, it accepts incoming LDAP requests. On SAP NetWeaver AS for Java, it accepts Service Provisioning Markup Language (SPML).

g. Identity Federation

Identity Federation is a separate component that handles single sign-on (SSO) for SAP and non-SAP systems. It supplies a SAML 2.0-compliant identity provider for browser logins, and a security token service for SSO between web services.

SAP Identity Management did its job well for a long time: a central identity store, role-based provisioning into ABAP and non-SAP systems, HR-driven lifecycle management from SAP HCM and risk checks through SAP Access Control. That list is the bar any replacement has to clear.

With maintenance ending in 2027, no on-premises successor from SAP and migration timelines running well over a year, the planning window is now.

Identity Manager is the strongest destination: SAP-certified, deeper into SAP authorizations than a general-purpose provisioning service, and equipped with the attestation, certification and SoD controls SAP IDM customers previously had to assemble elsewhere.

Paired with ASCONSIT FASTlane, you extract what you have, clean it up, map it and start working with your own data on day one, while your existing environment keeps running until you are ready to switch it off.