Optimize your SAP licensing strategy

I'm James Watson. I'm the director of global services for privacy and security here at EPI-USE Labs. And today, I'm wanting to talk a little bit about the changes to the SAP license model that are coming in as part of the S/4 and RISE process, and how we can help actually impact assess and help reduce that license cost with the use of our partner solution, Soterion. So firstly, the change that's occurring. The new model is called Full Use Equivalent or FUE license modelling, and that is based on specific authorization objects within the SAP environment. And any people that have roles with those authorization objects will be classified as a full use user. And as such, they will then go through for license management against SAP. So in many cases, you may have employees that have roles from previous jobs within the organization, and those roles have never been removed. They will possibly have role setups where you have quite complex roles for a Finance user. But, actually, if we created some Segregation of Duty to be able to say, well, actually, how often are you using that authorization versus the normal? You may have some team splits where you could say, well, one user does need that advanced usage. They're using it daily. But if another user is not and maybe only uses it once a month, then could that be a firefighter control for that user to be able to get that access? Or even is it a business change that could say the other users that do need those authorizations could go through? So there's a number of different ways that you can address this, but the first thing you need to understand is actually how large of a problem do you have. Now there are specific trace programs within SAP that need to be activated that will monitor exactly what your users are using. We can get those running. Once they've been running for a long enough period of time, we can hand over to our partner solution, Soterion, where they will ingest the information from those logs. They'll do an analysis for you, and they'll present back to you the FUE cost. They'll tell you what your FUE count is. Soterion also then have specific rule-sets designed to be able to help advise on how to reduce those FUE license costs. The change can be quite significant when you're going from the old model to the FUE license model. And you can run some of these checks prior to the migration to be able to say, for your existing organization in ECC, how many users do you have that have authorizations that would be classed as FUE in the new process? Or if you've already made that transition and you are already suffering from higher license costs, this is something where we'd be able to provide compliance software with a business payback case for a return on investment. We're quite excited by this opportunity to be able to bring a new license management component to the market, and EPI-USE Labs are very proud to work with Soterion as the technology base, but with our services team able to support you on the delivery of that role redesign project to be able to significantly reduce your license cost.

Common licensing challenges for SAP customers

Managing SAP licenses effectively can be complex, especially as businesses navigate transitions to SAP’s cloud solutions. The shift to the Full Use Equivalent (FUE) licensing model can lead to challenges in tracking and optimizing licenses accurately. Over-licensing can result in unnecessary costs, while under-licensing risks compliance violations and unexpected true-up fees. Many organizations also struggle to maintain visibility into actual system usage, often leading to wasted spend or compliance issues. Whether migrating to SAP Cloud ERP Private, or maintaining an on-premises SAP environment, businesses running S/4HANA need a streamlined approach to manage licenses and avoid costly surprises.

How Soterion’s SAP License Manager can help

Soterion’s SAP License Manager module offers a comprehensive, data-driven approach to managing your SAP licenses. By accurately tracking user roles and system usage, it ensures you're only paying for what you truly need. The solution automates the audit process, simplifying compliance and significantly reducing the time spent on manual checks. With features like role clean-up and cost simulations, Soterion empowers businesses to optimize license allocation, avoid unnecessary costs, and maintain compliance across all SAP environments.

Smarter role decisions with integrated access and license impact analysis

For even greater control, License Manager integrates with Soterion’s Access Risk Management module. This allows you to simulate proposed role or authorization changes and instantly see their impact; not only on risk exposure, but also on your SAP Full Use Equivalent (FUE) requirements. If a change would increase your FUE consumption, it’s flagged before it happens – helping you avoid unplanned license costs, and enabling approvals by the licensing team where needed.

Welcome to an overview of Soterion's SAP Access Risk Assessment process. Soterion offers select organizations running SAP the opportunity to perform an SAP Access Risk Assessment on their data. In this video, we will explain the process at a high level and discuss the benefits of performing this assessment. Here's what we'll cover: How much effort is required from you or your team's side? What data is used from SAP for this Access Risk Assessment? How is this data extracted? The Process: What are the benefits to my organization? What happens to our data after the assessment? How secure is our data? And lastly, connecting to your Soterion hosted database. How much effort is required from you or your team's side? Your effort involves a few straightforward tasks. Downloading the Data Extractor from our website will take approximately five minutes. Installing the Soterion Data Extractor on a desktop or laptop will take roughly five minutes. Initiating the download from SAP will take ten minutes. The extraction may take up to sixty minutes to run, but it will run-in the background. And lastly, uploading the files to Soterion's data center in your geographic region will take approximately five minutes. What data is used from SAP for this access risk assessment? Soterion extracts SAP authorization related tables such as USR02 and AGR_Define. We also download user transaction logs to determine whether any remediation or role cleanup opportunities exist. A full list of tables downloaded can be found in Soterion's Data Extractor Guide. How is this data extracted? Soterion has created a Data Extractor utility that uses standard SAP functionality to read the SAP authorization tables. No custom function modules or transports need to be installed on your SAP system. The person performing the data extract will need the SAP authorization for the tables being downloaded. Soterion can provide an SAP role with the necessary authorization if required. The Process: Download the Soterion Data Extractor from the Soterion website. Install the Soterion Data Extractor on a desktop or laptop. The person performing the data extraction uses their SAP credentials to initiate the extraction process. Upload the downloaded files to the Soterion Data Center. Soterion will prepare a database with this data. The client will be notified on completion, and the next steps will be communicated, which could include a demonstration or providing logon details to review the SAP Access Risk results. What Are the Benefits to my organization? A Soterion SAP Access Risk Assessment allows your organization to understand its access risk exposure. Soterion presents this information in a business friendly manner to enhance effective decision making. Powerful risk remediation functionality helps address access risk violations, which is especially beneficial before impending audits. It also offers a mini proof of concept using data that you are familiar with. What happens to our data after the assessment? After the assessment, Soterion will delete the data upon request. How secure is our data? Soterion adheres to the latest security protocols, including annual ISO27001 certification, a SOC 2 Type 2 report, and annual penetration testing. We do not download personal data such as email addresses. SAP Usernames are downloaded but can be masked to hide this information if needed. All data can be viewed via Soterion's Data Extractor before being uploaded, and it is zip-locked for added protection during the upload process. Connecting to your Soterion-hosted database Accessing the Soterion database requires a username and password that comply with your SAP password policy. Two factor authentication can also be set up if needed. Thank you for watching this overview of Soterion's SAP Access Risk Assessment process. We hope this video has provided valuable insights into how the assessment works and its benefits to your organization.

Over-licensing

Under-licensing

Transition to FUE model

Inefficient role management

Lack of visibility into license usage

Time-consuming manual audits

Over-licensing

Unnecessary spending on extra licenses

Many organizations struggle with over-licensing, where they purchase more SAP user licenses than they need. This happens due to a lack of visibility into actual system usage, resulting in unnecessary costs. Without a clear understanding of user roles and actual consumption, businesses often end up with a significant number of unused licenses, leading to wasted expenditure.

Optimizing license usage

Soterion’s SAP License Manager module helps track actual system usage, ensuring that you only pay for the licenses you need. By aligning licenses with real-time usage data, businesses can eliminate excess licenses and avoid unnecessary spending.

Under-licensing

Risk of non-compliance and audits

Under-licensing occurs when organizations don’t allocate enough licenses, often resulting in compliance violations during audits. Insufficient license allocation can lead to SAP penalties and unexpected true-up costs, especially if your system is under-licensed for actual usage.

Ensuring compliance and proper allocation

The SAP License Manager module accurately calculates the number of licenses needed based on real system usage. This helps prevent under-licensing, ensuring that your organization remains compliant and avoids penalties during SAP audits.

Transition to FUE model

Transitioning to Full Use Equivalent (FUE) licenses

The shift to SAP’s Full Use Equivalent (FUE) licensing model can be complex, with many organizations unsure how to measure and allocate the right number of licenses. Without understanding how FUEs are calculated, organizations may face significant overpayments for licenses.

Simplifying the transition to FUE

Soterion’s solution makes it easier to transition to FUEs by providing clear, data-driven insights into your current license usage. This allows businesses to optimize their licenses during the move to FUEs, ensuring they’re paying for what they need and staying compliant.

Inefficient role management

Managing SAP roles and authorizations

Inefficient role management can lead to unnecessary license allocation, especially when inactive or underutilized roles are not identified. This increases the complexity of managing SAP licenses and may result in wasted resources.

Streamlining role management for optimization

The module identifies inactive or unused SAP roles, allowing businesses to clean up their system and optimize license allocation. By managing roles effectively, organizations can simplify their license management process and reduce unnecessary costs.

Lack of visibility into license usage

Challenges of tracking license usage

Without real-time visibility into SAP license usage, organizations often struggle to understand where optimizations can be made. This lack of insight can lead to wasted resources and unexpected costs.

Real-time insights for better decision-making

Soterion’s SAP License Manager module provides real-time visibility and detailed analytics on license usage. This enables businesses to make informed decisions on licensing, helping to optimize resources and reduce unnecessary spend.

Time-consuming manual audits

The burden of manual license audits

Manual audits are time-consuming and prone to error. They require significant resources and often fail to provide the accurate insights needed to optimize SAP licenses.

Automating the audit process for efficiency

The SAP License Manager automates the audit process, making compliance tasks faster and more efficient. With automated insights, organizations can ensure they’re always compliant and avoid the inefficiencies of manual tracking.

We had the solutions within a week, and we benefited from the first day. We could start working with the system immediately - it was a real plug and play! It was even better than we expected.

Cecilie Relling, Senior Specialist, Finance Process Improvements & Systems, Aker Solutions

We wanted to minimise the access we give to users, but we wanted the capability to provide additional transactions when needed for exceptional cases...we can then audit exactly what access and what transactions the users have had. So that was a definite additional benefit of using Soterion.

David Hall, Head Of Business Solutions at Compass Group UK & Ireland

The Soterion solution does exactly what we need it to do. It’s proven to be very effective. We use it daily, not only for firefighter access, but for almost everything SAP authorization and access related.

Marko Lotens, Vice President Information Technology, Masimo Consumer

The GRC solution from EPI-USE Labs and Soterion raised awareness in the company, and moved the responsibility back to the business, rather than being with the IT team.

Atle Myklebust, Teamlead IT SAP Technical Services, Elkjøp Nordic

We had done it manually, but we needed to look for a mature sophisticated GRC solution. We were already working with EPI-USE Labs, so Soterion was the perfect tool for our SoD framework.

Piet Jan Van Egdom,Head of Enterprise Systems Team, Nikon Europe BV

With Soterion’s Access Manager, the approval process is much more transparent, and there is no resistance from the business users anymore.

Thijs Van Haaren, Tech Lead SAP Security, Orkla

Thanks to Soterion, I can ensure that our estate is secure, the data is secure, what people can and can’t do is secure. And the ability to report on that means that I feel secure, and we are doing the best for the organisation.

Zaki Mouden, Global Head of Enterprise Applications, BSI

We have had very good results on our Access Review Management, which is now performed by our line managers with much less effort.

Nick Achteberg, Senior Director Technical Services (SAP), Endeavor