One Identity Manager SAP Integration

Integrating SAP systems into Identity and Access Management (IAM) is a common requirement because most large enterprises run one or more SAP applications, and users expect access to SAP to be handled as part of a single, end-to-end lifecycle. Managing SAP access separately from broader IAM creates fragmented request, approval, and review experiences and forces users to navigate multiple tools and processes. Organizations increasingly demand one Identity Governance and Administration (IGA) interface that spans all applications and services, regardless of deployment model.

This need is intensified by the shift from on-premises applications to cloud services and by diversification within SAP’s own portfolio. SAP offerings such as SuccessFactors and Concur differ substantially from traditional SAP environments, and the SAP portfolio lacks a consistent security model: products from SAP R/3 and S/4HANA to HCM, BI, Concur, and SuccessFactors use different access management approaches. Effective IGA therefore requires multiple, product-specific integration capabilities for both inbound HR-driven identity data and outbound provisioning to varied targets, including non-SAP services.

One Identity Manager positions itself as a leading IGA product with SAP-certified integration dating back to 2003, combining deep SAP connectors for on-premises systems with cloud integration through One Identity Starling Connect. It supports joiner/mover/leaver processes, workflow, policy enforcement, role management, access reviews, and cross-system segregation of duties (SoD). The SAP connector (licensed separately) includes modules for user management, structural profiles, analysis authorizations, and compliance. Integration extends beyond roles and profiles to detailed SAP artifacts like menus, transaction codes, and authorization objects. One Identity Manager can replace SAP Access Control for SoD and access management, though full firefighter access requires One Identity Safeguard, and integration to SAP Access Control via web services is custom rather than out-of-the-box.

• Most large businesses own one or more SAP applications.
• End users commonly complain about having different access request and management interfaces for different sets of applications and services.
• SAP offerings such as SAP SuccessFactors and SAP Concur are substantially different from traditional SAP environments and require new integration capabilities.
• There is no consistent security model across the SAP portfolio of applications and services.
• One Identity Manager has provided certified integration into SAP environments since 2003.
• The SAP connector for One Identity Manager is licensed separately and consists of multiple modules: SAP, SHR, SBW, and SAC.
• One Identity Starling Connect is licensed separately and is used for cloud-based integration to SaaS solutions including SuccessFactors, Concur, and SAP Cloud Platform.
• Baseline SAP integration can create SAP user accounts and manage assigned profiles, roles, and groups, but does not manage profiles and roles inside SAP.
• One Identity Manager can integrate with SAP Access Control via web services, and that integration requires customization.
• Full firefighter access in emergency situations requires One Identity Safeguard as a separate component, while One Identity Manager can manage firefighter accounts.

• “Granting user access to SAP environments is not a challenge of SAP specifically, but part of the generic user lifecycle management processes that span all relevant applications.”
• “Running SAP-related access management separately from the rest of IAM neither responds to the user’s demand of having one lifecycle to request access, to approve access, and to review access.”
• “There is a demand and a need for having one interface for IGA tools, across the entire range of applications and services, regardless of deployment model and type of application.”
• “A specific challenge within the SAP portfolio of applications and services is the fact that there is no consistent security model within the SAP portfolio.”
• “Thus, it is not about a single piece of SAP connectivity, but specific support for the various tools that SAP provides to its customers.”
• “One Identity Manager provides comprehensive and certified integration into SAP environments since 2003.”
• “Standard (and certified) integration simplifies the deployment of well-working integration of HR and the IGA tool, but is rarely found as an out-of-the-box capability.”
• “With its capability of synchronizing detailed SAP information, well beyond profiles and roles, One Identity Manager delivers deep integration into SAP environments.”
• “The integration of One Identity Manager with SAP environments is very sophisticated, allowing for fine-grain control of these environments, well-beyond what is commonly found in IGA products.”
• “In sum, One Identity Manager is one of the few solutions in the market that support comprehensive management of SAP environments and replacement of SAP components such as SAP Access Control.”