Saviynt Application Access Governance

Short Summary

SAP remains central to many organizations’ business application landscapes, but it is increasingly complemented by SaaS and non-SAP Line-of-Business (LoB) systems. This expansion makes it essential to manage access entitlements, roles, Segregation of Duties (SoD) rules, emergency “firefighter” access, and broader identity and security controls across heterogeneous environments. As critical systems move to cloud platforms—whether SAP offerings like SuccessFactors and Ariba or third-party services—the scope of centralized access controls must extend beyond traditional ABAP systems and even beyond SAP altogether. Auditors continue to scrutinize SAP heavily, yet effective risk management requires consistent access governance across all critical LoB applications, not just SAP.

The market is expanding in breadth of supported environments (on-prem SAP, S/4HANA, and SaaS from SAP and vendors like Workday, Salesforce, Microsoft, and Oracle) and in breadth of capabilities (from identifying entitlements and SoD conflicts to mitigating access-related risks end-to-end). Deployment models are also shifting toward SaaS services, alongside ABAP-embedded options, SAP Fiori interfaces, and standalone web applications.

Saviynt, founded in 2015, evolved from a SaaS IGA product into the Saviynt Identity Cloud, converging Application Access Governance with IGA, Privileged Access Management (PAM), External Identity & Risk Management, and an “Intelligent Identity Warehouse.” Delivered as SaaS or customer-managed on AWS/Azure, it offers consistent monthly updates and strong tenant isolation, including FedRAMP-grade protections and BYOK encryption. Functionally, it spans cross-application SoD, emergency access, role and entitlement governance (including non-human accounts), preventive access requests, certifications, and continuous controls monitoring using real-time LoB data. Saviynt is positioned as a leading choice where organizations need deep SAP authorization support plus broad multi-vendor LoB governance, though it lacks some SAP-specialized add-ons like go-live management.

Interesting Facts

• SAP access controls commonly include roles, critical entitlements, Segregation of Duties rules, and firefighter (emergency) access.
• The scope of centralized access control is expanding beyond ABAP systems and beyond SAP to multi-vendor LoB and SaaS applications.
• Saviynt was founded in 2015.
• Saviynt started with a SaaS-based IGA solution and expanded to the Saviynt Identity Cloud.
• Saviynt Identity Cloud includes Application Access Governance, IGA, External Identity & Risk Management, Privileged Access Management, and an “Intelligent Identity Warehouse.”
• Saviynt can be deployed as SaaS from Saviynt cloud or run in customer-managed clusters on AWS and Azure.
• All Saviynt installations use the same codebase with consistent monthly update cycles.
• Saviynt provides FedRAMP-grade data protection with complete data and network isolation, private connectivity, and BYOK encryption.
• The solution supports six main capability areas including cross-application SoD, emergency access management, access requests, certifications, and continuous controls monitoring.
• Out-of-the-box rule sets are available for applications including SAP, Oracle, Infor, Epic, and Microsoft Dynamics.

Notable Quotes

• “Managing access entitlements including roles, but also SoD (Segregation of Duties) rules, firefighter access, and other aspects around identity, access, and security is essential for protecting these business-critical applications.”
• “Thus, the scope for centralized access controls is expanding beyond the traditional ABAP systems and even beyond SAP.”
• “The segment is expanding in two directions:”
• “Deployment is fully automated per tenant.”
• “This approach avoids lateral movement between tenants and balances the advantages of multi-tenant architectures and single-tenant segregation well.”
• “Access Request Management supporting an approach for preventative risk management, ensuring that risks become visible already at request and approval time”
• “Support is provided for all levels of SAP authorizations and access controls down to transaction codes, for instance, not limited to the high-level business role view most other IGA tools provide.”
• “Saviynt claims being able to add support for other LoB applications within very few weeks, based on their experience in integrating a wide range of applications.”
• “Saviynt’s solution is targeting use cases that require both IGA and Application Access Governance capabilities, the latter spanning a range of LoB applications.”
• “Saviynt successfully combines two sets of capabilities.”