Governance over hybrid SAP Environments – the ANZ Story

Identity Governance and Administration (IGA)—spanning user lifecycle management and access governance—is positioned as essential for organisations seeking both frictionless user experience and compliance with regulatory obligations. Effective governance improves visibility into who has access to what, strengthens cybersecurity by detecting inappropriate access and policy violations, and helps uncover weak controls. These needs become harder in hybrid environments, where cloud and on-premises applications coexist, increasing the urgency for comprehensive governance solutions.

SAP ERP is described as “heavy-duty” software embedded across operational and administrative processes, making cloud migration to S/4HANA a high-friction, high-risk change. In Australia and New Zealand (ANZ), migration challenges are amplified by smaller organisational scale and a limited pool of skilled SAP staff and contractors, encouraging a “if it’s not broken don’t fix it” mindset that can lock organisations into legacy constraints and reduce agility. A survey commissioned by SailPoint (developed with KuppingerCole) targeted roughly 100 SAP-responsible professionals; 30 comprehensive responses were received, treated as statistically relevant.

Findings indicate ANZ SAP ERP remains predominantly on-premises even as SAP SaaS point solutions are widely adopted, implying the barrier is not cloud aversion but the complexity of governance and access control. Over half rely on SAP GRC, yet significant manual entitlement management persists, and policy ownership remains largely in IT rather than business units. Separation-of-duties is widely required, risk management is a high priority, and monthly governance reporting is labour-intensive and often integrity-challenged—driving limited confidence in governance outcomes. Many organisations also lack clarity on cross-application entitlement visibility, while expressing universal appetite for a single, comprehensive, easy-to-implement governance platform. SailPoint Access Risk Management is presented as a potential enabler through SAP connectivity and centralised governance.

• Three quarters of respondents reported their organisations were headquartered in Australia.
• New Zealand represents approximately 20% of the ANZ region’s population.
• One third of surveyed organisations were still using SAP R/2 for ERP.
• 24% of surveyed organisations had adopted S/4HANA.
• 16% of respondents used SAP’s CRM tool.
• 4% of respondents used SAP SRM for supplier management.
• 14% of respondents indicated they were primarily cloud-based.
• 20% of respondents relied on manual entitlement processes for access control.
• Nearly 80% of respondents reported using separation-of-duties requirements in access control policy.
• More than two-thirds of respondents took between two and five days to complete monthly governance reporting.

• “The goal is to provide a frictionless governance environment that efficiently serves user needs and accommodates corporate regulatory requirements.”
• “Governance provides visibility into ‘who has access to what’ within an organisation and a heightened level of cybersecurity through detection of inappropriate access.”
• “SAP is ‘heavy-duty’ enterprise resource planning (ERP) software that touches most operational and administrative processes in an organisation.”
• “A lack of resources is a major deterrent to the effective transition of SAP ERP to cloud-based services.”
• “Too often the response to the cloud migration task is ‘if it’s not broken don’t fix it’.”
• “This means that fine-grained access control is required.”
• “Moving policy management for access control to the affected business units is an area that companies should investigate.”
• “Automating monthly reporting to the degree possible will reduce costs, improve data integrity and accelerate corrective action.”
• “Strengthening identity governance, and improving compliance is the single most important component to raising a company’s security posture.”
• “It is recommended that SAP clients take a corporate-wide view of their IT environments rather than treating ERP as a stand-alone application.”