SAP IDM Exit
SAP Identity Management is ending. Plan the exit before the date plans it for you.
SAP Identity Management 8.0 leaves mainstream maintenance at the end of 2027, and there is no version 9. We map what your IDM does today and design where each job goes next: Microsoft Entra, SAP Cloud Identity Services, or both.
Fixed scope. Ends with an exit brief: what your IDM does today, the target options and the risks.
An exit, job by job. Drag through the phases.
example, made-up dataIn its new home 0
Being moved 0
Still in IDM 6
- Password reset
- Joiner, mover, leaver from HR
- SAP role provisioning
- Approval workflows
- Access reports for audit
- Custom scripts and connectors
The problem
IDM is quietly holding up your whole access process.
There is no successor product
Extended maintenance runs to the end of 2030 at extra cost. SAP recommends Microsoft Entra ID as the path forward.
Years of custom logic
Most IDM systems carry scripts and rules written long ago, by people who have since moved on.
It touches HR, SAP and Microsoft
Hiring, role changes and leavers all pass through it. A gap here becomes an audit finding.
Extended maintenance buys time, at a price
It is a valid choice. It should be a decision, not a default.
The end date is not the risk. The risk is finding out what IDM did after you switch it off.
What we do
List, choose, design, cut over without surprises.
- Step 01 of 4
List what IDM does today
Every job, connector and script, with the person who depends on it.
- Step 02 of 4
Choose the target
Microsoft Entra, SAP Cloud Identity Services, or both. What each covers in your landscape.
- Step 03 of 4
Design the provisioning
How people get, change and lose access in the new setup, with HR as the source.
- Step 04 of 4
Plan the cutover
What moves when, what runs in parallel, and how you roll back.
Step 1 of 4
What you get
Six documents that make the exit a project, not a scramble.
Tap a document to see what's inside.
- Every job IDM performs
- Who depends on each
- The cost of waiting
- Entra, SAP Cloud Identity Services, or both
- What each will handle
- What needs a new process
- HR as the source
- Approvals and who gives them
- SAP roles and Microsoft groups together
- Which agents need their own identity
- Who owns each
- How their access is reviewed
- Orphaned and shared accounts
- Access nobody can explain
- Quick fixes before the move
- The order of the move
- What runs in parallel
- Rollback for each step
How it fits
Two vendors, one identity process. We design the join.
Microsoft and SAP each cover part of what IDM does. Somebody has to decide which job goes where.
Microsoft gives you
Entra ID
- Workforce identity and sign-in
- Access governance and reviews
- Provisioning to connected apps
SAP gives you
Cloud Identity Services
- Sign-in for SAP applications
- Provisioning into SAP systems
- The link to your SAP roles
We design
Which job goes where
- One joiner, mover, leaver process
- SAP roles and Microsoft groups aligned
- Identities for AI agents
- A cutover your auditors accept
Who this is for
You run SAP Identity Management, and nobody wants to touch it.
- You run SAP Identity Management 8.0.
- Microsoft 365 already handles identity for your workforce.
- Your IDM carries custom scripts that only one person understands.
- Your auditors rely on reports that come out of IDM.
How to start
How to start
- 01
IDM exit brief
Fixed scope. Ends with the inventory, the options and the risks.
- 02
Target and provisioning design
The design documents, agreed with HR, SAP and Microsoft owners.
- 03
Cutover support
We lead the plan. The build is done with your team or your partner.
Questions
What people ask before the first call.
When does SAP Identity Management end?
Mainstream maintenance ends at the end of 2027. Extended maintenance runs to the end of 2030 at extra cost.
Do we have to move to Microsoft Entra?
SAP recommends Entra ID. SAP Cloud Identity Services connects your SAP applications. Many landscapes need both, and we design for yours.
Can we just buy extended maintenance?
Yes. It buys time. The inventory is worth doing either way, because it is the part that takes longest.
Do you do the migration?
We design it and lead it. The build is done with your team or an implementation partner.
Go deeper
Our research behind this page.
Do you know everything your IDM does today?
Most teams do not, and that is normal. The exit brief gives you the list, the options and the risks.
Or write to support@ux4tech.com
Insights and Architecture Briefs
