Multi-ERP SoD Analysis: SAP, Business One, Business Central & More

Multi-ERP segregation of duties needs one ruleset, not one tool per system. MTC Skopos ships native connectors for SAP ECC, S/4HANA, S/4HANA Public Cloud, SAP Business One and Microsoft Dynamics 365 Business Central, and covers Odoo, Dynamics NAV, Sage, PeopleSoft, Kyriba and any other ERP through a generic user-privilege format. A 10,000-user analysis runs in under 2 minutes and the flat €5,736/year license has no per-system fees. Cross-system rules, which catch a conflict split across two ERPs, are an optional €1,199/year add-on.

	MTC Skopos for multi-ERP landscapes
SAP connectors	ECC and S/4HANA via RFC or table exports; S/4HANA Public Cloud from tenant exports; SAP Business One via the DI API (HANA or SQL Server)
Microsoft connector	Dynamics 365 Business Central via a read-only connector extension (API or ZIP export)
Other ERPs covered	Odoo, Dynamics NAV/Navision, Sage, PeopleSoft, Kyriba
Everything else	Generic user-privilege format (Oracle, NetSuite, custom systems)
Systems per license	Unlimited, no per-system fees
Ruleset	One Excel format for every system; 350+ SoD risks and 700+ critical access checks included as an SAP ERP template
Cross-system conflicts	Optional add-on module, €1,199/year
Speed	10,000 users analyzed in under 2 minutes
Deployment	Portable desktop application, on-premise, no cloud upload

Why is multi-ERP SoD a different problem than single-system SoD?

Because the riskiest access combinations do not respect system boundaries. A user who creates vendors in SAP and approves payments in a treasury system holds a textbook SoD conflict, yet each system on its own looks clean. Landscapes drift into this shape through acquisitions, subsidiary systems, and best-of-breed purchases, and most SoD tooling was built for exactly one ERP.

Running a different analyzer per system does not fix it. Three tools means three rulesets to maintain, three report formats to reconcile, and still no view of conflicts that span systems.

Most programmes have not closed this gap. In the 2026 SoD survey, 38% of organizations limit their ruleset to a single system and only 13% cover non-SAP systems (survey findings).

How does MTC Skopos handle a mixed landscape?

One application, one ruleset format, one report. Each system is read on its own access model, then evaluated against the same risk definitions, so "create vendor" is the same risk whether it happens in S/4HANA, Business One or Business Central.

MTC Skopos was built by SAP authorization specialists, and that depth carries over: findings trace to the role, permission set or authorization group that grants the access, and remediation proposes changes to those same objects. Speed makes this practical at landscape scale: each 10,000-user system analyzes in under 2 minutes, so sweeping five ERPs is a morning's work, not a project. The full detection scope (SoD, critical access, over-privilege, organizational checks) is described on the access risk analysis page.

Which ERP systems does MTC Skopos support?

Out of the box: SAP ECC and S/4HANA via RFC or table exports, S/4HANA Public Cloud from standard tenant exports, SAP Business One through the DI API, and Microsoft Dynamics 365 Business Central through a read-only connector extension. Odoo, Microsoft Dynamics NAV/Navision, Sage, PeopleSoft, and Kyriba are also covered. Any other system, including Oracle, NetSuite, or custom applications, can be analyzed through the generic user-privilege import format. One license covers an unlimited number of systems.

System	Connector	What is analyzed
SAP ECC, S/4HANA	RFC or table exports, fully offline	Roles, profiles, authorization objects and values, usage
S/4HANA Public Cloud	Six standard tenant exports	Business roles, IAM apps, restriction values
SAP Business One	DI API, or files from an MTC script	General authorizations, authorization groups, superusers
Business Central	MTC Skopos Connector extension, API or ZIP	Permission sets, security groups, licences, security filters
Odoo, Dynamics NAV, Sage, PeopleSoft, Kyriba	Dedicated import paths	Users, roles and privileges
Oracle, NetSuite, in-house systems	Generic user-privilege format	Users, roles and privileges

How do I analyze an ERP that has no native connector?

Export the system's users, roles, and permissions into the documented generic user-privilege format (a flat CSV structure), and MTC Skopos analyzes it like any native source. This is how Oracle, NetSuite, and in-house applications are typically covered; our team can assist with the transformation.

Which landscapes mix SAP with Business One or Business Central?

Two-tier ERP is the common case: S/4HANA or ECC at headquarters, SAP Business One or Business Central in subsidiaries and acquired companies. The group auditor asks for the same SoD evidence in every entity, and shared service staff often hold accounts in the core and in a subsidiary system. Loading all of them in one tool gives one set of evidence and, with cross-system rules, shows the conflicts that sit across entities.

How does cross-system SoD detection work?

Rules can pair a function in one system with a conflicting function in another, for example creating a vendor in SAP and approving the payment in Kyriba. MTC Skopos matches user identities across the connected datasets and reports the combined conflict, which single-system tools cannot see. Cross-system rules are an optional add-on module at €1,199/year.

The combined finding keeps the same authorization-level traceability as a single-system one. This is the case consultants hit constantly at mid-market clients: SAP for logistics, a separate finance or treasury system, and no tool that sees both.

Is multi-ERP analysis included in the base MTC Skopos license?

Analyzing multiple systems is included: the €5,736/year base license has no per-system or per-user fees, so you can run separate analyses on as many ERPs as you want. The Cross-System rules module, which detects conflicts spanning two different systems in one rule, is a separate add-on at €1,199/year.

All prices are public on the pricing page.

What is the best SoD software for multi-ERP environments?

It depends on the deployment model you need. Pathlock and SafePaaS cover many ERPs from the cloud with provisioning workflows attached. MTC Skopos is the on-premise specialist: native connectors for the SAP family and Business Central, a generic format for everything else, a 1,150+ check SAP template ruleset, and flat pricing from €5,736/year with no per-system fees.

Enterprise multi-ERP platforms such as Pathlock price per user and per connected system, which is the structural cost difference. The SAP GRC alternatives comparison and the 15 SoD tools guide put the options side by side.