S/4HANA Public Cloud SoD Analysis: IAM Apps & Restrictions

MTC Skopos analyzes SAP S/4HANA Cloud Public Edition on its own access model: business roles, IAM apps and restriction values, read from six standard tenant exports. The analysis runs offline on your machine with no integration user in the tenant, and the same run can include ECC or S/4HANA on-premise systems so conflicts that span the cloud and the core are visible. Licensing is a flat €5,736/year with no per-user or per-system fee, where Public Edition customers are otherwise usually steered to a SAP Cloud IAG project.

	MTC Skopos for S/4HANA Public Cloud
Access model analyzed	Business roles, IAM apps, restriction types, fields and values
Input	Six xlsx exports from standard Fiori apps
Connection to the tenant	None: no communication arrangement, no integration user
Ruleset	Written against IAM app IDs and restriction fields, kept separate from on-premise rulesets
Mixed landscapes	Tenant analyzed alongside ECC, S/4HANA on-premise and non-SAP systems
Cloud-to-core conflicts	Cross-System add-on, €1,199/year
Price	€5,736/year base license, unlimited systems and users

Why is SoD on S/4HANA Public Cloud a different problem?

Because the objects an on-premise ruleset is written against do not exist there. Public Edition has no PFCG, no S_TCODE, no authorization objects to read. A user gets business roles, a business role activates IAM apps, and each app exposes restriction types whose fields are set to restricted values or left unrestricted. A conflict is real only if the restriction values on both sides overlap.

This is also why the tooling question changes. SAP GRC Access Control was built for on-premise and private cloud, so organisations moving to Public Edition are usually directed to SAP Cloud IAG. The 2026 SoD survey shows the effect: reported IAG use grew from 2% to 22% in five years, and the report calls the move "often an architectural requirement rather than a preference" for fully public-cloud organisations (survey findings). That holds for provisioning into the tenant. It does not hold for knowing who holds which conflict.

How does MTC Skopos analyze a Public Cloud tenant?

Export six workbooks from the tenant's standard apps. Each is a normal Fiori table export; the data sits on the sheet named "SAPUI5 Export".
Add a Public Cloud data source in MTC Skopos and point it at the folder.
Select a Public Cloud ruleset and run a users or roles analysis. Findings trace to the business role, the IAM app and the restriction values that create each conflict.

Export	What it provides
Business Users	The user list, with validity and lock status
Business User Role Assignments	Which user holds which business role
IAM Apps - Business Roles	Which IAM apps each business role activates
Restrictions - IAM Apps	Which restriction types and fields each app exposes
Business Roles - Restrictions	Every restriction a role carries, restricted or unrestricted
Business Roles - Restrictions Values	The values behind each restricted entry

The last two exports are a pair. Supply only the restrictions without their values and every restriction looks unbounded, which overstates access and produces false positives. The full field list is in the Public Cloud import guide.

Can the cloud tenant and the on-premise core be analyzed together?

Yes, and for most Public Edition customers this is the point. A typical landscape keeps ECC or S/4HANA on-premise for part of the business, or runs a two-tier setup with subsidiaries on Public Edition. A user who maintains suppliers in one and releases payments in the other holds an SoD conflict neither system shows on its own.

Load both as data sources, supply an identity mapping so JSMITH on-premise and john.smith@company.com in the tenant resolve to one person, and enable the Cross-System add-on. Each system keeps its own ruleset; a cross-system rule names the system each function belongs to. The mechanics are the same as for multi-ERP SoD analysis.

Where does the Public Cloud ruleset come from?

It has to be written against IAM app IDs and restriction fields, so an on-premise ruleset cannot be reused and will not fire against the tenant. Like any ruleset in MTC Skopos, it is yours to own and maintain, kept as an Excel workbook you can review and version. Our consulting team can build one with you, starting from SAP's standard rule set where you already have it. See ruleset maintenance.

What does it not do?

MTC Skopos analyzes. It does not create users, assign business roles or route access requests in the tenant, and it never writes back to it. If you need those workflows, keep SAP Cloud IAG or another provisioning platform for them and use Skopos for the analysis, the remediation plan and the audit evidence.

Frequently asked questions

How do you run SoD analysis on SAP S/4HANA Cloud Public Edition?

Public Edition has no PFCG roles or authorization objects. Access is modelled as business roles that activate IAM apps, limited by restriction types, fields and values. An SoD analysis therefore has to read that model directly, with a ruleset written against IAM app IDs and restriction fields. MTC Skopos does this from six standard exports of the tenant and runs the analysis offline on your own machine.

Do I need SAP Cloud IAG for SoD analysis on S/4HANA Public Cloud?

Not for the analysis itself. SAP GRC Access Control was designed for on-premise and private cloud, which is why Public Edition customers are usually pointed to SAP Cloud IAG. If you need access request workflows and provisioning into the tenant, IAG or a similar platform is the right tool. If you need to know who holds which SoD conflict, MTC Skopos analyzes the tenant from standard exports at a flat €5,736/year, with no integration project.

Which exports does MTC Skopos need from an S/4HANA Public Cloud tenant?

Six xlsx exports from the standard Fiori apps: Business Users, Business User Role Assignments, IAM Apps - Business Roles, Restrictions - IAM Apps, Business Roles - Restrictions, and Business Roles - Restrictions Values. The last two are a pair: the first says a restriction exists, the second carries its values. Without the values, every restriction looks unrestricted and access is overstated.

Can I analyze an S/4HANA Public Cloud tenant together with ECC or S/4HANA on-premise?

Yes. Load the tenant and the on-premise system as two data sources and map each person's accounts to one identity. With the Cross-System add-on, a rule can pair a function in the cloud tenant with a conflicting function on-premise, for example maintaining a supplier on-premise and releasing its payment in the cloud. Each system keeps its own ruleset, because IAM apps and authorization objects are different models.

Can I use my on-premise SoD ruleset on S/4HANA Public Cloud?

No. An on-premise ruleset is written against transaction codes and authorization objects, and it will not fire against a Public Cloud tenant, which exposes IAM apps and restriction fields. Keep a separate Public Cloud ruleset and select it when you analyze the tenant. MTC Skopos consultants can help build it.