Sap-security: Articles & Insights

A brownfield conversion carries your roles over as they are: every SoD conflict, every unused transaction, every workaround added since go-live. A pre-conversion authorization health check baselines SoD on ECC, removes unused access, maps successor transactions and Fiori apps into the ruleset, and designs SoD-free composite roles, in parallel with the migration project.

IAM tools assign business roles: named bundles that grant ERP roles across one or more systems. Approval workflows see the bundle name, not the authorizations behind it. MTC Skopos now imports business roles alongside your ERP exports and analyses the access they grant exactly like direct assignments, with full attribution, simulation, and remediation.

Critical access is a category of access risk separate from Segregation of Duties: transactions that cause damage on their own, without needing a conflicting partner. This guide lists the critical transactions every SAP environment should monitor, explains how to detect them with access risk analysis, and shows how MTC Skopos catches them in the same pass as SoD.

Over-privileged users are the quiet third category of access risk, behind SoD and critical access. They hold authorizations that expand their fraud surface, inflate FUE licensing, and create audit findings, even though nothing about their daily work requires the access. This guide explains how privilege creep happens, how to detect it with access risk analysis, and how to remediate without breaking business operations.

A practical guide to SAP authorization design that holds up in production. Covers role architecture, naming conventions, organizational value strategy, least privilege enforcement, critical access monitoring, and the change governance process that keeps your landscape clean over time.

Payroll postings, treasury transactions, executive compensation - some G/L accounts need tighter access control. Here's how to configure authorization groups with F_BKPF_BES and F_BKPF_BLA in SAP S/4HANA, step by step.

Exploiting SAP used to require both system access and years of domain expertise. AI collapses that second requirement. An attacker with a basic SAP login and a language model can now navigate the system, understand authorization structures, and find exploitation paths that previously took specialists weeks to uncover. What does that mean for how you manage access risk?