Sap: Articles & Insights

In most SoD tool evaluations, the deciding question is not the ruleset. It is where the SAP authorization data goes. Field Notes article 1 covers why these extracts raise the question more sharply than most software, how a decade of default-to-SaaS removed the choice from buyers, the five questions buyers actually asked, and the honest costs of running entirely on the customer's hardware.

Field Notes article 2. The decision to ship MTC Skopos as a signed portable executable came from the consultant's laptop problem: locked-down client machines where nothing can be installed, so the analysis is either a spreadsheet that stops at transaction level or a SQL, Python or Alteryx build that is correct once and thrown away at the end of the engagement. What portable-and-signed solves, why the product is still sold as a subscription when there is nothing hosted, and where SaaS honestly wins.

Field Notes article 4. Large enterprises with fully deployed SAP GRC Access Control kept asking for demos, and so did organisations already running a specialist analyzer such as CSI tools. They were not confused. Detection works; what is missing is everything after the report lands: remediation decisions, fast exploratory simulation, and output a business owner will read. The Excel file every security architect maintains is the market.

A practical guide to SAP authorization design that holds up in production. Covers role architecture, naming conventions, organizational value strategy, least privilege enforcement, critical access monitoring, and the change governance process that keeps your landscape clean over time.

Role redesign projects typically stretch across months of consultant workshops, spreadsheet gymnastics, and back-and-forth validation cycles. The AI Role Designer collapses this into an iterative conversation: provide a functional blueprint, let AI analyze historical usage, generate a new role concept, run risk analysis, and refine until clean. Then build the roles, whether manually or through AI connected directly to SAP.

Payroll postings, treasury transactions, executive compensation - some G/L accounts need tighter access control. Here's how to configure authorization groups with F_BKPF_BES and F_BKPF_BLA in SAP S/4HANA, step by step.

Exploiting SAP used to require both system access and years of domain expertise. AI collapses that second requirement. An attacker with a basic SAP login and a language model can now navigate the system, understand authorization structures, and find exploitation paths that previously took specialists weeks to uncover. What does that mean for how you manage access risk?

A guide to building an accounts payable segregation of duties matrix for SAP, with specific transaction codes, authorization objects, and common AP SoD conflicts.

A technical reference for SAP SoD conflicts: specific transaction code combinations, authorization objects that drive conflicts, and practical detection methods for SAP ECC and S/4HANA.

SAP's FUE measurement model assigns every user a license tier based on their authorization profile, not their actual behavior. That gap between assigned and used access is where organizations hemorrhage money. Learn how the FUE calculation works, what the STAR ruleset actually measures, and how to use MTC Skopos to bring your license position back in line with reality.

Your ECC SoD matrix won't work in S/4HANA. Learn how to build a ruleset that covers Fiori apps, OData services, and the new authorization architecture - without starting from scratch.

A complete guide to building and maintaining your SAP Segregation of Duties matrix, with a free downloadable Excel (XLS) template and best practices for automation.

Segregation of duties: Right team working with the right tool, what normally takes weeks of review without the proper tool, we knocked out in a few days.