SAM Service: SAP Access Management for a Large Scandinavian City
A large Scandinavian city had been running SAP for several years, but access rights issues were recurring: skilled SAP authorization consultants were difficult to source, training and retaining internal staff was challenging, and the overall concept (roles, processes, and responsibilities) was not sufficiently clear.
The Challenge
To clarify the situation and find the best possible operating model, the city decided to run a separate tender specifically for SAP access management. The goal was to overcome recursive access rights issues and the difficulty of sourcing skilled SAP authorization experts.
Our Approach
s4access was selected as the supplier based on the tender results, combining the highest quality score with the lowest total cost. The outsourcing was delivered by adopting s4access’s proven SAP authorization management operating model and tailoring it together with the city.
The service provided a single, end-to-end service covering day-to-day operations and governance, designed to be transparent, controlled, and audit-ready. Key components included:
- Governance model (roles, responsibilities, decision-making, and approvals)
- Service concept and day-to-day ways of working
- SAP authorization management concept
- SAP Access management support and development services
- Automation tools to manage segregation of duties (SoD) conflicts
- Monitoring of production super users (privileged users)
- GDPR monitoring for the SAP system
- License management
Results & Benefits
The new operating model was successfully rolled out, and clear improvements were already achieved during the first year. Handling of access requests became more structured, service predictability improved, and authorization risks could be managed in a more systematic way.
Internal customer satisfaction with the handling of access requests improved, while authorization-related risks were significantly reduced. The end-to-end model clarified ownership and controls, which improved both day-to-day efficiency and audit readiness.
- During the first year, the operating model was stabilized and internal satisfaction with access request handling improved.
- Authorization risk levels decreased noticeably as governance and monitoring became systematic.
- In the second year, both internal and external audits concluded that there were no observations to raise regarding the operation.
Customer Feedback
“Working with s4access has shown us that SAP authorization management is truly a specialized domain that requires a dedicated expert partner. We have continued the collaboration for years, and it has been especially valuable for us: requirements have kept increasing, yet together we have consistently ensured the right level of service without cost increases.”
— SAP Service Owner, large Scandinavian city