Right-Size Security, Right-Size Spend:
The New SAP
Licensing Reality
Establishing and maintaining well-designed, right-sized security is now synonymous with maximizing your SAP investment. This guide explores how an expert, targeted license review can set you on the right track, and how it’s already helped organizations like yours…
What you'll learn:
The new SAP licensing equation: Better security = Lower costs
Moving to RISE with SAP on S/4HANA? If you haven’t already, you’ll likely receive an attractive migration offer from SAP. But what do you need to know before signing on the dotted line?
One critical and often overlooked consideration is the automatic transition to SAP’s new Full Use Equivalent (FUE) licensing model. Under this model, your security provisioning – specifically your roles and authorizations – directly determines your licensing costs. What you pay is based on what users are authorized to do; not what users have executed.
The FUE license model represents a significant and potentially costly change for your business. One that even SAP's promotional discounts won't offset if your roles and authorizations aren't optimized before migration.
.svg)
If you don't prioritize security and controls early in your project, you won't understand your future exposure. While the ROI case is clear for reducing license costs, moving security elements to the start delivers even further value by ensuring you avoid audit fees, and remediation efforts by getting it right first time.
Simon Persin, Global Practice Director for Risk, Security and Controls, Turnkey Consulting
.svg)
Understanding FUEs: Why roles and authorizations are key
Under the old model in ECC, licensing could be adjusted based on actual usage. Despite how roles and authorizations were structured, organizations could supply evidence that users weren’t using all the functionality available to them to move users into lower (and cheaper) license tiers.
However, negotiation is no longer possible under the new FUE-based system. Now license pricing is based on the roles and the authorizations within them, that are assigned to users, whether they make use of them or not. The more complex roles and authorizations provisioned, the higher the charges will be. That means there is now a direct link between your SAP security posture and how much SAP will charge.
Roles and authorizations explained
Roles
High-level access groups determining what groups of users can and can’t do on certain tasks or with certain data sets.
.svg)
Authorizations
The technical permissions that allow users to conduct specific processes within the roles granted to them.
While scaling FUEs back to a minimum level may seem like the best choice from a cost perspective, increasing FUE counts to accommodate infrastructure needs could be the best way to future-proof larger infrastructures. Explore this table to understand the interconnected nature between your SAP system size tier and FUE counts.
Usage Tier
|
System Size
|
T-Shirt
|
Database/Application
|
PRD
|
QAS
|
DEV
|
|---|---|---|---|---|---|---|
|
60 to 135 FUE
|
XXS
|
256
|
HANA DB
App Servers
|
256Gib memory
256GB usable storage
1 x 64GiB memory
|
No QAS system delivered
No QAS system delivered
No QAS system delivered
|
256GiB memory
256GB usable storage
1 x 32GiB memory
|
|
136 to 550 FUE
|
XS
|
256
|
HANA DB
App Servers
|
256 GiB memory
256GB usable storage
1 x 64GiB memory
|
256GiB memory
256GB usable storage
1 x 64GiB memory
|
256GiB memory
256 usable storage
1 x 32GiB memory
|
|
551 to 1000 FUE
|
S
|
512
|
HANA DB
App Servers
|
512GiB memory
512GB usable storage
1 x 64GiB memory
|
512 GiB memory
512GB usable storage
1 c 64GiB memory
|
256GiB memory
256GB usable storage
1 x 32GiB memory
|
|
1001 to 200 FUE
|
M
|
1024
|
HANA DB
App Servers
|
960GiB memory
960GB usable storage
2 x 64GiB memory
|
960GiB memory
960 usable storage
2 x 64GiB memory
|
256GiB memory
256GB usable storage
1 x 32GiB memory
|
|
2001 to 4000 FUE
|
L
|
2048
|
HANA DB
App Servers
|
1,922GiB memory
1,922GB usable storage
2 x 128GiB memory
|
1,922GiB memory
1,922GB usable storage
2 x 128GiB memory
|
512GiB memory
512GB usable storage
2 x 64GiB memory
|
|
4001 to 6000 FUE
|
XL
|
3072
|
HANA DB
App Servers
|
2,944Gib memory
2,944Gb usable storage
4 x 128Gib memory
|
2,944GiB memory
2,944GB usable storage
4 x 128GiB memory
|
512GiB memory
512GB usable storage
2 x 64GiB memory
|
|
Above 6000 FUE
|
XXL
|
6144
|
HANA DB
App Servers
|
5,700GiB memory
5,700GB usable storage
4 x 128GiB memory
|
5,700GiB memory
5,700GB usable storage
4 x 128GiB memory
|
512GiB memory
512GB usable storage
2 x 64GiB memory
|
The risks of overprovisioning
Beyond security concerns, overprovisioned roles and authorizations also have cost implications under the FUE model. But, as many organizations don’t have a full picture of their current SAP security design, most will be in the dark about how it will impact their FUE licensing.
An S/4HANA Trusted Authorization Review (STAR) report is the natural first port of call. Running the STAR report applies SAP’s predefined license rule set to the current user base to establish your FUE needs. However, the STAR report doesn’t consider the specifics of your user estate, security position or business processes, and won’t identify areas to find efficiencies and reduce licensing commitment. This is why reviewing the report in detail and remediating any overprovisioning before submitting the results to SAP is essential to cost avoidance.
“When running your STAR report, do not send the results straight to SAP - Turnkey can help you analyze the output without sharing the details. If a STAR report showing significant over-use is submitted to your SAP rep, they may use this as leverage to contract based on your unoptimized security provisioning.”
Doug Gibson, Managing Partner, Invictus Partners
Three steps to right-sized licensing
Before moving to the FUE model and involving SAP, organizations must first fully review their current roles and authorizations and assess options for making changes. In short:
01
Review
Examine SAP usage company-wide to gain an understanding of how current security provisions will affect your license count.
02
Right-size
Map actual usage to current roles and authorizations and develop a target licensing requirements model that matches business goals and needs.
03
Remediate
Make targeted improvements to right-size your license count according to business goals and needs.
STAR report reality: 100 users become 1000s
One of our clients thought their licensing needs were straightforward: their ECC system had fewer than a hundred professional users. But, due to inflated access levels and misaligned processes and roles, their STAR report revealed that they'd require thousands of licenses under the new FUE model.
.svg)
One review, four business advantages
Beyond minimizing unnecessary costs, a license review can also act as a catalyst for positive change throughout your organization:
Cost avoidance
Stripping out unnecessary license costs ensures expenditure is optimized – from the outset and on an ongoing basis, too. While rates can be adjusted and renegotiated over time, it’s easier and more cost-effective to right-size your estate at the earliest possible opportunity.
Smooth migration
The fewer roles and authorizations you have, the fewer there are to migrate over to the new system. Getting security right from the outset makes your migration more efficient and reduces the risk of hitting roadblocks.
.svg)
Improved user experience
Ensuring users have all the access they need, and none of the access they don’t, streamlines their user experience. They’ll get simplified processes and a simplified menu, all while keeping data and systems safe.
Stronger security and compliance
Auditors look for right-sized roles and authorizations in your SAP estate, so a license review helps deliver on those expectations and ease SAP audit and compliance processes.
Your potential ROI: Real results from our license reviews
45%
Reduction in FUE costs
.svg)
£500,000
License costs savings
1,300 → 650
FUE license reduction
Find out more about maximizing the opportunity of FUE licensing.
.svg)
Your journey to optimized licensing
Whatever the size and complexity of your SAP estate, and whatever your current licensing position, Turnkey’s comprehensive SAP license review and remediation process will get you where you need to be.
Built on more than two decades of experience in developing SAP security models that align roles and authorizations to business requirements, SAP access governance needs, and long-term plans for growth, our tried-and-trusted, four-step process includes:
Phase 1
User analysis and target state creation
We start by engaging with your internal SAP team and analyzing your STAR report, access data, and usage information.
Using our accelerator-driven methodology, we compare your actual system usage and current role allocation to identify discrepancies and potential efficiencies. We then use our findings to provide your organization with a target security and license model.
Phase 2
Quick wins and role impact identification
We pinpoint potential ‘quick wins’ through a role impact assessment to ensure the benefits of the license rationalization can be felt at the earliest opportunity. This includes evaluating which roles and authorizations need remediation or redesigning to fit the target model and prioritizing those that can be addressed easily and quickly.
.svg)
Phase 3
Roadmap creation
We create a roadmap specific to your target security and license model, featuring all the required remediation and redesign activities needed to get you there, as well as all relevant forward-looking infrastructure requirements.
Presented in a digestible, accessible format, the roadmap is designed to help you articulate the return on investment of license rationalization – both in security and cost terms – to C-level stakeholders.
Phase 4
Targeted role remediation
At your direction, we can remediate your SAP roles and authorizations to fully align with your target security and licensing model. This work varies depending on your specific requirements but often includes: removal of unused or unnecessary roles; role remediation to mitigate license inflation caused by the FUE model; and user remediation to ensure users are aligned to the new authorization solution.
Ultimately, we recognize that SAP licensing is a business decision. This is why we recommend thoroughly assessing your potential FUE exposure before any data is shared with SAP. With Turnkey’s support, you can reduce costs, improve security, and streamline user experiences based on the principle of least privilege, ensuring you get the best outcome for your business and from SAP.
.svg)
.png?width=380&height=780&name=lime-triangles%201%20(1).png)
Maintaining long-term value
After license review and remediation is completed, we recommend re-running the STAR report to allow for comparison with the ‘old’ proposed license estate and quantify the savings and efficiencies made.
But this is not necessarily the end of the story. Business and licensing requirements will naturally evolve over time, making ongoing monitoring and optimization an essential task. Turnkey can help you stay clean, providing periodic license review and/or ongoing access governance support through our Bedrock Managed Service.
When do we help?
No matter where you are on your S/4 transformation and licensing journey, we can help.
Before
Strategic advisory and road mapping
Engaging with us before you “do the deal” will offer the best level of protection and help you get the best deal.
During
Review and remediation
Helping you meet your predictions in FUE’s to avoid any nasty surprises.
After
Ongoing management and optimization
Keep yourself in check with your planned FUE profile. This will also strengthen your negotiating position for the next time around.
.svg)
Expert guidance for your FUE optimization journey
The benefits of understanding SAP’s FUE model and cleaning up your organization’s roles and authorizations far outweigh the costs of a license review.
When you partner with Turnkey for your SAP license review and remediation, you’ll benefit from a best-fit approach that molds around your organization’s specific requirements. You’ll gain a detailed understanding of your current licensing position, what it means for your organization, where to make changes, and just how beneficial those changes will be.
We help you bridge the gap between process, technical, and commercial, based on years of experience and our alignment to your business goals. That way, you can migrate to S/4HANA on RISE in full confidence that you’re doing so with the most secure, cost-effective, and rationalized roles and authorizations possible.
Optimizing FUEs and enhancing operations
We helped one of our clients halve their FUE total from an initial 1300 to a target of 650. Not only did this drastically reduce license fees in the long term, but it also reduced risk by restoring the ‘least privilege’ access principle; boosted compliance by removing unnecessary access; and improved efficiency by cutting operational friction, process delays, and administrative overheads.
Datasheet download
Aiming to perfect your RISE transition? Find out more about our RISE Right License Review Process here.
Services
Resources
Find Us
Turnkey HQ:
58 Ayres Street
London
SE1 1EU
© 2024 Turnkey Consulting Ltd